The world of data security is experiencing a wealth of innovative advances thanks to new developments in information technology. With new tools being developed daily sometimes many consumers will want to have the latest and greatest technology in order to feel they have the best possible security. This is a fallacy, one that could end up leaving a company much more vulnerable than they were before. Data security strategy exist at the axis of process, people, and technology. It is for this reason that whatever technology is selected much be in sync with processes and people to address security vulnerabilities. One practice that is quickly falling out of the spotlight is email monitoring. Cyber attackers are targeting negligent insiders by way of company inboxes. If you are not keeping track of employee inboxes you may already have been breached and wouldn’t realized it.Data security strategy exist at the axis of process, people, and technology. Click To Tweet
Attack Surface: Emails, Social Engineering, and Insiders
The primary method of cyber attacks, email, has not really budged much over the last few years. According to Verizon’s 2018 Data Breach Investigations Report the main method of cyber attacks are through email, by main we mean 96% of cyber attacks. To add even more worry, companies are three times more likely to suffer from a data breach due to very well crafted social attacks. Keep in mind your attack surface is the sum of all points/vectors a malicious actor can use to breach your security.
Thankfully email attacks are only successful with about 4% of employees, while 80% are able to spot a phishing email. Now keep in mind this is regarding negligent insiders, what about employees who have malicious intent? If an employee knows their company doesn’t monitors emails it makes an effort of sabotage or espionage that much easier. All it would take is for the malicious employee to have malware sent to them and release it on the company network, which can make a backdoor or whatever they want.
Social engineering, the use of deception to manipulate people, is used when an external party wants to gain access to sensitive data through a negligent insider. However, when there is an insider threat there is no deception required since the cyber attackers have an insider already. Email becomes one of the most easiest access points in a company’s attack surface to cause major damage. All it requires is the download of one malicious file. Even amatuar cyber attackers can achieve a successful attack if someone opens a malicious file.
What are the Benefits of Integrating Email Monitoring
While it may not seem obvious at first but email monitoring has many benefits for not just your data security strategy but also for productivity, compliance, and legal matters. Our focus today is on the security benefits of email monitoring.
Email monitoring provides the ability for employers to identify potential risks in employee communications. One such risk may be an employee who shares nonmaterial information about the company with unauthorized people, including other employees. Such practices means that at some point that employee could potentially share information that comprises the company’s security. Once you have identified risky behaviors it becomes easier to know what other security practices may be most effective in your data security strategy. The example above demonstrates a potentially need for separation of duties and a policy of least privilege.
Accountability & Policy Enforcement
Security education is promoted as one of the top deterrents to suffering a data breach. However, education is not really impactful if there is no follow up to determine if there has been a successful behavior change. With email monitoring you are able to determine if employees are in fact learning anything from the training provided. One of the ways you can test the follow up if you are monitoring is to run simulated phishing exercises to test how many people in your organization open the email. Some organizations such as Infosec Institute provide phishing templates for managers to use for testing in their organization. Surprisingly most people fell for the Netflix one.
In addition to training, you need to know if employees are in fact following company policy. Many companies for example make it clear that the business email account is strictly for business purposes. Despite that being clear in policy employees may not follow it and may use their business email to talk with personal friends or sign-up for things online. This of course puts your company’s network at increased risk for a data breach. There are accidents caused by employees following all the rules, but then there are blatant violations of company policy that leads to a data breach. The latter is unacceptable and with email monitoring would be spotted and dealt with quickly. It would be hard to maintain any data security strategy if a company has no means of monitoring and enforcing policies developed for data security.
Compliance and Record Keeping
When it comes to audits you can never be too prepared. Email monitoring significantly increases your ability to prove you’re attempting to meet compliance. Most regulation requires that you are taking reasonable steps to ensure data is secure. If you are not keeping track of the primary medium of communication, email, then you’re not exactly taking the precautions necessary to ensure that sensitive data is not being exchanged. Emails also protect employees who may have made honest mistakes as opposed to those who are intentionally violating policy. The email records also can be a basis for decisions that were made after a policy violation was discovered. Auditors may be interested to know how you handle violations and security incidents.
You really want to make sure email monitoring is included in your data security strategy. Despite communication tools like Slack and Telegram, email is still the number one form of communication for the public and private sector. Email is also the number one attack point and vulnerability in any organization. If email monitoring is not included in your data security strategy you open any sensitive data in your organization to compromise by way of malware or through insiders sharing it with third parties. Take the preemptive measure and include email monitoring in your security efforts. Click below to learn more about Teramind.