According to a report released by Digital Shadows, a digital risk protection specialist, global assets controlled by money and wealth managers are expected to significantly increase by as much as 5.6% per annum, to reach 147.4 trillion by 2025. This level of wealth attracts cybercriminals looking to steal valuable intellectual property, financial data and proprietary investment strategies through phishing scams and other sophisticated techniques. Unsurprisingly, in its 2021 report, the Financial Services Information Sharing and Analysis Centre (FS-ISAC), discussed an increase in global threats owing to the rapid digitisation of the financial services sector and expects that third-party risk, zero-day vulnerabilities, and ransomware groups will adapt to the changing cyber environment and continue to increase.
Data theft can take many forms. Access to email accounts, for one, can provide a wealth of information on sensitive business operations. In recent times, email has become a choice channel of communication by companies owing to its flexibility in relaying messages from clientele, upcoming activities and team in mere seconds. Sadly, email have also become a target channel for cybercriminals looking to perpetuate data theft. Whether through sophisticated targeted attacks, malware and phishing attacks, business email compromise, or spam campaigns, attackers continue to take advantage of a lack of security implemented on many email systems to carry out their nefarious activities.
Asset and wealth managers who are concerned with proactively avoiding data theft and the consequent financial and reputational damage must pay attention to email security and deploy relevant security controls that greatly reduce the risk of hackers accessing, encrypting or deleting data. 7 security controls to mitigate phishing attacks and bolster email security include:
Screening for malicious attachments and links
While the general rule of thumb is to avoid opening email attachments from people you don’t know, hackers have become more creative and can easily fake an email address to make it look like your boss or a colleague’s. Having an extra layer of security that screens for malicious links and attachments will at the very least, alert your staff if an email or link is malicious and prevent them from causing a breach.
Attachment Sandboxing and Detonation
Attachment sandboxing is a technique that proactively detects malware by extracting an attachment from a message, running suspicious code in an isolated and safe environment and monitoring the behavior and output of the code. This prevents files downloaded from untrusted sources from gaining access to trusted resource or manifesting malicious behaviour that can impact users’ data and devices, thereby mitigating email security risks.
Sender Policy Framework
This email authentication protocol is a technical standard designed to restrict spammers from using your organisation’s domain as the source of an email message. SPF lets you publish a list through your domain name record of all the server IP addresses or domains your organisation uses to send email, making it harder for email senders to hide their identity. A receiving email server can check this list during mail delivery to confirm that email claiming to come from a specific domain has been sent from an authorised source. Emails from anywhere else are treated as spam by default.
DomainKeys Identifies Mail (DKIM)
Like SPF, DKIM is an email authentication protocol that allows organisations take responsibility for transmitting a message by signing it in a way that mailbox providers can verify.
Tagging external emails
A common tactic deployed by cybercriminals is to send emails using the display name of someone within the organisation whilst using an external email. By tagging external emails, users are quickly warns of any suspicious message by including a caution notice for every email that did not originate from within the organisation.
Domain Based Message Authentication, Reporting and Conformance (DMARC)
Domain Based Message Authentication, Reporting and Conformance (DMARC) is another email authentication, policy, and reporting protocol that helps domain owners and mail administrators prevent cybercriminals from spoofing their domain and organisations. It goes further and SPF by ensuring that a digital signature included in the header of each email sent so that a recipient’s email server is able to validate the source. This email standard works by confirming the receiving email service using SPF and DKIM. Once the receiving email service confirms the sender’s identity, the email is forwarded to the receiver’s inbox, otherwise it will mark it as spam.
Quarantine Service
This is an additional layer of protection that restricts potentially malicious emails from reaching your inbox by quarantining it. Users can ultimately choose to move these types of emails to inbox or delete it after due diligence has been carried out.
Types of email security
At Tivarri, we provide cybersecurity and fully managed IT services that keeps your business protected from any phishing attack or email intrusions.
Our market leading hosting desktop and Microsoft 365 based services have been designed to meet FCA and ISO 270001 standards whilst making use of your existing equipment and substantially improving the cyber security of your business. Through a host of features including multi-factor authentication for email, user risk reporting, email access restriction to a list of countries, Microsoft Exchange with Microsoft Defender for Office, external email notification, email system security enhancements, controlled deployment of email on mobile devices, we will ensure that you never have to worry about data theft or phishing scams by significantly enhancing your organisation’s email security.
Contact us to learn how you can mitigate your organisation’s email security risks with Cranberry Cloud.
Sources
