Is Ransomware Data Recovery Impossible?

Is Ransomware Data Recovery Impossible?

by | Jul 5, 2024 | Backup, Email Security

“I will find you and I will decrypt you”

Unfortunately, we can’t call up Liam Neeson if our data is encrypted via ransomware. Although he is a man with a particular set of skills, we do have to take proactive steps to ensure we can recover from ransomware.

What if you don’t have backups, is all hope lost?

How can we recover files from ransomware and what steps can we put in place to improve ransomware data recovery?

How Does a Ransomware Attack Typically Work?

There are several different entry methods for a ransomware attack, most of which involve malicious software. Ransomware encryption typically works by using a combination of symmetric and asymmetric encryption methods to lock and encrypt files.

Infection: The ransomware infects the victim’s system, often through phishing emails, malicious downloads, or exploiting vulnerabilities.

Key Generation: Once on the system, the ransomware generates a unique pair of keys for encryption: a public key and a private key. The public key is used to encrypt the files on the victim’s computer, while the private key is saved by the attacker.

File Encryption: The ransomware scans the system and network shares for files and encrypts them using the public key. This encryption is often strong and cannot be broken without the corresponding private key. The private key, which is needed to decrypt the files, is transferred and stored by the attacker.

Ransom Demand: The victim is presented with a ransom note via malicious software or through email demanding payment, usually in cryptocurrency, in exchange for the private key. If the victim pays the ransom, the attacker may provide the private key to decrypt the files.

It’s important to note that paying the ransom does not guarantee that the files will be decrypted or that the attacker will not demand more money. Additionally, ransomware can also include tactics to increase pressure on victims, such as threatening to publish the encrypted data or incrementally deleting files until the ransom is paid.

In most cases, it is best to contact your country’s federal cybercrime division or police department to assist with any ongoing investigations. In some cases, they have dedicated teams to help with ransomware data recovery and available ransomware recovery processes.

The Evolution of Ransomware

Response Strategies for a Ransomware Attack

When it comes to ransomware attacks, as with so many other business risks, planning ahead is vital. If you have a well thought out and practised Incident Response Plan, you’ll be more prepared and will respond to the attack in a more effective way if you implement the proper email security technology approach.

This can drastically improve ransomware data recovery time and reduce the risk of the ransomware spreading.

Record Important Details: Note down all known locations that have been encrypted along with the encryption extension. The ransom note or software can help identify the type of ransomware and in some cases, certain ransom keys have been broken or otherwise leaked online. This can greatly assist with ransomware data recovery.

Turn off the Infected Device: Ensure that the infected machine is disconnected from the network and shut down after you have recorded details. Removing the machine from the network is crucial to prevent the spread of infection or encryption.

Disconnect your Other Devices: Check your network to ensure that no other devices have been encrypted or infected. If any are identified, immediately disconnect them from the network.

Change Important Passwords: Ransomware can be known to locate and extract passwords stored on devices or in files. It’s very difficult to determine the scope of the attack so as a general recommendation all important passwords should be changed from a clean machine.

How Do You Report a Ransomware Attack?

It’s crucial to record all details about the attack, as they can be helpful for any professional assistance, insurance claims, legal claims, ransomware data recovery or informing authorities. Remember, paying the ransom does not guarantee the return of your data and may encourage further criminal activity. It’s best to consult with professionals and follow the reporting procedures outlined by your company and law enforcement agencies. This is because, in our ransomware surveys, we found that more than half of the business owners are concerned about the security of their critical data.

Ransomware Attack Survey 2023

Techniques for Restoring Files After a Ransomware Attack

Several techniques can be leveraged for ransomware data recovery. Although we want to focus on proactive preventative measures, the steps below should be considered when looking to recover from an attack.

Implement an Incident Response Plan: As already mentioned, an effective response plan can be critical to ensuring that the blast radius of a ransomware attack is reduced, and the correct steps are followed to improve your chance of ransomware data recovery. The plan should include items such as: information collection, logging, communication internally/externally, legal requirements, investigation procedures, remediation steps and post-attack review.

Decryption Tools: Some ransomware encryption can be decrypted. This is why recording the ransomware information can be crucial. It’s best to reach out to a professional recovery team to help identify if your data can be decrypted without restoring from backup.

Restore from Backup: This can generally be the primary method of recovering files from ransomware. However, you must have good backup procedures in place before you need them. It is common for backups to become encrypted during a ransomware attack, therefore you need to ensure that your backup systems are isolated from production systems. If your backup storage is in the cloud, consider implementing immutable storage, which can’t be altered or deleted by anyone, including your own administrators. Regularly testing individual file, folder, Virtual Machine and system recovery is also important, as this will greatly assist in a crisis when the pressure is on to bring the business back to a working state quickly.

To properly protect your email technology environment from a potential ransomware attack, use Hornetsecurity’s hybrid approach email services such as:

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

Conclusion

The short answer to our question of “if ransomware data recovery is impossible” is no. There are a growing number of variants that can have their decryption keys applied but also good backup practices are the key to ensuring your data and business are protected.

FAQ

Is it possible to recover files from ransomware?

Yes, in most cases ransomware data recovery can be achieved if you have adequate backup systems in place, this isn’t usually a difficult task. If you do not have backups, then in some cases you can decrypt the data if the ransomware has been cracked by online communities.

What percentage of ransomware victims get their data back?

Excluding the victims who were able to restore their data from backup, according to a 2024 report from Sophos, approximately only 8% of victims who paid the ransom regained access to their data. This reinforces that paying for ransomware is usually not a good solution.

Is ransomware difficult to remove?

Typically, removing the ransomware software itself can be achieved by most Antivirus software but the decryption of data is where it becomes more difficult.

How long does it take to recover from ransomware?

This depends on a few factors. Do you have backups in place? Are they relevant and not encrypted? If you don’t have backups, are there decryption keys available for the variant?

In most cases, decryption takes as long as encrypting. Backup systems can take some time to restore depending on the amount of data encrypted but as a safe estimate allow at least 2-3 days of business downtime to recover. To sufficiently recover from ransomware proactive measures need to be in place.

HIPAA Compliance Training: Empowering Healthcare Staff with Cybersecurity Awareness

HIPAA Compliance Training: Empowering Healthcare Staff with Cybersecurity Awareness

by | Jul 3, 2024 | Compliance, Email Security

Addressing the human factor in healthcare cybersecurity, this post explores the importance of ongoing training and education for healthcare personnel to mitigate risks and uphold HIPAA compliance standards. It aims to spark thoughts on ways to improve the effectiveness of current procedures, create new ones, and protect your patients’ privacy.

The Weak Link in HIPAA Compliance: Humans

The technology world has no shortage of vendors and experts that work tirelessly to strengthen compliance in processes and products. Hornetsecurity’s 365 Permissions Manager product serves as a powerful example. However, we must always remember one standout word in the HIPAA acronym: “Accountability”. This applies to people, not technology.

