Mimecast general manager for Middle East Werno Gevers shares the latest findings of the Mimecast State of Email Security report, and delves into why today’s threat landscape calls for more pervasive security strategies.
The ongoing COVID-19 pandemic has resulted in a tremendous shift in the way businesses operate. How has this impacted the cybersecurity landscape?
The global spread of the coronavirus has created many new opportunities for threat actors. We’ve seen in that since the first 100 hundred days since the virus began, overall threats activity has increased significantly rise by 33.5% which are focused largely on high volume, spamming and impersonation attacks. These tactics enable attackers to target a large number of potential victims with the least possible effort. We’ve seen that these attacks come at the time when an unprecedented combination of risk factors make people particularly vulnerable, I think that is illustrated by the fact that users are clicking on unsafe links as they seek for more information about the crisis. Over this period as well, we have witnessed that the number of clicks on blocked URLs has increased more than 751%, which is significant. As we continuously monitor these attacks, we’ve found that the latest coronavirus-related attacks are evolving to target government and businesses are also rising.
As companies transition to a remote workforce and the fact that click rates on these malicious links are rising are clear indications of people letting their guard down as they become desperate to learn more information about the pandemic. I believe that the rise in unsafe clicks suggests that there is an urgent need for organisations to refresh awareness training for employees and to rethink security strategies.
According to Mimecast’s latest State of Email Security report, we have witnessed an uptick in BEC, impersonation fraud and email phishing attacks during the first 100 days of COVID-19. What have been the primary drivers behind the increase of such cyber threats, and can we expect this trend to continue in the coming months?
I think the State of Email Security report is one of our most downloaded assets globally. Today it has become more vital as many employees are working from home and are using cloud tools to be productive. This report is instrumental in enabling us to look after our customers.
The report saw that cybercriminals are refocusing their phishing impersonation and ransomware attacks from office networks to the cloud services to target those remote employees. We’ve also seen that the global pandemic is accelerating the cloud adoption immensely. We’ve seen a massive surge in the demand for software-as-a-service based collaboration solutions. However, many organisations found that they weren’t equipped for remote working environments. This meant that employees who are working from home for the first time may not be sufficiently aware of the cyber threats and how to mitigate them. In fact, our research has found that employees from companies not using our security awareness training service, we’re more than five times likely to click on malicious links than employees from companies that utilise the training.
In the UAE, the State of Email Security report showed that 70% of respondents reported encountering incidents of phishing, BEC and impersonation attacks due to the global pandemic. We’ve also seen that 17% of respondents stated phishing remained flat or increased for them. If you look at Saudi Arabia, 54% of the respondents reported the same or increasing phishing attacks at their organisations and 56% of the respondents had seen impersonation fraud increased or stayed the same.
In addition, our latest threat intelligence highlighted that one of the things that is highly likely to occur during continued periods of uncertainty is an increase in cyber-attacks against vulnerable targets. At the end of the day, humans are the weakest links. Therefore, the longer the pandemic remains a subject of significant concern across global communities, cyber-attacks will continue to rise.
How can organisations monitor and curb the disruptions caused by email-borne attacks? How can Mimecast help them address these challenges?
Historically, email security has been integrated with a secure gateway, which is a perimeter strategy to prevent malicious emails from making their way to corporate mailboxes. The changes in the threat landscape required such strategies to transform and extend beyond the traditional perimeter-oriented defence to a more pervasive one. This ensures that security is integrated into the company’s overall systems and extends to protect applications such as Microsoft Office 365.
More than deploying secure gateways organisations need to understand that they need to manage human errors to mitigate the impact of internal email threats that could disrupt their business. Mimecast offers a wide range of solutions including Email Security, Web Security, Brand Exploit Protect and DMARC, which have now all become incredibly important when it comes to protecting organisations as they navigate remote working environments. We also have a comprehensive backup and archiving solution, which help companies restore access to critical business data should there be any unplanned downtime.
Another key factor that they need to look into implementing robust security awareness training programmes. With today’s a distributed workforce and an abundance of scams doing the rounds, the cost of human error escalates. So, organisations need to take steps adequately to prepare them to spot these threats. Our research has shown that the most effective training needs to be short, fun, and engaging to help foster the security culture. Business leaders need to understand that security is every employee’s responsibility and not just the security team’s.
Ultimately, a pervasive security strategy requires a combination of robust email security and awareness training.
What can regional customers expect from Mimecast over the coming months?
We’ll continue to build out our API platform with more integrations with leading brands. We believe that it is important for organisations to be able to invest in a service that could talk to their broader ecosystem. We have also recently acquired a company called MessageControl, a messaging security provider with solutions designed to help stop social engineering and human identity attacks with the use of machine learning and artificial intelligence. This powerful combination of Mimecast and MessageControl is engineered to provide customers using productivity apps, such as Office 365 or Google, which will give them stronger protection against the advanced phishing and impersonation attacks. It is also designed to prevent inadvertent loss of sensitive and confidential data while also serving as an additional sensor to further enrich threat intelligence.
For us as an organisation, we remain committed to keeping our customers safe and secure as the threat landscape evolves. In addition, we are going to continue evolving our services and platforms to ensure that we deliver the best protection to our customers.
