Resources & insights

The Evolution of Email Security

Traditionally, spam created minor issues for individuals and organisations. 

In the late 1990’s there were unsolicited emails, unwanted emails and emails. They were messages we weren’t really too bothered about.  

But what if there was coding within the emails which would include viruses? This became a vehicle to get into organisations and in the early 2000s, email providers such as AOL started warning users of “phishing” and protecting their information. Hackers were sending high volume phishing emails however the impact was low. 

In 2014, advanced threat protection was introduced which provided detection and accuracy in protecting against advanced persistent threats. This led hackers to change their strategy by targeting users rather than technology. They started creating emails which would bypass normal checks asking the user to do something. 

Modern day phishing tries to replicate day-to-day known companies and messages. 40% of attachments are opened before reading the actual email. Hackers started to realise if they reduce volume with clear messaging (switching their hacking strategy to low volume with high impact) they are much more likely to get what they want.  

What are the common types of email threats seen in organisations today? 

Whaling  

Whaling involves impersonating important people within the business. This can involve changing a domain name slightly so that the recipient is less likely to nitice. Much lower volume which involves getting it right first time, but impact Is catastrophic to the organisation. 

Compromised Insiders 

When we look at things already in the business, someone within the organisation can do more damage than someone on the outside. Compromised insider is someone who has no longer has access to inbox where control is taken away from the user. 

Careless Insiders 

The majority of breaches come from within the business, where staff are not careful in following security processes. This results in leaking the wrong information by mistake to the wrong people. 

Malicious Insiders  

Someone that genuinely wants to harm to the organisation. 70% of organisations surveyed by Mimecast had experience of an inside user purposely trying to harm the business through internal communications. 

In current circumstances, we are more prone to attacks due to hackers taking advantage of vulnerabilities. According to Forbes, we’ll see the largest cyberattack in history within the next six months. As more remote working technology is used, attackers targeting these platforms are increasing their number of social engineering techniques. These are likely to include fake file sharing emails, meeting invitations and instant messaging communications, and a number of the types of attacks listed are likely to be seen.  

If you would like to find out more about working securely or remotely, contact our team of experts today. 

Back to resources & insights