Email security

We all know Email is the widely used communication medium at least in the corporate world. In fact, Email existed before the World Wide Web and other modes of communication came into use.

Though email security has not been paid much attention, email security is of utmost importance given the sophisticated line of attacks being conducted by cyber criminals over email. Also, given a good amount of time spent on email in the workplace it has become an ideal target for cybercriminals to target users over email.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

Why Email Security

First question which arises is why email security? 

Email’s are the treasure trove and they contain highly sensitive information like card data, confidential data, passwords, private documents like passports, utility bills etc. Also, access to emails gives cyber criminals a network of contacts and can use hacked email to gain access to other social media accounts like Facebook, Instagram, Linkedin etc.

Some of the most valuable information traded in black market obtained from accessing email accounts are - 

1. Financial reports and accounting balances;
2. Companies project plans and strategy for several years;
3. Intellectual properties;
4. CRM databases and contacts;
5. Database of employees;
6. Network Infrastructure and its design

Thus maintaining security and proper access to email accounts is of paramount and special attention should be paid in maintaining legitimate access to Email accounts. 

Common Email Pitfalls and Email Security Measures to be undertaken 

Following are the main attack vectors used by cyber criminals to target users - 

• Phishing - Phishing is the widely and most commonly used technique to target users. Phishing emails are crafted emails that lures users to provide confidential and sensitive information or clicking on the link. By clicking on the link, the link redirects the user to a spoofed site which asks the user for personal or financial data by impersonating as a legitimate website. Also , few links download and infect the PC with malware to get sensitive information from the affected computer.
• Clicking links embedded in Emails - It is always advisable and safe to not to click on any link embedded in the emails. Also images embedded in the email should not be clicked blindly. Users should click on the link unless it has been verified that it is from a trusted source or service.
• Attachments in Email - A user should not directly open the files attached to emails since malicious files are common vectors of infections. Also, file extensions should not be trusted, images could be EXE’s which when run can download malware or run malicious payload.
• Using the same password for multiple email accounts - It is a very common practice of using the same password for multiple email accounts. If one account gets compromised, the attacker can access all the other email accounts having the  same password. 
• Scan Email for Malware - If in doubt, it's wise to scan email for malware since an attacker can send email from a compromised email account which you trust and spread malware to other contacts.
• Avoid Public Wifi - Public wifi are prone to MITM attacks and attackers can sniff your email password when you open email on public wifi.
• Use 2 Factor Authentication - It’s advisable to enable 2FA when logged into email from the new system. Even if the account gets compromised and the attacker tries to login from a new system, 2FA will save you from the attacker accessing the account. 
• Encrypt Email - Though this may not be necessary but if needed, encrypt the email so it cannot be decrypted even if the account is compromised since decryption would need an attacker to have an encryption key.
• Training and Awareness - Proper Training and Awareness should be provided to train users to identify and verify original or phished email so they can take legitimate actions as needed and safeguard themselves from various email based attacks.
• Email Filters - Proper email filters should be in place to scan and verify all the incoming emails. If an email is flagged by the filter, it should be blocked at the perimeter so it is not delivered to the receiver.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

Conclusion

Email being the most important source of communication are prime vectors used by attackers to target any user. If proper awareness and training is in place, it will make it difficult for attackers to launch email based attacks, thus safeguarding users and their data.

Sources

1. http://securityaffairs.co/wordpress/37468/cyber-crime/global-phishing-survey-2h3014.html 
2. http://www.makeuseof.com/tag/7-important-email-security-tips-you-should-know-about/ 
3. /topic/ins-outs-email-security-awareness/