Technological HIPAA solutions can work wonders for the “Portability” bit of the acronym. They also facilitate the vital “privacy” component of the law. Software can prevent unauthorized users from viewing sensitive information. A program can require all its communications to use encrypted channels. Unfortunately, nothing can prevent all accidental, negligent, or malicious activity.

The previous paragraph deliberately sorted “malicious” after “accidental” and “negligent”. Attackers draw everyone’s attention with mass havoc, but smaller HIPAA leaks with no ill intent occur almost constantly. As a patient leaves the building, a receptionist may exclaim, “I hope that rash clears up quickly, Susan!” loudly enough for everyone in the waiting room to hear. A provider might leave their appointment calendar open on a screen within a patient’s line of sight. A harried office worker might place a printed document with protected information where anyone standing at the front desk can view it. A group of doctors might discuss an interesting patient case using the patient’s name – in a crowded restaurant. You have no doubt witnessed multiple HIPAA violations that went unnoticed and unaddressed.

Technology will never stop those small leaks. It also can’t help when someone triggers HIPAA’s “Accountability” provisions. To ward that off, healthcare organizations must focus on staff training.

Why HIPAA Violations Occur So Frequently

The following criteria were used to score the Olympic federations and committees, and build our rankings:

  • Has Email Security Gateway: Having an email security gateway is crucial because it acts as a barrier against various email-borne threats such as impersonation attempt, phishing, malware, etc… and can ensure the continuity of email services.
  • Has SPF record: An SPF record is important because it helps prevent email spoofing and protects against phishing attacks by specifying which mail servers are authorized to send emails on behalf of a domain.
  • SPF record is good: Here, we’re considering SPF records effectiveness, for instance whether they are configured with a “softfail” option, which is weak.
  • Has DMARC record: DMARC is crucial for preventing email spoofing and phishing by authenticating emails and specifying how to handle those that fail authentication, ensuring only legitimate emails reach recipients.
  • DMARC record is good: We consider DMARC records to be good when they receive a positive mark on a scan, such as from https://tools.sendmarc.com/.
  • Immune to bypass: Email security bypass is an old trick, but it is still working these days. This means that an organization has not restricted access to their email server, and as such, an attack can completely bypass their email security solution and directly reach their email server.  A recent paper on the topic: https://sumanthvrao.github.io/papers/rao-www-2024.pdf

Using the above criteria we created a very simple grading system. We built two different scales,  one for countries which had an email security gateway, one for those who did not, and attributed different weightings of the scoring criteria depending on our assessment of the respective contribution to email security.

Your People Mean Well

Many HIPAA violations happen simply because people don’t associate their actions with privacy breaches. People are helpful and trusting. It seems logical to expect that the average person that chose a career in healthcare has an even more helpful and trusting personality than the average person in another line of work. They know their patients and feel comfortable with them; why would they worry about that open file? A good provider would never dream of exploiting personal health information for their own gain; why would they suspect any regular person of it? To get the best help for a patient, a doctor might need the counsel of other doctors; why would anyone eavesdrop? The office won’t flow well if nurses don’t deliver information as quickly as possible; who would ever take advantage of an uncovered paper document? The idea of attackers as shady looking characters has pervaded the public consciousness to the point that few of us see threats in people that look “normal”. That’s especially true when those people are also our customers and patients.

Your People Have a LOT to Do

We must also remember that healthcare workers are busy people. Regulations and training place an additional burden on them. No one wants to take the extra moment to cover or uncover a document when they have dozens or more to handle along with all their other high priority duties. Insisting otherwise or trying to shame people into changing their behavior doesn’t help.

HIPAA Compliance Sounds Complicated

The overwork problem goes beyond daily activity. Healthcare workers also deal with substantial requirements for periodic credential renewals. Adding in HIPAA training can feel like another time-consuming annoyance of buzzword-filled box-checking busywork. Acronyms and the word “compliance” only make it all worse.

Viewers and readers struggle to absorb material that does not capture interest, content that does not make things easier, and activities that they do not feel use their time in a valuable way. HIPAA training that does not take this into account will have little effect on preventing breaches.

Account for Human Nature in Training Material

You cannot build an effective HIPAA training program that does not take these factors into account. Acknowledge that people frequently do not understand that a particular action qualifies as a HIPAA violation. Realize that the attitude of “I’m too busy, it will be OK just this once,” infects everyone.

Ways to Improve HIPAA Training Effectiveness

Fundamentally, you can make the most improvements to training procedures by understanding the barriers to learning. The preceding sections looked at those, and you likely have ideas of your own. Next, you must face the challenge of implementation. The following subsections outline a few suggestions to augment your plans.

Keep It Short and Simple

I believe that “Keep It Short and Simple” has become the modern, inoffensive expansion of the age-old “KISS” principle. Whatever words you prefer, the basic meaning holds. You know that people don’t want to sit in training. You know that they don’t like acronyms and buzzwords. Prepare accordingly. Avoid long-winded explanations. Don’t show blocks of legal text.

You might develop some sort of short saying, such as “Protect Patient Data the Way You Protect Patient Lives.” Of course, people often react to pithy mantras with eye rolls and exasperated sighs, but they still remember them. If the knowledge sticks, the training worked.

Instead of trying to “teach HIPAA compliance”, envision what you want people to understand and embody, and explain that. A few examples (some restatements of the same ideas):

  • No one other than the patient and their care team should know anything about the patient
  • The patient’s business is nobody else’s business
  • No release form, no information
  • What happens in the exam room stays in the exam room
  • The bad guys are always listening

Remember to address this topic from the angle that healthcare workers want to help.

Connect Arcane Data to Relatable Points

Healthcare workers work in healthcare, not the law. Don’t dazzle them with legalese. They do need to know the basics of what HIPAA means. They must also understand common acronyms, like PHI (personal health information). When you introduce such terms, immediately link them to something that anyone can understand.

  • For HIPAA, you might include a statement along the lines of, “if we lose control of patient information, we lose patient trust”.
  • With PHI, you can include something like, “Jill does not want everyone in town knowing that she was treated for hemorrhoids”.

While you have a legal obligation to obey HIPAA, it happens to align with most people’s morality about private information.

Give It Entertainment Value

Corporate and professional training does not need to follow sterilized tradition. Elements that perk up the presentation help to grab and maintain interest. You don’t need Hollywood-grade production value to make an impact.

However, if you have access to product design resources, use them. You might have talented individuals in your marketing department that can help. Numerous online and college courses exist to help with modern business communication. You can use these tools for much more than a HIPAA class.

Two things help: humor and shock. Both require awareness and finesse (drab corporate presentations arose from failure to employ these intelligently and respectfully). Humor can involve a mascot figure delivering your sayings. Shock can come from examples of HIPAA fines and violations. Since not everyone understands that a seemingly innocuous activity could lead to a breach, you should have little trouble finding ample material. Again, lean on internal and external resources with experience for help.

