Today, more and more email security risks are developing with alarming speed. Spear-phishing, ransomware, and other malware attacks have become a great risk for many organizations. Therefore, big or small businesses must find ways to protect themselves against emerging email security risks. More than 90% of all cyber attacks have been launched by some form of email campaign. Security breaches may gravely harm either customer or company reputation. Thwarting these assaults requires a multi-layered email security procedure, one that adopts both end user security training, multi-factor authentication, and unified threat management.  One reason for this is that email, by default, is not a secure communication tool.  Hence, organizations should be aware of these risks and take precautions early to avoid security breaches.

Spoofing and Phishing

Email spoofing is where a cyber criminal sends a user an email pretending to be someone the user knows. For example, the sender can change their identity to “someoneyouknow@domain.com”.  By changing their identity, the criminal can trick the user into providing sensitive information.  Email spoofing is easy to do, and very difficult to trace.

Phishing is also a dangerous method used by cyber criminals to fool users into providing sensitive information such as bank accounts or social security numbers. Sometimes cyber criminals include graphics and logos in the email to trick the end user into thinking it is a legitimate email request for information. They even give a link that seems to be real. Yet, the link takes users to a malicious web site. Because spoofing and phishing are more common ways cyber criminals use to attack end user accounts, we highly recommend enabling two factor authentication on your email accounts, deploying a firewall with Unified Threat Management (UTM) such as a WatchGuard Firebox, and ensuring security levels are set properly on all Microsoft Office 365 user accounts.  For our SWARM clients, one of the services we provide by default is to ensure your Microsoft Office 365 tenant has the proper security levels set.

Client-Side Attacks

Attack vectors for internet users are increasing day by day. A link containing malicious content can be enough to zip up the files on your computer and hold you for ransom. E-mail security must be strengthened with anti-phishing solutions such as Ironscales.  Using Ironscales end users can proactively reduce phishing attacks by identifying those threats simply by clicking on a button in Outlook. The threat is contained a removed from all end user mailboxes. BBTech is an Ironscales partner.  If you would like to learn more about Ironscales, or any of our other security products, call sales at 214.210.4415 option 2 to schedule a demo and trial.

Harmful Files

When malicious content in the email attachment reaches the user, it may take the whole computer system and network down by encrypting files in an unreadable format. This is known as Ransomware.  Once anyone gets infected, a ransom must be paid to decrypt the data.  For a successful anti-phishing solution, we recommend a tiered approach to securing your network from harmful files.  A tiered approach includes a firewall which includes a unified threat management subscription, behavioral based anti-virus program like Sentinel One and Cyber Security training.

Misconfigurations in Office 365

This is a very common security problem. A poorly configured Microsoft Office 365 tenant can lead to serious security breach.  For example, a cyber criminal may try to brute force your password.  If your email password is weak and contains dictionary words, the criminal can break into your Office account within minutes.  One they are in, they have access to all your files stored in SharePoint, OneDrive and email. Once in, they can send a random e-mails to your employees. A cyber criminal who imitates the CEO may be more likely to succeed at gaining access to business bank accounts, etc.  For our SWARM clients, one of the services we provide by default is to ensure your Microsoft Office 365 tenant has the proper security levels set.

Storing Passwords in the Browser

Never save passwords in a browser like Chrome, Edge, etc.  If your laptop or desktop where to be stolen, the criminal has access to your personal accounts. We highly recommend using a password manager like LastPass or Dashlane.

End User Awareness Training

Another crucial point to consider is a cyber criminal will bypasses all security precautions if the end user is not trained in spotting Cyber Attacks. Since 97 % of people around the world cannot identify a sophisticated phishing email. Users should be trained regularly to be aware of the threats via phishing tests, exams, questionnaires and game.   For our SWARM clients we offer FREE Cyber Security Training.   If you are looking for a more robust Cyber Security Program, we offer that too.  This program, called Breach Prevention Platform (BPP), provides continuous education and monitoring, dark webs scanning, simulated phishing, employee vulnerability assessment, security risk assessment, a library of security policy documents, and more.

File Format Exploits

Moreover, file format exploits are becoming one of the primary information security threats for many enterprises. Attackers exploiting these vulnerabilities create carefully crafted malicious files that trigger flaws (such as buffer overflows) in applications. These vulnerabilities are substantially alarming since they often cross platforms. For example, a file format vulnerability in Adobe Acrobat might allow an attacker to create a single malicious PDF file that compromises Windows, Macintosh and Linux systems.  To combat these forms of exploits, we recommend Sentinel One as a security solution.

Conclusion

Keeping your business secure from harmful files, exploits, ransomware, malware, etc. should be taken seriously. At BBTech Solutions, we take protecting our clients sensitive data very seriously.  We have partnered with industry leading security companies to ensure our clients data is never compromised or lost.  To learn more about any of the products or services mentioned in this article, call our sales department at 214.210.4415 option 2 to schedule a demo or a free trial.