Are you Effectively Protecting your email?

Considering cyber criminals ‘lazy’ is a huge mistake. They are as lazy as sharks who perpetually swim in search of prey, and the smart play is to follow the path of least resistance. Everybody picks the ‘low hanging fruit’ first. Wolves go after the weakest in the herd. It’s not just human nature, it’s the law of the wild.

The easier it is to hurt businesses and take their money, the more time they have to attack other businesses, and the more money they make. The question every CEO should ponder is: “Have I made myself easy prey?”

Email phishing attacks are by far the most common tactic used to effect a Cybersecurity breach, wherein deceptive emails encourage the end user to click on a malicious link or attachment which releases the malware into the network.

It doesn’t matter if you have the best in-house IT support or outsourced Managed Services Provider (MSP) in the world. NOTHING can reliably prevent an employee from unwittingly clicking on a malicious link or attachment – any more than a fireman can prevent anyone from tossing a lit cigarette into dry weeds. It’s what happens after the fact that separates the Managed IT Services experts from the garden variety ‘IT guys.’

A top-notch MSP will have set up the network defenses to isolate the intrusion in the originating workstation, wipe the computer clean and reinstall the data from any one of several reliable, protected backups – usually within a couple of hours. BUT this all relies on end users who have been trained on what to do when an infection occurs. The first step is immediately switching the workstation OFF – even if it means a hard shutdown.

Email is the river upon which almost all business traffic (and cyber-crime) navigates, and it’s not going to protect itself – no matter what safeguards your IT team has put in place. It is crucial to foster effective cooperation between an aware, concerned workforce and the IT provider.

Business Email Compromise (BEC) is one of the fastest growing forms of cyber-attack.

What is the goal of BEC?

The primary goals of Business Email Compromise attacks are to steal money, gain system access, or compromise sensitive data. They are highly targeted and well thought-out, utilizing a spear-fishing tactic that depends on familiarity with the fake ‘sender’ – someone the recipient knows and seems real, which lures them into a false sense of security that the communication is legitimate, when it is not.

These types of attacks require quite a bit more effort from the cybercriminal than other tactics, but when successful, the payoff tends to be significantly greater.

Typically key executives such as CEOs, CFOs, or a title recognized as possessing financial authority are the targets of these attacks. BEC often involves compromised vendor emails, requests for W-2 information, or requests for large amounts of gift cards - a HUGE red flag – legitimate business does not generally request payment in gift cards (DUH!).

How do I make sure my email is secure?

Paying attention to both the big picture and small picture is critical in protecting your email. Your IT team does the heavy big picture lifting: Next generation firewalls, anti-virus (AV), spam filtering, and so forth. The small picture realm is populated by your employees - the end-users.

If you have failed to empower your employees with ongoing Security Awareness Training, then when you want to find out who is ultimately responsible for the success of a phishing attack, you need to look in the mirror. This is blunt, but true.

Any user, even with the best intentions, and even the smartest workers, can slip up. In the middle of a very busy day, an email shows up that looks like it’s from FedEx - but it isn’t – it’s spoofed (copied), but it has all the right logo and signature and looks like any other FedEx email. It offers a link to check the tracking on your delivery. Maybe you have a package on its way, maybe you don’t, but just in case you forgot if anything is on order, you click to see what it is and your computer becomes infected.

Here are a few handy tips for ensuring that your own email is as secure as possible:
From Technology Safety (techsafety.org) – only the bullet points are included below, but the comprehensive description can be viewed HERE.

1) Use non-identifying information
2) Use a password known only to you
3) Use ate least a two-step verification
4) Review security notifications
5) Use only secure devices
6) Always log in/out
7) Don’t let browser or mobile device remember your accounts/passwords
8) Be judicious as to who gets your email address

Unfortunately, all too often, the tips laid out above are overlooked. One of the inherent challenges of maintaining strong Cybersecurity is that users often view things like logging in/out for every session as cumbersome and time consuming. Obviously, it’s easier to stay logged in if you can, but so is leaving your front door wide open when you go to work, so you don’t have to unlock it when you get home.

Close the door and lock it.