Reinforce Training with Reminders

Your technological toolbelt contains more than prepackaged, purpose-built applications. You likely have control over the lock screens and screensavers of office systems. You might also have overhead monitors for information presentation. Use these to rotate in HIPAA reminders. A few examples:

  • The first rule of PHI is that we do not talk about PHI.
  • Your patient can’t see this, can they?
  • Has anyone other than you seen your calendar?
  • Did you remember to turn that document face down?
  • Who overhead that diagnosis?

Many offices have routine internal communications, such as newsletters. Use all delivery methods at your disposal to disseminate small reminders.

Foster a HIPAA-Compliant Culture

Because compliance depends so greatly on moment-to-moment behavior, it may require a shift in “normal” behavior. Changing that requires more than an hour in a training room. Small, frequent, pervasive reminders help. Recruiting informal “HIPAA Ambassadors” to model behavior works in some environments. Periodic recognition for activities such as avoiding or correcting HIPAA violations create positive incentive. Avoid responses that shame as they typically cause more resentment and rebellion than positive change.

You can leverage the “Accountability” component with most people. Legally, it primarily means that violations can result in fines. However, the word also means that healthcare workers have a duty to patients to keep personal health information private. This gives a “shared and individual responsibility” aspect that resonates with most people.

Don’t Forget Those Bad Guys

Throughout all your HIPAA training and culture modification efforts, remember that the “bad guys” are real. If patient information wasn’t valuable, no one would be trying to steal it. You want staff to remember that they can’t recognize an information thief through everyday interactions. This hearkens back to things already discussed, such as reminders of, “No release form, no information.” The knowledge that someone out there might have nefarious reasons to ask too many questions or listen a bit too closely can put enough of an edge on those reminders to help staff retain them.

Therefore, it’s time to take it seriously, as your organization could face a situation similar to that of Change Healthcare.

Like humor and shock, this topic needs mindful presentation. You do not want to build an environment of constant fear and mutual distrust. Most people in a healthcare setting want to help others get better or receive treatment.

What the Change Healthcare Cyber Attack Means for the US Healthcare Industry 2

Shake It Up

As the proverb goes: “Familiarity breeds contempt.” Repeatedly presenting the same material, no matter how well made, will eventually cause staff to stop taking it seriously. Don’t create a bit of material and consider the task finished. Start with something simple. Refine it continually. Reword phrases. Replace sayings for a time and reintroduce them later.

If you can build a solid HIPAA-compliant culture, this becomes somewhat less important. People will always need reminders and refreshers, of course.

Keep Sight of the Goal

While we all wish for a single, magical HIPAA training course that we can deliver once to everyone and they retain forever, that will not happen. Accept that you will need to create and maintain material that keeps up with people in a way that they can understand.

Most importantly, remember that effective HIPAA training depends on simple and relatable presentation. Appeal to what your healthcare employees do best: care for the patient.

How 365 Permission Manager Can Help Streamline Compliance

365 Permission Manager is a powerful tool that can streamline HIPAA compliance and make it easier for healthcare organizations to manage permissions and protect patient data. It offers automated permission management with simplified access control, ensuring only authorized personnel can view patient data, thereby reducing the risk of unauthorized access. Furthermore, regular audits keep permissions updated for ongoing HIPAA compliance. 365 Permission Manager’s intuitive dashboard makes it easy for staff to manage access levels, while real-time alerts notify administrators of unusual access attempts.

Enhanced security features protect patient data, preventing data breaches and ensuring confidentiality, in line with the principle, “Protect Patient Data the Way You Protect Patient Lives.”

To ensure HIPAA compliance and safeguard your healthcare environment, utilize Hornetsecurity’s Security Awareness Service to educate your employees on securing critical data. Additionally, the 365 Permission Manager is a powerful tool that streamlines HIPAA compliance, making it easier for healthcare organizations to manage permissions and protect patient data.

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

FAQ

Why is HIPAA compliance important for healthcare staff?

HIPAA compliance is crucial to protect patients’ personal health information (PHI) from unauthorized access, ensuring privacy and trust. Violations can lead to severe legal penalties and damage to the organization’s reputation.

How can healthcare staff prevent accidental HIPAA violations?

Healthcare staff can prevent accidental HIPAA violations by receiving regular training, being aware of their surroundings, covering documents containing PHI, and ensuring conversations about patients are private.

What role does Hornetsecurity play in enhancing HIPAA compliance?

Hornetsecurity offers solutions like 365 Permissions Manager, which help manage and secure email communications, ensuring that unauthorized users cannot access sensitive information, thereby supporting HIPAA compliance.

Understanding Email Security Technologies and the Power of Hornetsecurity’s Hybrid Approach

Understanding Email Security Technologies and the Power of Hornetsecurity’s Hybrid Approach

by | Jun 11, 2024 | Email Security

Email delivered threats such as phishing, malware attachments and Business Email Compromise (BEC) are still the number one favorite attack vector for cyber criminals. And they’re not letting up, with new flavors of attacks being tested every day. It just takes one legitimate looking email to sneak through into a user’s mailbox, and an unsuspecting user to click a link or open an attachment to open a door into your business for the bad guys.

In this article we’ll explain and provide a comparative analysis of the two main approaches to email security. We’ll then look at a few fictitious companies that suit one approach over the other and finally demonstrate how a hybrid approach, such as the one deployed by Hornetsecurity 365 Total Protection, offers the best of both worlds.

What are the Most Common Approaches to Email Security?

Email security isn’t a new problem. Even a decade ago when most businesses were still running their own email servers, they either had to install software on their edge servers to filter out the dross or subscribe to a hosted service to filter the incoming email feed before it reached said servers.

Today most organizations rely on hosted email, with Microsoft 365 and Google Workspaces being the most popular options. This provides the foundation for the two different approaches: Secure Email Gateway is the single point cloud service where all the incoming emails to your organization are filtered, and clean emails are delivered to your mailboxes.

The other approach is using Application Programming Interfaces (APIs) in the email cloud service to detect and respond to email threats, often called Integrated Cloud Email Security (a term coined by Gartner in 2021). This isn’t an either / or proposition either, you can combine both techniques, something called Hybrid Cloud Email Security.

Secure Email Gateway

This is the older of these two methods, having its roots in the appliances or hosted services that businesses used a decade or two ago. They filter incoming and (often) outgoing emails, removing spam, malware, and other threats, sometimes also providing data loss prevention by identifying sensitive data in outgoing emails. They can also encrypt outgoing emails with standard TLS (formerly SSL) encryption, as well as other approaches such as DNS-based Authentication of Named Entities (DANE), Mail Transfer Agent-Strict Transport Security (MTA-STS) and venerable encryption protocols such as S/MIME and PGP.

email filtering

Secure Email Gateway

An in-depth exploration of DANE and MTA-STS are beyond the scope of this article but suffice to say that they make sure that traffic between mail servers on the internet are always protected with TLS encryption, and not susceptible to attackers changing IP addresses in the DNS infrastructure.

Not all Secure Email Gateway servers are created equally, and their defense mechanisms vary. Often, they apply advanced threat protection features such as opening attachments in sandbox environments to identify signs of malicious activity or use Machine Learning (ML) to identify potentially misleading or dangerous language in the text of a phishing email.

