Recent surveys for the state of email security are in for 2019, and we are seeing more of the same that has been reported in years past. In a Barracuda sponsored survey of email security, most organizations admit to being completely unprepared to deal with today’s email security challenges.
The 2019 survey responses show the following results:
- Ransomware and Phishing are top two security risks for organizations today
- Most organizations were victims of email security attacks in 2018 – (82%)
- Organizations continue to under invest in innovative products that protect email from these todays changing email attacks (spear phishing attacks, account take over, or URL based malware attacks.
- The cost of email attacks is increasing with 25% of the respondents reporting that attacks cost them over 100,000
- About 90% of Survey Respondents have REAL concerns with Office 365 lack of email security. This ranges from spear phishing attacks to malware and account takeovers
Here are 5 steps that organizations can take immediately to reduce risks posed by email cybercriminals in 2020:1. Upgrade email security from Office 365
Microsoft’s Office 365 email security, known as Advanced Threat Protection is about 3 years behind technology already in the market from other security vendors. Review of your current email and malware protection systems are an essential element of proper security planning. Email security products built by Barracuda Networks, Proof point and Mimecast all provide advance protection for email, which provide defense against spam, and malware delivery. These systems have superior technical capabilities to Microsoft Advanced Threat Protection (ATP), such as an integrated ability to whitelist or mark domains as safe, and scanning for embedded malware threats.2. A Formal Security Compliance Document is Essential
This document should provide the framework for how employees handle, share and store sensitive data. The policy should address password management systems, password policies, how frequently data is backed up and acceptable use policies for both company owned and employee owned devices, applications and services. (think social media accounts.)
3. Build a Multi-Layer Defense for Email Security
Additional layers beyond basic email security that protect against the ever increasing sophistication of attacks, include sandboxing attachments, time of click URL analysis, A/I scanning of email and attachments. We also suggest that firewall perimeter security and network access control systems are reviewed for security effectiveness as part of a comprehensive security plan.4. Review Your Office 365 Tenant Security Settings
We have personally witnessed attacks on O365 tenants that have taken advantage of clients that have not reviewed or modified default security settings in their cloud email service. Review your O365 security rules that govern basic security for the service. How many administrators do you have in your organization that can make changes, the fewer the better! Make sure that ALL IT personnel authorized to make changes use a domain admin password, instead of their personal credentials. Also prevent ANY rule change originating from a source address outside of your domain, (this is a common way for criminals to initiate account takeovers).5. Implement E-Mail Usage Best Practice and Regular Cloud Backup Procedures
All employees, but in particular Sr. Executives, and Financial / Accounting Dept. Employees should be aware of the risks of providing personal information on social media accounts that can be used by cybercriminals. All employees should adopt passwords on email systems, which are very DIFFERENT from personal accounts in use. Further ALL email systems, including Office 365 email should be regularly backed up by an outside cloud service, as Microsoft does not guarantee data beyond 30 days within Office 365.