The Ultimate Guide to Email Security for Your Business

It is hard to argue that the work landscape today looks nothing like it did just a few months ago back in February. We spend much more time in video conferences, access more company documents and resources remotely, and check our work emails from home now more than ever. 

What didn’t change, however, is the number of cyberattacks happening through email. In fact, because of all the uncertainty and stresses of the past few months, these attacks intensified. According to the Federal Trade Commission, Americans already lost $13.4 Million in 2020 due to scams related to COVID-19, and almost 24,000 business email scams were reported to the FBI this year. Putting it simply, coronavirus, protests, and the general anxiety make us click, and hackers are privy to it. 

More often than not, email is their weapon of choice. Physhme reports that 91% of cyberattacks happen through email as the “entryway” for hackers. Why? Simply because human error to this day is the hacker’s surest bet. People are susceptible to curiosity (COVID-19 spread maps), fear and urgency (impostor “boss” asking a new employee to immediately wire money), reward and recognition (“winnings” from your bank requiring you to login onto a phishing site), as well as social, entertainment, and opportunity factors (check out this meme).       

So, how can you recognize potentially dangerous emails and protect your information and your company’s proprietary data? 3nom hosted a webinar on this, and here is the summary. 

First, let’s take a quick look at the main types of email attacks to better understand what we are up against.  

• Phishing or spear-phishing are types of attacks where hackers attempt to obtain personal information, like passwords and credit card information. Often these would be links to fake websites mimicking the likes of PayPal or even a COVID-19 tracking one, inviting you to log into your account or update your password. 
• Ransomware is malware (aka a type of self-activating program) that gets sent as an email attachment or a link to websites that installs itself onto your network and encrypts all your files and data, preventing you from accessing it until you pay a ransom. The more advanced versions will embed links into innocent Word documents and launch when the document is opened or the link is clicked. 
• Viruses that infect your network and compromise your work by either slowing it to a halt, mirroring your computer activity onto a hacker’s machine, or stealing sensitive information directly from your computer are usually sent as email attachments. 
• Theft happening through email can be either financial (coming from someone you trust like your boss asking to wire money or buy gift cards) or theft of proprietary data, which can be either “requested” directly by an impostor, or stolen remotely. 

Let’s now look at one of the most important types of email scam — impersonation.  

Impersonation

Impersonation is a broad term for a type of email scams where a sender attempts to impersonate a trusted source. This “trusted source” can be your credit card company, your boss or co-worker, or anything in-between. There are two main ways to minimize a chance of security breach due to impersonation: train your employees to recognize it and set up additional “gates” making this recognition easier. 

Train Your Employees

• Pay attention to the domain the email is sent from first, and only then the display name (e.g., From: PayPal, paypal@gmail.com is clearly an impostor)
• An authentic email will never come from a @gmail.com domain, it will always have a company domain (JohnDoe@3nom.com, never JohnDoe.3nom@gmail.com)
• Check for spelling in the domain name – spoofed emails often make a small tweak to the spelling that can easily slip the receiver’s attention. For example, if John@dshipping.com is the real email, the spoofed email may be John@dshpping.com (missing the “i” in “shipping”). Other examples are @g0ogle instead of @google.com (“o” replaced with “0”) and Leedon1@seeker.com instead of Leedonl@seeker.com (“l” replaced with “1”)
• Pro tip: if you aren’t sure whether or not the domain is authentic, do a quick search for the domain to see which organization is emailing you. In the case above, search “3nom.com.” 
• Watch out for blatant grammatical errors in the email. Grammatical errors are a great indicator of a scam, not because the scammers are stupid but because they use email to find the least attentive victims who will be easier to lead through the end goal of the scam—the extraction of money or information.  

Increase Your Security at The Company Level

• Start with creating a clear set of policies and procedures around email security and handling of sensitive information and data. These policies may be: 
  • No credit cards or personal information may be sent over the email.
  • No sensitive document can be emailed without an official request. 
  • All wire transfers may require a confirmation phone call to a predetermined number. 
  • Certain documents can be classified as highly confidential which would restrict them being sent to external sources.
  • Every employee has to update their signatures and privacy settings. 

• Make sure that every employee completes security training, such as 3nom’s free Security Awareness training. 

• Sometimes an email can come from an actual email address but not your company’s authoritative server. 
  • Make it a company-wide policy to have a disclaimer at the bottom of your emails. This makes it easier to spot fraudulent emails when the disclaimer is not present. 
  • Add a notification when an email originates outside of your organization. For example, “WARNING: This email originates outside of TechOne LLC. Please forward suspicious emails to IT OPS.”  

• Other best practices for spotting email attacks and validating suspicious email may require professional implementation with your in-house IT or a managed service provider, but are well worth the effort as they help to reduce the risks even further: 
  • All attachments can be automatically scanned by the advanced antivirus protocol.
  • Link destinations can be previewed upon hovering on the link without the need to click it. 
  • Links can open in safe sandboxes to ensure they are clear.
  • Email can be held and scanned in the cloud until deemed safe to release into the mailbox — they will have no way to infect the machine or system. 
  • A multistep process may be put in place to detect and block malicious URLs.
  • And much more. 

The IT security landscape today evolves at a lightning speed, but so do the hackers’ attempts to breach your company’s data. Working with an experienced partner like 3nom will help you stay ahead of the curve on the best email security solutions for your business so you can focus on work with peace of mind and confidence. Get in touch today to book your  Email Security Evaluation!  

Check out a full, recorded webinar, of 3nom Managing Partner Abe Sasson and CTO Avrohom Liberman, discussing all things email security here.