Once an email has been deemed safe and delivered to user’s inboxes, these gateways have no way to remediate threats if it’s later discovered that the message was malicious.

A big benefit of Secure Email Gateways is that all external email pass through them (if used for outgoing filtering as well), enabling easy archiving and journaling opportunities, to fulfil compliance regulatory requirements, as well as enabling e-discovery. These gateways also employ current technologies for identifying spam, phishing and spoofing and protecting organizations email reputation such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC).

They can also apply corporate template signatures to all outgoing emails, and because they’re a separate service they can provide continuity if Exchange Online or Google Workspaces is having an outage, providing webmail access, and queuing of emails until service is resumed. Depending on the service, there may limited integration with other security tools and services – if for example a user’s workstation becomes infected with malware, it’d be nice to easily know if they received any suspicious emails in the last few hours.

Finally, as a central service, they can provide excellent reporting and statistics on traffic volumes, threats detected, and actions taken.

They require some setup, and they’re not easy to “try out” in a proof of concept, because you must redirect your organization’s email domains (company.com) to the Secure Email Gateway service by changing the Mail eXchanger (MX) DNS entry. This will tell every email server on the planet where to send any emails for your domain, so you can’t do a test setup with just a few users for example.

Integrated Cloud Email Security via an API

The rise of large scale, cloud hosted email services such as Microsoft 365 and Google Workspaces have also spawned new integration points that weren’t available in the old on-premises world. The lifeblood of cloud services are APIs and the ease with which they facilitate integration between different services, and email is no exception.

These cloud services can easily integrate AI and ML for threat detection into user’s mailboxes (temporarily blocking access to delivered emails until scanning is complete), and unlike a gateway, they have continuous access to the entire platform, so that if an email is later identified as malicious, they can reach into mailboxes and delete or quarantine them “after the fact”.

Their ability to provide archiving is controlled by the APIs that the cloud provider offers, in fact, all their flexibility is entirely dependent on what the provider chooses to expose. They generally offer email authentication standards configuration (SPF, DKIM, DMARC) but this again depends on the underlying APIs.

Because they’re dependent on the cloud platform, they can only offer limited support for continuity in the case of an outage, and they don’t manage email encryption with PGP or S/MIME. Integrated Cloud Email Security services also don’t manage routing of emails, instead relying on the cloud platform for handling this. Reporting is likewise dependent on the APIs offered, but integration with other security tools is often excellent (as long as those tools are also cloud services). Being integrated “into the mailbox itself” means they can provide excellent data loss prevention services. If you have a large tenant, your provider must take into account API throttling limits as you can’t overwhelm the capacity of the platform with too many simultaneous requests.

Their real strength shines when it comes to setup – because no infrastructure or MX records need to change, they often only take a few minutes to deploy, and they can be scoped to a set of test users easily.

API - Approach default - (most common)

API – Approach default – (most common)

API - Approach - (safe mode)

API – Approach – (safe mode)

Hybrid Cloud Email Security – The best of both

In many scenarios, a combination of these technologies, like the hybrid model developed by Hornetsecurity, provides the best protection against email borne threats. The Secure Email Gateway will block most low-level threats, whereas the Integrated Cloud Email Security can deeply analyze the text of emails and attachments, using advanced AI and ML models to identify risks. Deployment is seamless, with easy integration into Microsoft 365 and Google Workspaces.

And the strength of each gives a better experience overall, if an email isn’t identified as malicious initially, but then received by other users later and this time blocked / quarantined (perhaps due to updated signatures), the gateway can tell the integrated service to delete the already delivered emails straight away.

During outages you get the benefits of continuing email access, reporting is even more comprehensive as not only incoming and outgoing emails are included, but also internal emails between employees which do not pass through the Secure Email Gateway. Data loss prevention is more comprehensive, with deep analysis of emails by the Integrated Cloud Email Security service, and the option to instruct the gateway to encrypt particularly sensitive emails based on the results.

Finally, because of the API driven nature of the Integrated Cloud Email Security they can extend beyond emails and mailboxes, such as managing permissions for attachments saved to OneDrive for Business from Outlook for example.

Hybrid (MX+API) - Approach - (safe mode)

Hybrid (MX+API) – Approach – (safe mode)

Hornetsecurity’s hybrid technology enables it to leverage gateway technology to provide solutions such as its Spam & Malware Protection, Signature & Disclaimers, Email Encryption, Archiving, and Continuity Service in addition to featured powered by integrated cloud technology such as Advanced Threat Protection, AI Recipient Validation, and 365 Extended Email Protection.

Use Cases

As always in IT, the right solution depends on the specific needs and existing environment of an organization. We’ll look at four different fictitious companies, and their situation and recommend an email hygiene solution to suit.

GlobalTech Inc. is a large multinational corporation that has diverse email services across different countries, including on-premises, Google Workspace and Microsoft 365. In this mixed, complex environment, a single, cloud based Secure Email Gateway service, integrating the different email domains will provide comprehensive control and reporting.

They’ll need to meet varying regulatory requirements in different regions, so enabling data loss prevention and email encryption through the gateway will be crucial. If there are email system outages, they’ll rely on the gateway’s continuance services to minimize business impact. Depending on IT needs, they may also add Integrated Cloud Email Security to their Microsoft 365 and / or Google Workspace tenants.

GlobalTech email system

GlobalTech email system

FinSecure Corp on the other hand relies on secure email communications with their clients. They’ve used S/MIME for many years to ensure end to end protection and non-repudiation of emails (proving that the sender of an email hasn’t been spoofed) and rely on DANE to mitigate the risk of criminals performing attacker-in-the-middle attacks against their email infrastructure. They will rely on a Secure Email Gateway service to enforce email encryption policies, and to demonstrate compliance with stringent regulations that are common for financial services firms.

FinSecure Corp

FinSecure Corp

Our third example is CloudInnovate, a tech startup in Silicon Valley, relying exclusively on SaaS cloud services for collaboration and email. They’re growing rapidly and require an easy to integrate service for their cloud-first strategy. They’ll use an Integrated Cloud Email Security service for Microsoft 365 for easy scaling and providing advanced AI and ML protection against emerging threats.

TechGen Robotics

CloudInnovate

Finally, TechGen Robotics, a leading robotics research and development company, operates at the forefront of innovation in autonomous systems and AI technologies. They have a lot of sensitive intellectual property, and are financially successful, making them targets for BEC attacks as well as industrial espionage. They’ll use both technologies together to ensure encryption of all sensitive emails (and attached documents), along with deep data loss prevention inspection to protect their IP.

They’ll need the advanced protection in their Integrated Cloud Email Security to identify and stop sophisticated attacks, and use the encryption provided by the gateway to protect communications end-to-end. They need the email continuity provided by the gateway in case of a service provider outage, whilst relying on the advanced protection of the API solution to inspect emails and attachments, including when those are saved in cloud storage.

