Personal email:Pathway to Cybersecurity Breaches - GovCloud Network

blog

0
267
Monday, September 9, 2015

Personal email:Pathway to Cybersecurity Breaches

Personal email:Pathway to Cybersecurity Breaches

As a business communications tool, email is the dominant option, and many corporations have policies that allow the use of personal email on corporate computers. In a recent Adobe Systems commissioned online survey of 400 U.S. white-collar, adult workers, more than 90 percent of them admitted checking personal emails at work. The workers questioned in the poll estimated they spend 6.3 hours a day checking emails, with 3.2 hours devoted to work emails and 3.1 hours to personal messages. Nearly half of the respondents also said that their use of emails for work will increase in coming years with 19 percent saying it will go up substantially.

Employers generally have the discretion to monitor and restrict employees’ personal computer usage as they see fit and, in most cases, email messages are not subject to any personal privacy laws. But even with these stipulations, Dell SonicWall channel partner Michael Crean, President and CEO of Solutions Granted, says that allowing personal email on corporate PCs is just not worth the risk. Solutions Granted, a small veteran-owned business, is certified as a SonicWALL Managed Security Service Provider. According to Crean, the threat of malicious attacks and subsequent remediation cost far outweighs any gain from allowing personal email access. “If your employees need to check their email in the car, they use their personal phone. So why can’t they do the same at work?”

Email phishing, the attempt to acquire sensitive information for malicious reasons by masquerading as a trustworthy entity, is a significant cybersecurity threat.

“In one incident investigated by Dell SecureWorks, attackers phished an employee at a manufacturing company to obtain the login credentials for the company’s Citrix platform. The attackers were able to use the credentials to connect to internal corporate resources, then move laterally through the network and harvest intellectual property using the company’s Altris platform, which remotely distributes new software and patches to all the endpoints.”

The most sophisticated attacks are grouped in two categories:

  • Indirect Phishing Attacks –attackers direct a series of emails, usually in combination with organizational information from other sources such as LinkedIn, that add up to a successful phishing campaign. An example would be an employee being tricked into giving away Yahoo credentials as part of an attack, which can give access to contact or calendar information. Another example would be an employee with a cloud-based company email (i.e. Office 365 or Gmail for Business accounts) could be successfully phished. This could give the attacker a platform for sending malicious emails that appear safe.
  • Direct Phishing Attacks – Cybercriminals seek login credentials for actual business systems. During Q2 2015 security analysts found multiple examples of phishing attempts on Outlook credentials. Aside from email access, these credentials are frequently used for domain logins, providing an attacker with access to other cloud-based services, such as Dropbox or Salesforce. This sort of breech could also provide an attacker with direct access to corporate proprietary information.

Phishing is often described as spam and, according to Secure List, generally followed the same template:

  • Very little text (the email generally contains a typical header consisting of several words which is exactly repeated in the body of the message)
  • One or more links which load a brightly decorated picture (sometimes in parts) with all the necessary advertising data (a more detailed advertising text plus contacts: website address, phone number, company name)
  • Another long link that leads to a resource that corresponds to the content of the email
  • Additional ‘white noise’ text to bulk out the email

The white noise text consists of random phrases or single words in any language which may not be the same as the language of the mass mailing. This text is generally invisible to the reader of as it is written in white or pale color on a standard white background.  Email is also often used to distribute malicious attachments in Microsoft Word or Excel.

Phishing is an equal opportunity threat with “Global Internet Portals”, which include email and search portals taking the brunt of the attacks. As a trusted advisor to their customers, Solutions Granted recommends the following:

  • Severely restrict or eliminate employee access to personal email via company-owned assets;
  • Don’t let preferences of your human resources team overrule the need for IT security; and
  • Use industry proven cybersecurity technologies and best practices.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.

Cloud Musings
↑ Grab this Headline Animator

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2015)

Follow me at https://Twitter.com/Kevin_Jackson

LEAVE A COMMENT

Name*
E-mail*
Phone number*
Your Message

Latest posts

0
59

CIO dream team: Who’s in and why?

Today’s CIO navigates the twin challenges of enabling new business models and managing rapid technological change. Cl...

0
152

Digital Transformation and the Mainframe

Digital transformation infuses digital technology into all areas of an organization’s business or mission. Its fundam...

0
676

Composable Architecture Q&A. Are you ready?

Q: Is it time for my company to jump on the composable architecture bandwagon? A: Composable architectures are quickl...

0
214

Increase Productivity by Reducing Technology Distraction: Lessons from Forrester Research

Workplace productivity is hurt every day by the very technology developed and purchased to improve it.  Forrester ann...

0
3437

Cloud Computing Evolves: An Interview with Mats Johansson

Recently, Ericsson Digital released an amazing report on Edge Computing and 5G. In it, they explained how distributed...

0
2663

Unveiling the end-to-end capabilities for the networked society

An Interview with Henrik Basilier  By Kevin L. Jackson The telecom industry is rapidly moving towards a future i...

0
3379

AT&T Finance Solutions GM on Shrimping, Software, and CX

Helping clients address the trends and challenges presented by the Financial Services industry is the main focus for ...

0
7407

The IoT Nexus: Bosch Connected World 2019 in Berlin

Next week, I will be influencing #LikeABosch as I accept an invitation from the company to attend Bosch ConnectedWorl...

0
2749

Survive and Thrive With Digital Transformation

First cloud computing then multi-cloud. How can we get ahead of this digital transformation nightmare? These are the ...

0
1060

The “George Jetson” of Today

He grew up in Silicon Valley, landed his first job at Apple Computers, was introduced to Nobel Prize winners by his d...