blog

0
61
Monday, September 9, 2015

Personal email:Pathway to Cybersecurity Breaches

Personal email:Pathway to Cybersecurity Breaches

As a business communications tool, email is the dominant option, and many corporations have policies that allow the use of personal email on corporate computers. In a recent Adobe Systems commissioned online survey of 400 U.S. white-collar, adult workers, more than 90 percent of them admitted checking personal emails at work. The workers questioned in the poll estimated they spend 6.3 hours a day checking emails, with 3.2 hours devoted to work emails and 3.1 hours to personal messages. Nearly half of the respondents also said that their use of emails for work will increase in coming years with 19 percent saying it will go up substantially.

Employers generally have the discretion to monitor and restrict employees’ personal computer usage as they see fit and, in most cases, email messages are not subject to any personal privacy laws. But even with these stipulations, Dell SonicWall channel partner Michael Crean, President and CEO of Solutions Granted, says that allowing personal email on corporate PCs is just not worth the risk. Solutions Granted, a small veteran-owned business, is certified as a SonicWALL Managed Security Service Provider. According to Crean, the threat of malicious attacks and subsequent remediation cost far outweighs any gain from allowing personal email access. “If your employees need to check their email in the car, they use their personal phone. So why can’t they do the same at work?”

Email phishing, the attempt to acquire sensitive information for malicious reasons by masquerading as a trustworthy entity, is a significant cybersecurity threat.

“In one incident investigated by Dell SecureWorks, attackers phished an employee at a manufacturing company to obtain the login credentials for the company’s Citrix platform. The attackers were able to use the credentials to connect to internal corporate resources, then move laterally through the network and harvest intellectual property using the company’s Altris platform, which remotely distributes new software and patches to all the endpoints.”

The most sophisticated attacks are grouped in two categories:

  • Indirect Phishing Attacks –attackers direct a series of emails, usually in combination with organizational information from other sources such as LinkedIn, that add up to a successful phishing campaign. An example would be an employee being tricked into giving away Yahoo credentials as part of an attack, which can give access to contact or calendar information. Another example would be an employee with a cloud-based company email (i.e. Office 365 or Gmail for Business accounts) could be successfully phished. This could give the attacker a platform for sending malicious emails that appear safe.
  • Direct Phishing Attacks – Cybercriminals seek login credentials for actual business systems. During Q2 2015 security analysts found multiple examples of phishing attempts on Outlook credentials. Aside from email access, these credentials are frequently used for domain logins, providing an attacker with access to other cloud-based services, such as Dropbox or Salesforce. This sort of breech could also provide an attacker with direct access to corporate proprietary information.

Phishing is often described as spam and, according to Secure List, generally followed the same template:

  • Very little text (the email generally contains a typical header consisting of several words which is exactly repeated in the body of the message)
  • One or more links which load a brightly decorated picture (sometimes in parts) with all the necessary advertising data (a more detailed advertising text plus contacts: website address, phone number, company name)
  • Another long link that leads to a resource that corresponds to the content of the email
  • Additional ‘white noise’ text to bulk out the email

The white noise text consists of random phrases or single words in any language which may not be the same as the language of the mass mailing. This text is generally invisible to the reader of as it is written in white or pale color on a standard white background.  Email is also often used to distribute malicious attachments in Microsoft Word or Excel.

Phishing is an equal opportunity threat with “Global Internet Portals”, which include email and search portals taking the brunt of the attacks. As a trusted advisor to their customers, Solutions Granted recommends the following:

  • Severely restrict or eliminate employee access to personal email via company-owned assets;
  • Don’t let preferences of your human resources team overrule the need for IT security; and
  • Use industry proven cybersecurity technologies and best practices.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.

Cloud Musings
↑ Grab this Headline Animator

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2015)

Follow me at https://Twitter.com/Kevin_Jackson

LEAVE A COMMENT

Name*
E-mail*
Phone number*
Your Message

Latest posts

0
103

2018 AT&T Business Summit: Security “in” and “of” the Cloud

While public cloud is undoubtedly an outsized piece of the conversation, news headlines of the latest data breach can...

0
57

My Brush with Royalty: Queen Latifah

Queen Latifah! Hip Hop Icon. Movie Star. Television Star. Fashion Model. Songwriter. Producer. Entrepreneurial Genius...

0
64

What’s New in Puppet 5?

Puppet 5 is released and comes with several exciting enhancements and features that promise to make configuration man...

0
80

5 Reasons Why Ansible is the Best CM Tool Out There?

Amidst volatile markets, dynamic technology shifts, and ever-increasing customer demands, it is imperative for IT org...

0
105

Machine learning APIs for Google Cloud Platform

Google Cloud Platform (GCP) is considered to be one of the Big 3 cloud platforms among Microsoft Azure and AWS. GCP i...

0
65

What Is The Most Important Part of Architecture?

I always find it interesting to hear what people view architecture as. A lot of people think it’s just about the desi...

0
1653

Cloud migration best practice Part 4: Executing the migration

This series has stepped through cloud migration best practices. After providing an overview, we discussed: Classifyin...

0
236

Cloud Migration Best Practice Part 3: Application Portfolio Analysis

In part three of this series on cloud migration best practice, I will focus on migrating the application itself. If y...

0
304

Why Use Immutable Storage?

Data has become a global currency, and its value has nowhere to go but up.  According to The Economist online, the wo...

0
720

CLOUD ACT: What Does That Mean for Your Cloud Storage

When Congress names a law after you, it’s getting serious.  That is where we are now with cloud computing.  The Clari...