CloudInnovate

TechGen Robotics

Conclusion

Hornetsecurity’s cutting edge email security solutions relies on providing both a Secure Email Gateway and Integrated Cloud Email Security for complete protection. As you have seen, both approaches have their strengths and weaknesses and by combining them, you truly get the best of both worlds, and the cleanest possible email feed.

365_Total_Protection_1200x628_EN

FAQ

What is the difference between Secure Email Gateway and Integrated Cloud Email Security?

Secure Email Gateway filters incoming/outgoing emails via a cloud service, while Integrated Cloud Email Security uses APIs in email platforms like Microsoft 365 to detect/respond to threats within the platform itself.

Why should I consider a hybrid approach for email security?

A hybrid approach to email security is necessary for certain businesses because relying on just one solution leaves gaps in protection. Secure Email Gateway (SEG) offers robust threat detection and compliance features but lacks continuous scanning and advanced threat protection capabilities. Conversely, Integrated Cloud Email Security (ICES) provides real-time scanning and post-delivery threat remediation but may not offer the same control and compliance as SEG. Additionally, businesses can reduce dependency on a single technology, mitigating the risk of vulnerabilities. A hybrid model also offers scalability and flexibility, allowing businesses to adapt their security measures as they grow and their needs evolve.

How does Hornetsecurity’s hybrid model improve email security?

Hornetsecurity’s hybrid model enhances email security by blocking most threats with a Secure Email Gateway and using Integrated Cloud Email Security for advanced threat detection and response, providing seamless integration and robust protection.

AI in Cybersecurity: How Large Language Models Are Changing the Threat Landscape

AI in Cybersecurity: How Large Language Models Are Changing the Threat Landscape

by | Apr 24, 2024 | Email Security, Security Awareness

Since late 2022, we’ve seen a dramatic rise of Large Language Models (LLMs) based AI in the form of ChatGPT (Generative Pre-trained Transformer) and its cousins. There’s been quite a lot written about how these tools will impact cyber security.

In Hornetsecurity’s 2024 survey, a staggering 45% of business leaders voiced concerns about AI exacerbating the threat landscape. This alarming trend mirrors the global rise of AI-driven malicious activities, with threat actors leveraging automation and sophistication to orchestrate attacks.

The UK’s National Cyber Security Centre (NCSC) has also noted a troubling consequence: AI is democratizing cybercrime, enabling even novice criminals to engage in sophisticated attacks previously reserved for seasoned adversaries.

It is difficult to ascertain with a high degree of certainty if malicious emails were created or enhanced by LLMs, primarily because if they’re good, they’ll look indistinguishable from a well (hand) crafted phishing email.

However, these are the areas where we know that LLMs are having an impact on cyber security:

Code quality: GitHub Copilot (and other similar tools) is showing some quite astonishing improvements in productivity for developers, both beginners and seasoned hands. While there are safeguards in place to stop these tools developing obvious malware they can be circumvented, so it’s very likely that malware developers are using these tools to crank out more malicious code faster.

Sophisticated phishing: Drafting and enhancing phishing and especially spear phishing emails. We have an example of one of these below, but it’s probable that criminals are using these tools to fine tune their wording to achieve maximum results. Again, various LLMs have safeguards in place to stop these sorts of malicious uses, but they can often be bypassed. There are also GPT tools that lack these safeguards, such as WormGPT and others. Hornetsecurity’s 2024 survey revealed that 3 in 5 businesses describe AI-enhanced phishing attacks as their top concern.

Translating attacks into other languages: Many Phishing and Business Email Compromise (BEC) defenses are tuned for English, having less success stopping attacks in other languages. There are also geographies around the world where phishing and BEC attacks have been uncommon up until now, making the average finance department worker less suspicious (Japan, other countries in East Asia, and Latin America comes to mind). Here, we’re likely to see a surge in attacks based on the ability to translate emails into near perfect prose, by attackers who aren’t fluent in the language, expanding their potential target pool manyfold.

Targeted research: To pull off a successful spear-phishing attack, or social engineering phone call attack on helpdesk staff, requires detailed understanding of a company, individuals that they’re impersonating and their relationship to others in the hierarchy. Traditionally this is often done through LinkedIn, company websites research and the like, but with the advent of LLM based search engines, this is changing. As you’ll see in our example below, AIs can help immensely with this task, and shorten the time investment required.

To demonstrate how easy it is to generate a phishing email through an LLM we decided to create our own. The following is an attack on Andy Syrewicze, a Technical Evangelist here at Hornetsecurity. Here is the initial research prompt and output:

The following is an attack on Andy Syrewicze, a Technical Evangelist here at Hornetsecurity

As you can see, a simple prompt provides a detailed breakdown of a social engineering strategy to target Andy drawing on his professional and personal online footprint. Something that would take far longer to achieve manually.

This is then followed up with a very convincing draft of a spear-phishing email for Andy.

This is then followed up with a very convincing draft of a spear-phishing email for Andy

The email generated here is of a much higher quality than the average phishing email and far more likely to succeed. The personalization of the references and context demonstrates how effective AI tools such as LLMs can be in crafting targeted spear-phishing attacks.

Why We Fall for Scams

A thorough investigation of social engineering and hacking human psychology is a topic for an entire book on its own, here we’ll just focus on the highlights to bring an understanding of the basic characteristics that make us so susceptible.

A well-crafted phishing email has the following characteristics:

  • It’ll blend in and be part of the normal communication flow. We’re used to receiving emails about a parcel delivery, or a notification from our bank, or a reminder from our boss, so a fake email with the same characteristics is less likely to raise our suspicions. It has the right logos, structure, format, and it looks like the expected sender so we’re more likely to take the requested action.
  • It’ll appeal to our emotions. The most important part of any social engineering endeavor is to bypass the cold, logical thinking part of our mind (Cerebrum), and activate the emotions and the “fight or flight” center (Amygdala) so that we take actions we wouldn’t normally contemplate. Some approaches will appeal to greed / reward (“click here for free tickets”), some to shame / embarrassment (“I’ve got video recordings of what you did last night”), or fear / dread (“I need you to transfer this amount now or you’ll be fired”). The most common appeal is urgency; when something needs to be done “right now”, we tend to skip past our normal, suspicious questions and just get it done, often to avoid feeling the uncomfortable emotions mentioned any longer.
  • It’ll have a requested action that’s not too unusual. Examples include providing personal details to your “bank”, something we remember having to do when opening an account in a new bank or resetting our network password by clicking a link and being presented with a normal looking sign-in page.

The whole effect of an effective phishing lure is short-circuiting our questioning rational mind by invoking emotions and urgency and providing an easy way to “fix the issue” quickly.

This leads us neatly to the next step – the importance of security awareness training for all your users.

User Training is Crucial

This cannot be understated; you cannot build a cyber-resilient organization without involving every single person who works there. This starts with the basic awareness of asking someone unknown who isn’t wearing a badge in the office to identify themselves, and if the answer doesn’t stack up, calling security.

