Email Vulnerabilities and How S/MIME Can Help

Types of Email Threats

It is impossible to run a business without email. That’s a simple fact. Businesses across industries depend upon email as an indispensable communication method, keeping employees in touch with customers, partners, vendors, and, of course, each other.

But email communication has its drawbacks. Common threats to email messages and attachments include the ability for them to be spied upon, altered, and faked, leaving businesses and organizations vulnerable to a wide range of possible cyberattacks. One of the most common tactics related to this is a phishing attack. A phishing email is one that appears to be from a legitimate source but contains a malicious link or harmful attachment.

This type of attack can come in many forms. One of the most common is a spear phishing attack, which targets specific individuals and accounts by impersonating someone within the organization—likely a CEO, CFO, or other leadership figure. Employees in departments such as finance or HR might receive an email urgently asking them to do something like process a payment or relay confidential information, with the sender claiming to be unavailable to confirm the authenticity of the request.

This may seem straightforward or obvious, but cybercriminals can be incredibly sneaky. You may have heard of approaches like typosquatting, where hackers register domains a letter or two different from legitimate domains and use them to register email addresses that appear authentic at first glance. The truth is, in many cases, this isn’t even necessary. Email spoofing is easy and all too often, effective. This method involves spoofing a “from” email address —meaning that the phisher can simply put the email address they want to appear in the “from” field into the appropriate place in the email header, and that is what the recipient will see. Even eagle-eyed individuals wary of typosquatting and other simple phishing methods may not recognize a fraudulent email if it appears to come from a legitimate source.

Potential for Damage

These attacks can result in the loss of industry secrets, confidential information, sensitive data, or even money from company accounts. What’s worse, these incidents can also place enterprises into non-compliance status with mandatory regulatory requirements.

The potential for damage here is very real. A recent FBI report indicates that there has been $2 billion in fraud loss since April, 2020 as a result of Business Email Compromise (BEC) attacks—a specific form of spear phishing attack that ends in sending money to the spear phisher. And those are just the incidents that were reported, indicating the true number is likely much higher. In fact, losses from BEC attacks are higher than any other form of cyber-enabled crime, a clear indication that email security awareness must be among the primary cybersecurity concerns for any business.

The damages can go beyond the initial fraud losses too. Being subject to a data breach can erode public and customer trust, causing potentially irreparable harm to your company’s reputation — and bottom line.

How S/MIME Can Help

Don’t worry—there is good news. During the next few weeks, the Sectigo team will break down how organizations can defend against these attacks (and other scams like them) using digital certificates.

Secure/Multipurpose Internet Mail Extension (S/MIME) email certificate technology can address the problems and vulnerabilities inherent to email, improving both an organization’s protection against spying and protecting its employees from social engineering attacks that depend on email. S/MIME sets itself apart from standard email protections, such as antivirus programs, by verifying the sender, rather than simply analyzing an email for threats once it has been received. It also protects the contents of email during transit.

How does S/MIME address the vulnerabilities with email? There are three distinct ways in which it improves the security profile of email communications.

• It verifies the authenticity of the sender, confirming that the sender is who the person claimed.
• It encrypts all content and attachments within emails, preventing malicious software from intercepting email communication in transit and reading its contents.
• The protocol also provides an assurance of integrity, ensuring that transmitted email is unaltered and giving receivers the peace of mind that the messages and attachments they have received are identical to what was sent

This continuing blog series will explore specific ways that businesses and organizations can deploy S/MIME technology, including as a method of defense against spear phishing and a way to remain compliant with information security regulations such as GDPR and HIPAA. As more and more organizations look to deploy this type of technology, understanding the many ways it can be used to help protect a business will help provide a fuller picture of S/MIME’s value.

Read the rest of the blog series:

• S/MIME 101: Protecting Yourself from Spear Phishing Attacks
• S/MIME 101: How S/MIME Can Help with HIPAA Compliance
• S/MIME 101: Maintaining DFARS Compliance Using S/MIME
• S/MIME 101: Making GDPR Compliance Easy with S/MIME