The Minefield of Corporate Email

Email security challenges CISOs as cybercriminals target corporate inboxes with malware, phishing attempts, and various forms of fraud.

Employee email accounts are prime targets for fraudsters, phishing attacks, and malware delivery as hackers assume someone will click, download, or respond to fall into their traps.
The threats causing concern are far from new — in fact, theyre among the oldest. As Cisco researchers point out in a new report, Email: Click with Caution, spam is 40 years old and phishing is over 30. Over time theyve grown in prevalence and
sophistication
, joined by malware and fraud as criminals find new ways to cause problems for security practitioners.
It seems never-ending sometimes, the kinds of threats that arrive through email, says Ben Munroe, director at Cisco Security, who also says the fact that its still a problem for us … is incredible. Things are not getting better and in fact, things are getting worse.
Incredible, yes, but as researchers note in the report, emails structure is an almost ideal format for scammers. Employees are forced to read every message, make judgment calls about what they receive, and decide what to open, click, download, and respond to. The right amount of social engineering can manipulate recipients into accidentally letting attackers in.
More than half (56%) of CISOs say defending against user behavior is very or extremely challenging, Munroe says, citing Ciscos
2019 CISO Benchmark Study
. Only 51% think theyre doing an excellent job managing employee security. Users often get a bad reputation, but its tough when cybercriminals have an advantage and their targets dont know whats coming.
Its not fair for everyone to criticize users for doing what users have to do, he says. Employees have to answer emails, even if an email from their boss came from a hacker. It isnt fair to always say users are not sophisticated — attackers are extremely sophisticated, Munroe adds.
Here, we take a closer look at the emailed threats arriving in their inboxes.
To Click or Not to Click?
Wendy Nather, head of Advisory CISOs at Duo Security, now part of Cisco, says attackers efforts are going in two directions: one is technological; trying to exploit new methods and plant new payloads. The other is psychological, encompassing social engineering efforts. You have to defend both on the technical side and the social engineering side, she emphasizes.
Credential theft is one of the most common email-based scams,
Cisco researchers found
. Cybercriminals send emails from fake addresses ([email protected], for example) and users who click a link are redirected to a fake webpage where theyre prompted to enter credentials. Those go to the attacker, who may use them to log in to other Microsoft services.
Cisco cites an Agari
report
that says 27% of advanced email attacks are launched from compromised accounts — up from 20% in the last quarter of 2018. Microsoft accounts aside, attackers also target popular cloud-based email services like Gmail and G Suite.
Business email compromise (BEC), which caused
$1.2 billion
in losses in 2018, is another threat to watch. Researchers note attackers dont typically use compromised accounts for these; instead, two-thirds of BEC scams still use free webmail attacks and 28% use registered domains. BEC messages are often personalized; one in every five includes the name of the recipient.
Digital extortion, in which attackers try to convince their victims they have footage of them accessing an adult film site or other content, is another lucrative move for attackers. Munroe notes how advancements in technology have changed the game in extortion: the improvement in hardware, allowing all of us to have a camera; the improvement in bandwidth, allowing us to stream video have also driven techniques for malicious activity. Researchers do point out profits from extortion have fluctuated along with the value of Bitcoin over time.
Malware Delivery
Email is still a reliable vector to deliver malware, though attackers have been forced to change their tactics as their victims learned the risk of clicking .exe files. Now, malware is more likely to be served indirectly via documents with less suspicious file types or malicious URLs in messages.
Between January and April 2019, binary files only made up 2% of all malicious attachments. Attackers now gravitate toward .zip files, which make up one-third of attachments. JavaScript files make up 14.1% and, researchers note, and attackers are more frequently using them. Its now the third most-common malicious extension, following .doc (41.8%) and .zip (26.3%).
Throw PDF documents into the mix, and more than half of all malicious attachments are regularly used document types, ubiquitous within the modern workplace, according to the report.
Malware itself has also evolved, Munroe points out. Id say in terms of what theyre distributing — the idea of malware or what you could call modular malware — having landed on a host or an endpoint, its able to detect a number of different parameters about where it is or what to do. Is it in a low-cost environment? Valuable environment? Is there high bandwidth?
That idea is certainly quite worrisome and given email is a prevalent attack vector, its certainly concerning for CISOs, he adds.
Whats a CISO to Do?
The challenge of email security lies in its commonality. Its the mundane nature of email, especially trying to trick people into clicking things they spend all day clicking, says Nather.
Some CISOs recognize different users have different risk profiles, she continues, and they adjust their security practices accordingly. Human resources employees, who have to open attachments all day, or financial analysts, who are prime BEC targets, are some examples. Theyre putting more security controls around them, isolating them more, hardening their systems more, Nather explains. Some employees have different external email addresses.
In the report, researchers explain how to spot a phishing attempt. A few telltale signs:
Sense of urgency:
if it demands immediate action, act with caution and confirm with the sender
Illegitimate-looking URL:
Phishing URLs often look unusual. If its hidden within text, hover over the link for a closer look. Hesitant? Dont click.
Unusual file types:
most business emails rely on the same few file types. If you dont recognize it, dont open it.
Spelling mistakes and blurred logos:
Emails that seem careless may be signs of a phish.
Related Content:
7 Recent Wins Against Cybercrime
What You Need to Know About Zero Trust Security
6 Security Scams Set to Sweep This Summer
Inside the Criminal Businesses Built to Target Enterprises

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
The Minefield of Corporate Email