When someone calls you claiming to be from the IT helpdesk and asks you to approve the MFA prompt you’re about to receive on your phone, don’t assume they’re telling the truth. Always double-check their credentials first to ensure that it’s a legitimate request.

What you’re trying to foster is “polite paranoia”, making it normal to question unusual requests, and understanding the risk landscape and sharpening instincts. Most people who work in businesses aren’t cyber or IT savvy and weren’t hired for those skills. However, everyone needs to have a basic understanding of how identity theft works in our modern digital world, both in their personal and professional lives.

They also need to have a grasp of the business risks introduced by digital processes, including emails.

By having this context they’ll be able to understand when things are out of context or unusual and have enough suspicion to ask a question or two before clicking the link, wiring the funds, or approving the MFA prompt.

And this isn’t a once-off tick on a form to achieve compliance with a regulation.

Often, the long, tedious, and mandatory presentations that organizations conduct once a year or quarterly, followed by multiple-choice quizzes, are perceived as time-wasters by the staff. They want to rush through them quickly and typically forget any insights gained.

Instead, the training program should be designed to be ongoing, consisting of bite-sized, interesting, immediately applicable, and fun training modules combined with simulated phishing attacks to test users. If any user clicks on a phishing email, they should be given additional training.

Over time, the system should automatically identify users who rarely fall for such attacks and interrupt them with infrequent training, while the persistent offenders are given additional training and simulations on a regular basis.

The other reason for ongoing training is that the risk landscape is continuously changing. Some months ago, malicious emails with QR (Quick Response) codes to scan were the exception, now they’re a very familiar sight, requiring ongoing awareness of staff not to scan them on their phones (outside of established business processes).

Security experts often lament the priorities of staff, saying, “if they only took a second to read the email properly, they’d spot the signs that it’s phishing”, or “they just don’t take security seriously”.

This is a fundamental misunderstanding of the priorities and psychology of the average office worker, clicking a link in an email will at most get you a slap on the wrist, not fulfilling an urgent request by the boss can get you in serious trouble or even fired.

And this is why the entire leadership, from middle managers all the way to the C-suite must lead by example. If they do and communicate their understanding of the basics and secure processes, staff will follow suit.

But if the CFO requests an exemption from MFA or bypasses security controls regularly because “it’s more efficient”, there’s no chance that his underlings will take cyber security seriously.

A Day in the Life at Cyber Resilient Inc.

What does it look like at an organization that has embraced this approach? First of all, no one fears speaking up or asking “silly questions” about weird emails or strange phone calls. If there is an incident and someone clicks something they shouldn’t have, there’s no blaming and accusations, it’s not personal, there was a failure of a process.

This brings a strong sense of psychological safety, an important foundation for cyber resiliency.

Transparency is promoted from the leadership all the way throughout the organization. Understanding that we’re all human, we’re “all in this together” and being upfront about making mistakes, without fear of retribution, will improve the cyber resiliency culture.

Talking about new cyber risks and exploring not just business risks but also the risks in people’s personal lives is another strong result of a good security culture.

Our working and personal lives are blended like never before, with people sending and receiving emails from their personal devices, sometimes even working from their personal laptops (BYOD), which means that the risks to the business aren’t confined to corporate assets and networks.

Compromises of users’ personal identities can be used by criminals to then pivot to compromise business identities and systems.

Looking at it in the mirror – in an organization where cyber resiliency isn’t valued, staff will be fearful of making mistakes and be unsure what processes to follow if they think they might have made one. Individuals are blamed when incidents do occur, ensuring that any future issues are swept under the rug to avoid the same fate.

And staff don’t understand IT, they don’t understand the risk landscape and they routinely put the organization at risk because of this lack of understanding.

Implementing Security Awareness Service

As mentioned, it’s important that security awareness training is incorporated into the work life of your users, it can’t be something that’s done once every six or twelve months. Hornetsecurity’s Security Awareness Service was designed with exactly this in mind, providing short video trainings, coupled with spear phishing simulations.

But overworked IT teams also don’t want to spend a lot of time on scheduling training and simulations, so it incorporates the Employee Security Index (ESI) which measures each user’s (and group, department) likelihood to fall for targeted, simulated, attacks.

This is mostly hands-off for the administrators, so the users who need extra training and tests receive it, whereas staff with already sharp instincts are tested less frequently. You can also track ESI over time and see the forecast for it.

Employee Security Index dashboard

Employee Security Index dashboard

There’s also a gamification aspect where users can compare themselves to others, which creates a strong incentive to be more cautious and sharpen instincts. The training material is available in multiple languages.

Another benefit of the Security Awareness Service is the statistics, it gives the security teams and business leaders data to understand the current risk profile of their staff, and where boosts of extra training might need to be deployed.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection and Advanced Threat Protection strategies.

Discover the latest in cybersecurity: How to Spot a Phishing Email in The Age of AI. Learn how AI fuels sophisticated phishing attacks and gain actionable insights to protect your business.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

Everyone in business today is somewhat aware of the risks of cyber-attacks, phishing messages, and identity theft. It’s essential for businesses to recognize that cybersecurity threats are constantly evolving, especially in the age of AI.

Threat actors are leveraging AI tools to create sophisticated phishing attacks that can lead employees to click on malicious links or disclose sensitive information. The phishing samples we’ve shared should serve as a good source for communicating the signs of scam emails to your staff.

FAQ

How are Large Language Models (LLMs) impacting cybersecurity?

LLMs, such as ChatGPT, have significantly altered the threat landscape by enabling automation and sophistication in malicious activities. They’ve democratized cybercrime, allowing even novice criminals to conduct sophisticated attacks. Specifically, LLMs are enhancing code quality, refining phishing emails, translating attacks into multiple languages, and facilitating targeted research for social engineering attacks.

What characteristics make phishing emails successful?

Successful phishing emails blend seamlessly into normal communication flows, evoke emotions such as greed, shame, or fear, and prompt urgent actions. They mimic the appearance of legitimate messages, utilize familiar logos and formats, and contain requests that seem plausible, like providing personal details or clicking on links.

How can organizations improve their cyber resilience?

Organizations can enhance cyber resilience through comprehensive user training, which fosters a culture of “polite paranoia” and encourages questioning unusual requests. Continuous, engaging, and practical training modules combined with simulated phishing attacks help users recognize and respond to threats effectively. Leadership plays a crucial role in setting the tone for security awareness and adherence to secure processes throughout the organization.

What Your Employees Need to Know About Phishing + Real-Life Examples

What Your Employees Need to Know About Phishing + Real-Life Examples

by | Apr 18, 2024 | Email Security

In this article, we’ll present a series of real-world phishing emails, with personal details altered or obfuscated to protect the innocent.

These are useful for training users to spot the clues that something is trying to trick them, so feel free to use these in your training materials.

Real-Life Phishing Examples

Let’s start with a classic, the Nigerian prince scam, also known as an advance-fee scam. These try to make victims believe that they are the recipients of a large amount of money (emotion trigger: greed), but to receive it, they must pay a fee (“transfer fee” or “handling fee”). Here’s a simple example:

“transfer fee” or “handling fee”

Note the use of gift cards – criminals can’t use the standard international bank transfer system (Swift) as their funds would be blocked very quickly, and asking normal users to transfer crypto currency is also a dead giveaway – thus, the gift card request, a very common tactic.

