What is email security, and why do you need it for your business?

An email security service is a process of filtering emails that are destined for your organization (inbound) and those that are leaving the organization (outbound). Email filtering entails checking messages for spam, viruses, worms, malware and suspicious links and attachments and blocking or quarantining messages containing these threats. Emails that pass these checks are delivered to the intended recipient’s mailboxes.

Outbound spam filtering usually scans user’s outgoing emails to protect the organization from sending emails that contain spam or potentially harmful content, which would often lead to an organization being blacklisted on the internet. Blacklisting means you will not be able to send emails – they will tend to bounce as other servers will reject them.

Email security solutions come in various forms – cloud-based, on-premise hardware or software solutions – and an organization can choose whatever meets their requirements.

What is email security, and why do you need it for your business?

Why Do You Need Email Security?

Email is one of the most popular methods of online correspondence, more so for businesses. Unfortunately, most malware and viruses that find their way to computer systems and networks originate from email attachments. Without proper security measures, email can easily serve as a gateway for phishing attempts and malicious links and attachments.

Business email accounts are attractive targets for cybercriminals because they are a likely source of valuable business and client data. Some companies invest a lot of time and resources in network and endpoint security but ignore email security. This reality may be why email is the number one delivery method for cyberattacks in organizations today. Cybercriminals have identified this loophole and chosen to exploit it.

These email-borne threats come in various forms, including but not limited to:

• Emails with attachments or links containing viruses, worms, malware, some of which can extract data from hard drives, key-loggers that can capture passwords and enable the hackers perpetrate further attacks such as email spoofing (pretend to be someone from the organization) to maximize their chances of successful attacks

• Browser exploit kits: Emails with known internet browser exploits can cause data leakage, identity theft and even user access problems

• Phishing emails

• Spear-phishing and whaling attacks

• CEO fraud attacks

• Business Email Compromise (BEC) attacks

• Social engineering attacks that will lead employees to inadvertently expose sensitive company information such as passwords, credit card details or leak highly confidential data. These are often a result of spoofed emails.

• Domain squatting: malicious persons may register, buy and sell a brand’s email domain. Cybercriminals who purchase these domains can use them to masquerade as an organization’s employees and target clients or suppliers (spoofing)

• Ransomware

• Junk email

All these can result in financial loss (fraud) or loss of confidential company information such as financial details, company policies and budgets, profit plans, competitor strategies, etc., all of which have the potential to lead to financial or reputational loss. When a company suffers these losses, its clients, partners and shareholders may also be directly affected.

Another reason securing email is important, especially business emails, is that there may be emails with sensitive/confidential information. For example, they may contain bank statements, clients’ personal information and medical records, business strategies that you would not want your competitors getting their hands on, etc.

Components of an Email that need to be secured

There are four main components of an email message that can be compromised or manipulated.

These are:

• The body of the email – the actual words contained in the email

• The attachments of the email

• URLs (links) within the email

• The sender's email address

Essential Email Security Best Practices

Implementing email security best practices can help you mitigate the risk of email-borne cyberattacks by assisting you to prevent malicious individuals from leveraging email as a means of accessing your data, network and systems.

Here are some recommended email security best practices you can apply within your organization to help you establish a robust layer of email protection and safeguard your email communication:

1. Password Best Practices

Start from the basics - set strong passwords for your email accounts.

Passwords are perhaps the primary line of defense to our email accounts, but they are only as strong as we make them. Where possible, we recommend that organizations develop and enforce password policies for employees.

• Set passwords with a combination of uppercase letters, lowercase letters, at least one number, and at least one special character.

• Ensure your password is long – at least 10 or more characters.

• Do not use words that can be found in the dictionary. These are easily hacked even if spelled backward.

• Do not use common names of people.

• Avoid patterns, for example, 123123 or repetitions of numbers or letters such as bbbbbbb or 7777777. Also, avoid numbers or letters that are next to each other on the keyboard like qwerty.

• Do not use information about yourself or someone close to you like name, date of birth, or age.

