Email is by far the most popular attack vector for cyber attackers. They use email to infect their target with malware or trick them into giving up their credentials and other sensitive information. In fact, not only is email the most popular vehicle to deploy ransomware attacks, but it’s also the most effective way of reaching the target.
In 2020, approximately 94% [1] of attacks were delivered by email, and phishing attacks account for more than 80% [2] of reported cybersecurity incidents, causing $17,700 in losses per minute [3].
It wasn't supposed to be like this. In 1971, a bearded computer genius named Ray Tomlinson, the ‘Father of Email’, sent the world's first email [4] out of a desire to create a more convenient way to communicate with his peers.
His work went on to revolutionize communications and radically changed the way businesses and people communicated with each other. Twenty years later, in 1991, millions of people were sending millions of emails a day to each other. Apart from spam - which first appeared in the 1980s - email was a wonderful way to increase productivity, communicate and collaborate.
Email was easy to set up, nearly free to send and receive, and a godsend for businesses globally. It enabled them to communicate almost instantly over large distances without paying for postage stamps or sending a communication via fax machine.
But then, in 1996, the word ‘phishing’ appeared in hacker circles. ‘Phishing’ was an analogy for fishing, with internet scammers using email ‘lures’ as ‘hooks’ to fish for AOL (an early internet provider) credentials. They’d cull these credentials from a sea of unsuspecting internet users to surf the internet for free. The letters ‘ph’ in the word phishing was a nod to phone phreaking, an earlier form of hacking used to get free phone calls.
It took some time for phishing to turn from an innocent way to get free internet access to an automated mass-market cybercrime capability by organized cybercriminals. But by 2010 we were there, and ten years later, email is the number-one way to attack an organization. In 2020, email is no longer just a booster of commercial productivity; it is also a major attack vector and source of cyber risk for any business.
Businesses know this, which is why businesses are spending more money on cyber-awareness training. The purpose is to train employees not to trust out-of-the-ordinary email requests and not to click on attachments without first verifying that the sender can be trusted. Tremendous efforts are made to educate users on the potential dangers of email and to turn them into an organization’s first line of defense against email attacks.
Of course, this does help stem the tide, but it suffers from one fatal flaw. Humans will always be human, and phishing attacks are designed to play into the human psychological condition. You cannot fool all of us all the time, but you can fool some of us some of the time.
No matter how savvy, trained, and educated a user is, we are all susceptible to a finely-crafted phishing email, especially when we are in the middle of a busy workday. We can all be tricked no matter how careful or cyber aware we all are.
The sad truth about antivirus software and firewalls is that they can never block malicious emails from inboxes. At least, without blocking for senders on a whitelist, and even then, a trusted sender's email can be compromised. Secure Email Gateways help somewhat, but they rely on known signatures and rules to detect and identify malicious emails, which rely on those gateways recognizing known signatures only. Still, the bad emails slip through.
What organizations need is an additional layer of email security, an automated platform that proactively blocks malicious emails before they can reach inboxes. This is where CyGuard Email Protection comes in.
CyGuard Email Protection is an evolution of the secure email gateway that adds an intelligent layer of security to your email. It is built from the ground up to deploy ‘in the cloud’ and effectively secure cloud-based email and collaboration tools like Office365, Google Workspace, Slack, Microsoft Teams, Dropbox, and Google Drive to defend against phishing attacks and malware payloads.
CyGuard Email Protection is an addition to the default security layer provided by your cloud services vendor. It leverages artificial intelligence (AI) to defend against zero-day attacks, scan all external incoming email traffic and internal email traffic to deal with a rapidly-evolving phishing threat landscape.
The beauty of CyGuard Email Protection is its inline API-based approach that tightly integrates with your cloud infrastructure in a way that does not require any infrastructure or routing changes, enabling a frictionless deployment. It is this ability to link directly with your cloud provider's native API that makes CyGuard Email Protection so powerful. It provides real-time and historical data on users, the files they send, and any security events they generate.
It also gives the capability to manage and control universal policies by mapping the users and their permissions with each cloud provider into a unified threat management interface, enabling policy control across all SaaS communication and file-sharing applications.
There's more to learn about CyGuard Email Protection and how it protects you from external and insider threats. Get more information here.
References:
1. https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html ;p 2. https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html
3. https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html
4. https://www.raytheon.com/news/feature/ray_tomlinson