A second clue in this email is the poor use of grammar and English, which is always a sign of something fishy but will likely be less prevalent in the coming months as generative AI tools become commonplace. Does this email really sound like it would have been sent by someone at JP Morgan Chase bank with the last name Angel?

Next is the phishing category, starting with a spoofing email. Spoofing is using various techniques to make it appear as if the email is coming from one sender when, in fact, it’s sent from an attacker’s email address. In this example that’s American Express, amex.com. This email also employs the tactic of making the entire email into an image, to make it harder for anti-spam engines which analyze text. Having SPF and DMARC records in place will block this particular spoofing technique.

spoofing email

The link shown in the image isn’t the one that an unwary user will open if they click it, which is why it’s important to train users to hover over suspicious links before clicking them (which is easier on computers than on smartphones).

Humans, including security experts, are poor at identifying malicious URLs (because they were never designed to be an indication of trustworthiness), but the fact that the link text you’re seeing on the screen doesn’t match the actual link target is enough to know that it’s a scam.

If you do click, you’re taken to a phishing page with a sign-in prompt, which looks like it’s an American express site.

Note the scroll bars however, it’s a webpage, made to look like a browser (within the real browser), which you can tell from the scroll bars on the right and at the bottom. Again, the actual domain that the victim is entering their credentials into isn’t the one shown on the page.

real life phishing sample

Another flavor is impersonation, the email below again purports to be from American Express, but the sender is secureAmex@wsfax.com, whilst the display name of the sender is “American Express”. This email isn’t about triggering greed, but rather concern about the “important information” relating to your account.

American Express - real life phishing

Here’s another one from Canada Revenue Agency / Agence du revenu du Canada, again with the actual sending email address being different. This one appeals to greed, with the promise of a refund, clicking the link leads to a credential harvesting page.

Canada Revenue Agency Agence du revenu du Canada - phishing

We have all become accustomed to receiving a lot of packages, and after the Covid-19 pandemic, it has become ubiquitous. In our data, DHL has been the leading company impersonated for a long time, but they were recently replaced by Fedex.

Here are two examples of DHL impersonation emails where the display name doesn’t match the sending email address, with links to click to “update your address”. Note the misspelt word “Packagging” as well as using “Hello Dear” as an introduction, unlikely from a shipping company.

DHL impersonation - phishing
DHL impersonation - phishing 1

Phishing emails frequently use attachments to spring their trap; here’s one purporting to be from DocuSign.

The PDF attachment, obviously not a scanned fax page, looks like a DocuSign document – clicking the link for View Pending Document will lead to a phishing page. The use of a DocuSign-looking page is appealing to the familiarity of the process. many of us are asked to electronically sign documents using DocuSign, so we’re less likely to be suspicious of this request.

DocuSign phishing
DocuSign phishing 1

As mentioned, QR codes have become very popular in phishing emails. There are two reasons for this: firstly, email hygiene solutions were slow to incorporate technology to spot these in emails, scanning the code, following the link, and inspecting the target web page for signs of maliciousness. Hornetsecurity has had QR code scanning in place since early 2023.

Secondly, and possibly the reason why we’re still seeing large volumes of malicious emails with QR codes, is that they move the attack from an often managed, locked down, secured computer endpoint, where most business users read their emails, to a personal smartphone with minimal protection.

Scanning a QR code with your smartphone is second nature for most of us, especially as their use in society is so common, and people don’t expect a bad result from doing it.

Here are three examples of phishing emails with QR codes as the link instead of the traditional weblink or button to lure a victim.

Scanning a QR code - phishing

This QR code leads to a phishing site where the victim enters their credentials to “update their password” but instead, they hand over their username and password for criminals to use in further attacks.

This second example is similar but focuses on the victim updating the Multi-Factor Authentication (MFA) which is about to expire. Note the misspelling of “mult-factor”.

Multi-Factor Authentication (MFA) - phishing

The urgency of this email, with the 24-hour deadline, is again creating a sense that the user must do something about this now or risk losing access and not being able to do their job.

Both of these are particularly insidious because the legitimate set-up process for MFA with Microsoft Entra ID, either with Microsoft’s Authenticator app or a third-party app, involves scanning a QR code. It’ll seem quite normal for end-users to scan a QR code again as part of MFA.

Key here is education of the business staff by the IT / security teams. If there are no legitimate business processes that involve scanning QR codes sent through emails, it is essential to inform everyone to avoid scanning any QR code that they receive in an email.

Additionally, it is recommended to follow up with Security Awareness training, including simulated phishing emails, to test staff and help them sharpen their instincts.

If you do have legitimate business processes that involve QR codes, look to see if they can be sent in some other way than via email, and if they can’t, clarify to everyone that this process does use QR codes, and here’s how that flow works, but don’t scan any outside of this procedure.

This last example introduces a wrinkle with the QR code being blue on a red background, no doubt to bypass email hygiene solutions (Hornetsecurity ATP isn’t fooled and caught these). Note the clumsy grammar “failure to secure your update Mailbox will lead to deactivation”.

failure to secure your update Mailbox will lead to deactivation

If you scan the QR code you’re taken to a credential harvesting page, gathering Microsoft login credentials.

Microsoft login credentials

The key in all these examples to convey to your staff is to be aware of triggering emotions, unusual requests, unusual processes (this isn’t how I normally reset my password), bad spelling and grammar and for QR codes, don’t scan them unless it’s part of a known business process.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection and Advanced Threat Protection strategies.

Discover the latest in cybersecurity: How to Spot a Phishing Email in The Age of AI. Learn how AI fuels sophisticated phishing attacks and gain actionable insights to protect your business.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

In conclusion, understanding the tactics used in real-world phishing emails is crucial for individuals and organizations to protect against cyber threats.

By recognizing common red flags, practicing vigilance, and implementing robust security measures, individuals can defend themselves against phishing attacks, while organizations can fortify their defenses and mitigate the risk of data breaches and financial losses.

Stay informed, stay vigilant, and stay safe in the ever-evolving landscape of cybercrime.

FAQ

What are common characteristics of phishing emails?

Phishing emails often exploit emotions like greed or urgency, feature poor grammar, and employ spoofing techniques to appear legitimate. They may contain suspicious links or attachments and often mimic trusted organizations to deceive recipients.

How can individuals identify and protect against phishing attacks?

Individuals can protect themselves by being vigilant for red flags such as unusual requests, spelling and grammar errors, and unexpected links or attachments. They should verify the sender’s email address, hover over links to check their destination, and refrain from providing personal information unless absolutely certain of the sender’s legitimacy.

What measures can organizations take to mitigate the risk of phishing attacks?

