News of security breaches have become commonplace, but we have only yet seen the tip of the iceberg. According to a recent report, the total cost of ransomware is set to reach $1 billion in 2016. Furthermore, hackers are now resorting to whaling or business email compromise – i.e. stealing the business credentials of C-level executives and abusing their authority by tricking employees into making large wire transfers of funds to financial institutions. In the last three years, whaling scams have led to more than $2.3 billion in losses, according to the Federal Bureau of Investigation.
Phishing, ransomware and whaling have one thing in common – they are all email scams. And with the high level of reliance on emails for record keeping, correspondence and collaboration in business; it comes as no surprise that the ubiquitous email is the ‘sitting lame duck’ for cyber criminals. Security vendor Proofpoint’s quarterly threat summary for the first quarter of 2016 shows that there has been a 66% increase in emails containing malicious URLs and attachments over the last quarter in 2015. Compared to the corresponding period in 2015, this represents a phenomenal 800% increase!
Against this backdrop, and with stringent regulations such as the EU General Data Protection Regulation (GDPR); the onus of data security rests fairly and squarely with organisations holding the data.
According to Mimecast, the email security services provider, 91% of attacks start with an email. While many organisations deploy best-of-breed email security solutions, they aren’t integrated with the solution that houses confidential and business-critical information – i.e. the email and document management system. It is a faux pas. Such an approach will streamline the processes and technology to create a strong security foundation in the organisation. It will:
- Automate processes to detect suspicious URLs, identify keywords and match known sources of scams and threats to a blacklist
- Institute best practices around people and processes so that in the event of a human error, the technology steps in to protect the data and the organisation
- Set up ‘governed locations’ in the document management system for sensitive information, protected with features such as multi-factor authentication, and encryption at rest and in motion, to add additional security
- Limit access to confidential information to select members on projects, deals and matters
- Help replace the use of email as a default collaboration tool or restrict unprotected consumer file sharing services (e.g. Dropbox); with similar, easy to use, auditable tools from within the document management system
- Enforce corporate data retention and destruction policies
- Offer analytics to monitor unusual activity
Due to the sophisticated technical expertise of hackers coupled with their vehement resolve to destroy barriers, driven of course by financial gain; a comprehensive approach to security is needed. Due to the ubiquity and pervasiveness of email, it is most definitely the ‘soft touch’. To protect data, integrating email security with information and document management is the ‘low hanging fruit’ – it must be a key consideration as part of the overall security strategy of any organisation. It adds another level of safeguards to data to mitigate the impact of a security breach, if and when it happens.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.