Effective email security is one of the best ways to prevent costly ransomware attacks, data breaches and wire fraud. Cyber criminals use phishing schemes, lookalike addresses and other tools to break into a user’s mailbox, intercept messages and strike at vulnerable targets.
The need for secure email has never been stronger as the complexity and volume of threats have increased significantly, according to a recent Frost & Sullivan Analysis, “Global Email Security Market.” The research firm predicts double-digit annual growth for the next four years with the global market reaching $5.27 billion by 2025.
The financial, healthcare and government/defense sectors are expected to be the largest vertical markets.
“As email is the number one threat vector, organizations are looking for integrated solutions and a single pane of glass for more effective and simplified security management,” said Tony Massimini, security research analyst, Frost & Sullivan. “Also, the convergence of email security with other security solutions enables organizations to consolidate vendors and increase operational efficiencies while gaining stronger and more comprehensive security.”
Enterprises are also adopting cloud-based mailbox services and moving their email security to the cloud from on-premise appliances, the report said. That shift to the cloud is particularly important with more users working from home and using their own devices. An email archiving solution can also be helpful if you need to search through emails related to a data breach.
Massimini added that the growing number of data protection and privacy regulations in various countries will drive multinational enterprises to upgrade to new email security solutions to comply with the requirements in place. “Further, to keep pace with customers, vendors must move to the cloud quickly, continue to innovate in terms of cloud security, and work on augmenting other cloud email services,” he added.
Tools and training
For IAUG members, email security involves deploying the right security tools and platforms. Avaya and its business partners continue to offer robust solutions to protect vulnerable networks, data and applications from hackers.
But technology alone is not enough, as cyber criminals target users within the organization, hoping to gain access to key credentials. Their tactics include spear phishing – emails aimed at an individual – or voice or text messages designed to trick unwary users. Another scheme is the business email compromise (BEC), where fraudulent emails look like a legitimate request for information from a department head or senior leader, or an outside vender.
Because email security is an ongoing process, rather than a one-and-done project, organizations must continually alert their users to new email threats and remind them about maintaining security procedures, such as the following:
• Avoid simple passwords that would be easy to guess, such as the name of a spouse, child or pet. It’s better to use a combination of letters, numbers and symbols.
• Change passwords on a regular basis. This can be a mandatory requirement from the IT team.
• Don’t type in passwords or write them down on paper in a public setting. A criminal can easily capture logins with a high-resolution camera, compromising a password within minutes.
• Don’t click on links or download attachments from unsolicited emails. If in doubt, contact the sender directly by phone, text or new email to verify the message.
• Don’t send personal or financial information via email. Legitimate organizations rarely, if ever, ask you to provide that type of confidential data in an online message.
• Password-protect confidential files sent via email. You can then call the recipient with the password so the encrypted file can be downloaded.
• Use dual authentication when logging in to the enterprise network. This might include an SMS code or an automated voice call to ensure the login is legitimate.
IT professionals can also look at the various biometric tools, such as thumbprints or facial recognition, as an alternative to passwords.
Finally, remember that email security is not a standalone issue. The tools and training need to be integrated into the organization’s security ecosystem for overall threat assessment, monitoring and management.