• If you are an administrator and you are setting new passwords, do not send the new password to the intended user through email as the attacker still has access to the mailbox at this point. If this is the only way to do it, ensure users reset their passwords the first time they log in.

• Text messaging short forms can help you make strong passwords and remember them. E.g., 1AmH@ppy

• Use unique passwords and avoid reusing them across multiple accounts.

• Do not share your password with anyone else and do not write it down – unless you are using a password management tool that has strong encryption.

• Change passwords regularly, e.g., every 30 days.

Using strong passwords plays a crucial role in protecting your email accounts from account takeover, business email compromise (BEC) or CEO fraud attacks.

2. Use multi-factor authentication and application-specific passwords wherever possible

Multi-factor authentication and application-specific offer an added layer of protection to your email accounts – beyond using a username and password pair which can sometimes be easily compromised. Read more about two-factor authentication and why you should use it, and the importance of application-specific passwords.

3. Cybersecurity awareness training for your staff

The significance of cybersecurity awareness training for staff is often overlooked; however, given the constant threat of email-borne cybercrime, it is a critical aspect of a resilient cybersecurity strategy in any organization – regardless of size. It is also a common misconception that small businesses are safe from cybercrime. On the contrary, small businesses are, in fact, often the victims of successful cyberattacks simply because they are less likely to have put in place sufficient security measures.

Staff need training on how email threats work and the role they can play to avoid falling prey to these attacks. Staff need to be trained in how to respond when they receive a malicious or suspicious email.

If a phishing email is received, staff should be trained not to open the attachment – no matter how tempting it may be – because it will likely infect their machines with a malicious program and potentially cause a large-scale breach such as a ransomware attack on your company.

Staff should be asked to either move the email to forward this to the IT department to keep them informed of the threats and then move the email to the junk folder. The IT department may then choose to alert other staff members against opening emails of a similar nature.

Where staff do not know how to differentiate a suspicious email from a genuine one, the risk of falling victim to a cyberattacks are significantly higher.

Cybersecurity training should be regular and updated as the threat landscape changes.

4. Run regular phishing exercise simulations

Even the best spam filtering service will not eliminate 100% of email spam messages or attacks coming into your organization. For this reason, it is crucial to teach employees to recognize tell-tale signs of phishing emails so that they do not fall for the tricks contained in such socially-engineered attacks.

Also, teach your users how to flag and mark as spam any unwanted messages that may have accidentally landed in their mailboxes. This will prevent future emails from this email address from ending up in their mailboxes in future.

5. Activate Email Authentication where possible

Consider activating SPF, DKIM and DMARC to protect your organization from email phishing attacks. Read more about these anti-phishing solutions.

6. Opt for a gateway solution

Choose business-grade email security solutions that will filter emails before the emails are delivered into your corporate network. This will prevent overload on your internal network resources (bandwidth, server storage space) and also significantly reduce the chances of human error that could lead to business email compromise, a result of targeted cybercrime.

7. Develop a comprehensive cybersecurity plan for your organization

Email security should be part of a broader cybersecurity plan. Establishing a cybersecurity plan is important because even the most successful enterprise email security best practices will be rendered obsolete if your company is vulnerable in other areas.

A comprehensive cybersecurity plan should include policies, guidelines, requirements and recommendations regarding how to implement and use all the technologies your business uses, including email communication channels.

8. Avoid using public Wi-Fi networks

Cybercriminals monitor the activity on some public Wi-Fi networks such as those in restaurants or cafes. These criminals use the information they collect from users to gain unauthorized access to their email accounts, data and machines.

How MailSafi Can Help You with Your Email Security

MailSafi provides a cloud-based email security service that offers superior protection from spam, viruses, malware, ransomware, business email compromise or CEO fraud and other advanced email-borne threats. MailSafi also offers cybersecurity awareness training to organizations to help them become cyber resilient. Contact us today to discuss how we can help your organization build a solid email communication system.

MailSafi’s parent company, Kaluari, also offers various solutions to aid in building companies’ cyber-resilience. These include endpoint protection solutions like firewalls, antivirus, among others. Get in touch for more information.