{"id":31532,"date":"2019-10-30T18:00:00","date_gmt":"2019-10-30T18:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/operations\/email-threats-poised-to-haunt-security-pros-into-next-decade\/a\/d-id\/1336192"},"modified":"2019-10-30T18:00:00","modified_gmt":"2019-10-30T18:00:00","slug":"email-threats-poised-to-haunt-security-pros-into-next-decade","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/email-threats-poised-to-haunt-security-pros-into-next-decade\/","title":{"rendered":"Email Threats Poised to Haunt Security Pros into Next Decade"},"content":{"rendered":"
<\/div>\n
\n<\/header>\n

Decentralized threat intel sharing, more public-private collaboration, and greater use of automated incident response are what’s needed to combat phishing<\/span> <\/p>\n

As organizations begin to plan their cybersecurity strategy for 2020 and beyond, email security will certainly be high on leadership’s agenda. That\u2019s because phishing attacks continue to increase in sophistication and frequency, and email remains the number one vector for all cyber incidents. In fact, 90% of all cyberattacks<\/a> begin with email, and the breadth of phishing detection, prevention, and response has become the ultimate SOC team burden.<\/p>\n

As such, one thing is clear: Enterprises are losing the email security battle. This unpopular truth exists partially because of the complex email threat landscape. After all, it\u2019s almost impossible for any organization to proactively defend against 130 million phishing attacks<\/a>per quarter, not to mention the tens of thousands of permutations associated with each. Another contributing factor is the proliferation of payload-less, social engineering-driven phishing, such as business email compromise (BEC) and account take over (ATO), which enable attackers to bypass traditional server-level email security tools and trick human defenses with relative ease.<\/p>\n

Presently, when it comes to phishing mitigation, the industry is guilty of holding the same conversations that it\u2019s had for the past several years. Comparing and contrasting secure email gateways. Evaluating both the real and perceived benefits of phishing awareness training. Debating the pros and cons of authentication and encryption protocols. While all three tactics remain popular, they are decreasing in effectiveness.<\/p>\n

Thus, as we approach the next decade, it\u2019s time to move away from the trivial arguments of yesteryear and focus on what\u2019s needed to defeat the phish of 2020 and beyond. From decentralized threat intelligence sharing and greater public-private collaboration to automatic incident response and mailbox-level security, these safeguards are better suited to combat the future of anti-phishing because they rely on human and technical controls working together 24\/7\/365. <\/p>\n

Evolution of email security<\/strong>
Looking back over the past decade, email security has, admittedly, come a very long way. Eight years ago, organizations relied almost entirely on spam filters and antivirus software to protect against Nigerian scams. Eventually, antivirus products were rejected as the sole line of email defense, as attackers found creative and cost-effective ways to defeat these controls.<\/p>\n

Phishing technique advancements prompted secure email gateways (SEGs) to enter the market, and this technology remains the most common phishing prevention method. Around the same time as SEGs, security training became part of the corporate lexicon, and employers attempted to gain some advantage over attackers by using employees to identify and corral suspicious messages. <\/p>\n

Unfortunately, attackers responded to the increased employee awareness and SEG technology by creating new attack techniques that bypass common email security controls. In response, many enterprises have added gamification to their security training as a means to bolster employee situational awareness while also implementing authentication and encryption protocols such as DMARC.<\/p>\n

While such counter maneuvers are surely effective from time to time, attackers continue to have the upper hand while enterprises look toward 2020 for a silver bullet. Unfortunately, one is not going to appear.  <\/p>\n

Email security challenges that elevate risk<\/strong>
The email security industry is in the midst of an intense debate over what technology, standards and protocols can deliver the most protection and reduce the most risk. The common arguments are a bit ironic when considering that successful cyberattacks continue to cost enterprises more than $1 million per incident.<\/p>\n

The most common arguments include:<\/p>\n