Cyber Defense eMagazine December 2019

51
The point is that 94% of malware attacks conducted through email, according to the Verizon 2019 DBIR.
Spinning up a seemingly legitimate email from a trusted individual or brand is fairly easy when anyone
can become a Photoshop wizard overnight. Email addresses and domain names can be masked, and it
is alarming how much personal information is publicly available on social media accounts. An enterprising
threat actor could easily find the name and email address of a manager or vendor and send an email with
a malicious attachment, such as a link to a compromised site or fake login page. By sending multiple
versions of the spoofed email with slight variations, threat actors can scale the attack, knowing that at
least one will eventually be clicked by the user.
This shift in strategy means that no matter how strong your cybersecurity defenses, your organization’s
cybersecurity posture is almost entirely reliant on users. Web filtering through traditional security solutions
need a reputational footprint of an attack based on third-party or internal threat intelligence. If an attack
is new or has been slightly modified, it can sneak through. In fact, many malware attacks have grown
sophisticated enough to identify whether they are in a sandbox and shut down until instructed to ramp up
again when executed on users’ devices. Users – whether apathetic, unsavvy or both – are then
responsible for determining what they can safely click on. As a result, phishing attacks are growing
increasingly more successful. Verizon’s research also shows that 30% of phishing messages are opened
by targeted users, so it is clear current defense mechanisms are not working.
What’s an enterprise to do? How can an enterprise build a robust cybersecurity strategy when attackers
continue to target the weakest link: the user? Traditional cybersecurity solutions and conventional threat
prevention products rely on detect and respond tactics and have failed to keep up with the evolving nature
of sophisticated phishing attacks. These solutions analyze web links in an email and make a ‘good vs.
bad’ determination. Unfortunately, this approach requires a reputational footprint to make a decision that
does not detect (and ultimately block) new or modified attacks.
Enterprises need to rethink how they can protect users from cybersecurity threats by implementing a
Zero Trust Internet policy. Instead of trying to determine what web content is bad, enterprises should just
assume that all content is risky and isolate everything to be safe. Making an isolate or block determination
is much safer than an allow or block approach, preventing even unknown attacks from executing malware
on end users’ devices or directing users to fake login pages where credentials can be stolen. All email
links and attachments can be opened in a safe isolation session in the cloud, protecting users from giving
away credentials or opening attachments in a sandbox or on the endpoint.
The result: 100 percent malware free email.