Organizations should implement comprehensive security awareness training to educate employees about phishing tactics and best practices for identifying and reporting suspicious emails. Additionally, they should deploy advanced email filtering and anti-phishing technologies, enforce email authentication protocols like SPF and DMARC, and regularly update security policies and procedures to adapt to evolving threats.

Unmasking Phishing: Understanding the Insidious Threat to Your Organization

Unmasking Phishing: Understanding the Insidious Threat to Your Organization

by | Apr 16, 2024 | Email Security

In this article, we delve into the pervasive threat of phishing and its profound implications for organizational security. Phishing, an ever-evolving tactic employed by cybercriminals, continues to pose a significant risk to businesses worldwide.

From impersonating trusted entities to crafting sophisticated lures tailored to specific targets, the techniques employed by malicious actors are as diverse as they are insidious. Join me as we delve into the intricacies of this perilous cyber threat landscape and explore strategies to fortify organizational defenses against it.

Phishing – An Insidious Risk to Your Organization

Phishing remains the number one attack vector for criminals to establish a foothold in your organization. Even in this day and age of Teams, Slack and their cousins being used for collaboration and communication, email remains the most common way to exchange information with people outside an organization.

And it’s got inertia because it’s been there for so many decades, and everyone knows how to use email, both in their personal and work lives.

This also makes it the perfect channel for the bad guys to “show up in front of” your users, masquerading as someone trustworthy.

At the lowest level this involves impersonating a trusted company – DHL / Fedex (“we’re delivering a parcel and need you to click here to validate the address”), or your bank / credit card company (“click here to validate this anomalous transaction we’ve flagged”).

And of course, there’s the OG phishing scam – “I’m a Nigerian prince with money to give away and I just need you to help me out with the transfer”. These are sent in bulk because even if only 1 in 1,000 makes it through to a user’s inbox and only 1 in 1,000 clicks it, for each million I send, I get one hit.

Stepping it up a bit are more customized campaigns, targeting specific countries or regions, with specific lures related to current affairs and impersonating companies more likely to be trusted by the recipients in that geography.

Finally, we have spear phishing with highly customized lures, sent in much smaller volumes but where criminals have done their homework and use people and companies that your users are already collaborating with, ensuring a much higher success rate.

In all cases – if a user falls for the lure and clicks the link, or downloads the attachment, or enters their login details on the fake sign-in page, the consequences can be dire.

A single click starts the dominos falling

That single click or download can be the start of a major incident. In cybersecurity we talk about the kill chain, the steps an attacker must take to achieve their end goal, which could be theft of your intellectual property, or encryption of all files in a ransomware attack.

There are many variants, and depending on the attacker and the target, not all steps are required but generally they start with Reconnaissance to understand your business and what lures are most likely to generate a click (and your revenue to know how much they can demand in ransom for your files / systems).

This is followed by Compromise, gaining that first foothold, Moving Laterally to compromise other user accounts and systems, achieving control over the environment (“Domain dominance”), Exfiltration of data so that you can be further incentivized to pay the attacker to not have your data leaked. And if it’s a ransomware attack, this is followed by the actual encryption of your files.

And all from that single click by a user – which is why phishing is such an important attack vector to understand and defend against.

The Need for Security Awareness Training

The risk in numbers

Out of the 45 billion emails analyzed  in Hornetsecurity’s Cybersecurity Report 2024, 36.4% were labelled unwanted. Out of this third, 96.4% were spam, with 3.6% classified as malicious.

In this slice of malicious emails, phishing took the top spot at 43.3% (a 4% increase over the previous year) followed by 30.5% emails with malicious URLs (an 18% increase over the previous 12 months). Where there were malicious attachments, the most common was HTML files (37.1%), followed by PDFs (23.3%) and then archives such as ZIP files at 20.8%.

Getting as close as possible to a “clean feed”

All email hygiene systems follow the same basic architecture. Start by filtering out emails coming from known bad email servers and known bad domains by just refusing the connection.

Then, look at the DNS records (SPF – Sender Policy Framework, DMARC – Domain-based Message Authentication, Reporting and Conformance, and DKIM – DomainKeys Identified Mail) to filter out suspicious senders. Emails that make it through these first gates are then scanned by multiple anti-malware engines to spot any known viruses and filter those out.

In Hornetsecurity’s case, this is followed by Advanced Threat Protection, which inspects each email and its attachments in a sandbox, opening the files to look for any suspicious actions they perform, and using Machine Learning (ML) and over 500 signals to provide a verdict if the file / email is legitimate or not.

And if we later identify an email as malicious after delivery we can reach into any mailboxes where it has already been delivered and delete it.

This is an ongoing arms race, with attackers adjusting their tactics, types of attachment, obfuscating the malicious code and so forth, all to avoid detection. Our Security Lab experts, together with the ever-learning ML model tweak our detections to stop as close to 100% of all malicious emails as possible.

However, no system will catch every single bad message, and this is where the cybersecurity concept of defense in depth comes in.

In any complex IT system, you want to have multiple layers of protection, so that if the attackers penetrate one, they still have others to get through before they get to their prize. In this case, that’s your “human firewalls”, trained staff who know what signs to look for with their sharpened instincts.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection and Advanced Threat Protection strategies.

Discover the latest in cybersecurity: How to Spot a Phishing Email in The Age of AI. Learn how AI fuels sophisticated phishing attacks and gain actionable insights to protect your business.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

In conclusion, phishing poses a grave threat to organizational security, requiring a multifaceted defense strategy. Through awareness, advanced email hygiene, and a commitment to defense in depth, organizations can mitigate the risk and safeguard their valuable assets against this insidious cyber threat.

FAQ

What makes phishing such a significant threat to organizations?

Phishing remains a top concern for organizations due to its deceptive nature and widespread prevalence. Cybercriminals employ various tactics, from impersonating trusted entities to crafting sophisticated lures tailored to specific targets. These attacks often start with a simple email, leveraging users’ familiarity with email communication to trick them into clicking malicious links or downloading harmful attachments. The consequences of falling for phishing attempts can be dire, ranging from data breaches to financial losses and even ransomware attacks.

How can organizations mitigate the risk of phishing attacks?

Organizations can mitigate the risk of phishing attacks through a multi-faceted approach. Implementing robust security awareness training programs is essential to educate employees about the tactics used by cybercriminals and empower them to recognize and report suspicious emails. Additionally, employing advanced email hygiene systems, such as those that utilize SPF, DMARC, and DKIM, can help filter out malicious emails before they reach users’ inboxes. Investing in advanced threat protection solutions, including sandboxing and machine learning, can further enhance detection capabilities and mitigate the impact of phishing attacks.

Why is defense in depth crucial in combating phishing threats?

Defense in depth is critical in combating phishing threats because no single security measure can provide complete protection against sophisticated attacks. By implementing multiple layers of defense, organizations can create overlapping security barriers that increase the complexity for attackers and reduce the likelihood of successful breaches. This approach includes not only technical solutions such as email filtering and malware detection but also emphasizes the importance of human vigilance. Trained staff serve as the final line of defense, equipped with the knowledge and skills to identify and respond to phishing attempts effectively.