The Dangers of the Inbox

Every now and then, an email with a catchy subject line appears in your inbox prompting you to click it. It might contain an intriguing subject line or familiar name. Unfortunately, most cyberattacks begin through these seemingly innocent circumstances.

Inadvertently clicking on malicious links opens your business to dangerous cyberattacks. According to ProofPoint’s Human Factor 2019 report, more than 99 percent of cyberattacks require human interaction to succeed. Therefore, email security should be at the top of your business’s cybersecurity concerns.

This blog will explain how cybercriminals use emails as their weapon of choice, the most common cyberthreats that may appear in your inbox, and how you can adequately counterattack.

The Art of Cyber Deception

The psychological nature of cyberattacks is surprisingly strong. Cybercriminals use deception to hit targets and prompt irresponsible action.

Attackers constantly develop and deploy sophisticated social engineering tactics to fool their targets. Experts observe that attackers update their designs to improve efficiency. Elie Bursztein, the leader of Google’s anti-abuse research team explains that “They quickly adapt and keep the number of targeted users low. This makes it really hard to detect.”

Google reported that 68 percent of phishing emails blocked by Gmail were new variations that had never been seen before.

Cybercrime is constantly evolving to match advancements in technology. Being overconfident in your defenses is not a viable stance anymore. It is time to adopt a proactive approach to counteract cyber deception.

Cyberthreats That Infiltrate Your Inbox Regularly

Here is a look at the most common attacks that appear in your inbox.

Phishing/Spoofing/Identity Deception

Phishing involves hackers deploying various social engineering tactics to tempt users into clicking on malicious links and to unwittingly give up confidential information. Hackers invest a tremendous amount of effort into assuming the identity of a trusted source, because they need YOU to let them into the system. Once in, they can install malware on your network’s systems, access and misuse sensitive data, or simply lock personal systems and demand a hefty ransom.
Data suggests this is a growing threat. Verizon’s 2020 Data Breach Investigation Report stated that 22 percent of all breaches in 2020 involved phishing. Even well-informed users fall prey to such attacks. In a study conducted by BullPhish ID, 18.6 percent of users that clicked on simulated phishing campaigns demonstrated a willingness to submit credentials or requested data.

Business Email Compromise (BEC) and Spear Phishing

In a business email compromise (BEC) scam, the attacker hacks into your business email account to impersonate someone from your business. This is an attempt to defraud your company and stakeholders into sending money or sharing sensitive data. Spear phishing works in similar fashion, wherein the attacker tricks the user by creating the illusion that an email comes from a trusted source.
A GreatHorn report stated that BEC attacks ballooned by nearly 100 percent in 2019.

Account Takeovers

Taking identity impersonation one step further, account takeovers exploit your compromised credentials and target the financial stability and reputation of you and your business. Cybercriminals can access bank accounts and financial statements to carry out fraudulent transactions. The 2020 Global Identity and Fraud Report by Experience revealed that 57 percent of enterprises reported higher fraud losses due to account takeovers.

Simply put, the attacker will not just target your business. It will use your business as a gateway to exploit customer data simultaneously.

Malicious Malware and Viruses

Although used interchangeably, malware and viruses differ on technical grounds. Malware refers to any type of malicious software no matter how it works, while virus is a specific type of malware that self-replicates after entering other programs. Nonetheless, both pose an enormous threat to your business’s IT environment. CSO Online revealed that 92 percent of all malware is delivered via email, which is why we’ve included it in our list. Again, all it takes is a simple click for an attacker to gain access to your network and plant malware or a virus.

Ransomware

A ransomware attack occurs when a hacker breaches your network’s security, encrypts data, and demands ransom to restore it. Your business could come to a complete standstill while you deal with this problem. To put this into perspective, Q2 2020, average ransom demands were pegged at $178,254, 60 % higher than in Q1 2020 and a whopping 432% higher than in Q3 2019 ($41,198).

Investigations performed on previously confirmed Ransomware attacks have not shown definitive evidence of theft or exposure of data – only the encryption. However, within the last year, there have been change-ups in the behavior of Ransomware strikes. Hackers have changed tactics and are now claiming to EXFILTRATE COPIES of DATA BEFORE encrypting it. They then leverage additional blackmail threats, including data exposure, if the ransom demand is not paid.

Even if you opt to pay the ransom, you have no guarantee the attackers will provide the means to decrypt and restore your data. You are also not certain the data will not be sold, exposed, or targeted for a direct attack in the future.

Insider Threats: The Human Element

Insider threats are posed by individuals within your organization or closely related to it, such as vendors, partners, as well as current and former employees. Users can ignorantly or malevolently let an attacker into your system, leaving sensitive data exposed.

According to Verizon’s 2020 Data Breach Investigation Report, over one-third of data breaches worldwide involved internal actors. An Egress study revealed that 31 percent of employees have mistakenly sent an email containing sensitive data to the wrong person.

While confidence in your employees is well-founded and justified, we ought to remind you – to err is human!

Misconfigurations

Last but not least, misconfigurations in email platforms can expose your network to a host of threats. For example – sending emails without authentication. If a cybercriminal exploited this vulnerability and sent out emails impersonating an executive, you would be knee deep in managing a full-blown PR crisis.

It’s Time to Engage All Defenses

According to the University of Maryland, A cyberattack takes place almost every 39 seconds (or approximately 2,240 times a day). The time to upgrade your email security is NOW. The best solution is a two-pronged approach – implement the best cybersecurity solutions and provide your employees with extensive security awareness training.

We offer solutions for everything from endpoint security and backups, identity and access management, automated phishing defense, and Dark Web monitoring and security awareness training. While a 100% fail-safe cybersecurity option isn’t a reality yet, we can certainly walk you through a list of the best practices to protect you and your business.