The Threat Landscape

Today, email is still a very significant attack vector. For the vast majority of businesses, email is the common way all staff can receive messages from outside of the business. Other systems like Slack/Skype/etc, usually require the business to “invite” someone to a group or channel. But with email, an attacker only needs the name of a member of staff to send them a message, which is often easy to find on Companies House or LinkedIn. With a name, it’s possible to guess the email address format and send anyone in the business any desired message. The same is often not true with other forms of communication.

Additionally, decades of badly written and obvious spam have conditioned many of us that if an email looks well-written and on-brand, that it’s probably legitimate. The attackers are getting very good at making pixel-perfect copies where the only difference in a message is the link directing you to a malicious website.

Where Are They Going Wrong?

One of the main mistakes we often see is focusing on showing staff poor quality examples of malicious emails, focusing on the mistakes that a particular attacker has made. For example, using the incorrect font, signature, colors and other aspects of the email which only apply to poor quality forgeries. Often a highly-skilled phishing campaign is something that looks very nearly identical to a legitimate email. Similarly, a dangerous email may not include any links or attachments, things which we usually use as indicators to be suspicious. Instead, it could simply be a request to reset a password or change payment information.

The best way to defend against email-based attacks, in general, is to make verification of highly-skilled or high-risk requests as easy as possible. Building a culture where staff are encouraged to check unusual requests from leaders can help detect even the most highly skilled forgeries.

Check out Elliott’s blog on improving email security by underpainting external email labels here.