The crucial double check

Issue 8 2021 Security Services & Risk Management

Cybersecurity has quickly become the world’s fastest growing form of criminal activity and is showing no sign of slowing down with the number of attacks on businesses continuing to increase. Covid-19 has acted as a catalyst for this, with hackers taking advantage of remote workers during challenging times.

Despite innovations and sophistication in hacking methods, one of the main means of data loss is insiders, including employees making mistakes. Humans make errors – stressed, distracted employees will make even more mistakes. And with sensitive information on the line, such as regulatory compliance to safeguarding intellectual property (IP), companies are increasingly concerned about the risk of inadvertent data loss. But how can this threat be mitigated?

Andrea Babbs, UK general manager, VIPRE SafeSend, emphasises the importance of implementing a crucial double check to improve email security culture.

Human error

Business reliance on email is creating a very significant cybersecurity risk and not simply due to the increasing volume and sophistication of phishing and ransomware attacks. Given the sheer volume of emails sent and received a day (over 300 billion every day in 2020), mistakes are inevitable. Employees are trusted with company-sensitive information and assets and many are permitted to make financial transactions – often without requiring additional approval. Furthermore, with strict data protection requirements in place, not only GDPR, but also industry specific regulations, organisations clearly require robust processes to mitigate the risk of inadvertent data loss.

According to reports, 34% of all breaches are caused by insider fault, yet many employees are unaware of their responsibility when it comes to data protection. Should confidential corporate information fall into the wrong hands, the consequences could be devastating, including financial penalties, loss of trust and competitors gaining an advantage. BitMEX, one of the world’s largest cryptocurrency trading platforms accidentally leaked thousands of private customer email addresses when they sent out a mass mailshot without using the BCC function.

But how could this mistake be stopped? What employees need is a way to better manage their email functions, with an opportunity for potential mistakes to be flagged before an individual hits send, for example showing who is in the to, cc and bcc fields.

Additional layers

Few organisations have a clear strategy for helping their employees understand how a simple error can put the company at significant risk; even fewer have a strategy for mitigating that risk and protecting their staff from becoming an insider threat. But more importantly, what they may not be aware of is that there is a solution available that can add a layer of employee security awareness.

Businesses can help employees avoid simple mistakes, such as misaddressed emails, by providing a simple safety check, which alerts users to confirm both the identity of the addressee(s) and if relevant, any attachments. The solution can be configured to work on a department or user basis, for example, a business may not want HR to be able to mistakenly send sensitive personal information to anyone internally and therefore require a confirmation for all emails.

In addition to confirming email addresses and attachment(s), the technology can also check for keywords within the email content using data loss prevention (DLP) rules and each business can set its own requirements and parameters determined by corporate security protocols. Any emails, including attachments containing these keywords, will be flagged, requiring an extra process of validity before they are sent without impeding working practices and providing users with a chance to double check whether the data should be shared with the recipient(s).

The essential ‘pause’ moment

Deploying an essential tool that prompts for a second check and warns when a mistake is about to be made helps organisations mitigate the risk of accidental error and the potentially devastating consequences that might have on the business. Accidentally cc-ing a customer, rather than the similarly named colleague, will be avoided because the customer’s domain will not be on the allow list and therefore automatically highlighted. This is more crucial than ever before with employees dispersed across a range of locations as part of hybrid working. Such tools can support mixed operating system environments and DLP add-ons can be given to certain departments and groups who handle very sensitive information such as employee or legal data.

This type of tool is key for companies and reinforces a security culture, building on education and training, with a valuable solution that helps users avoid the common email mistakes that are inevitable when people are distracted, tired or stressed. It provides an essential ‘pause’ moment, enabling individuals to feel confident that emails have been sent to the right people and with the right attachments.

In addition to checking the validity of outbound and inbound email addresses and attachments, it can also support in minimising the risk of staff falling foul of a phishing attack. For example, an email that purports to come from inside the company, but actually has a cleverly disguised similar domain name, such as receiving an email from V1PRE, as opposed to VIPRE. The technology will automatically flag that email when the user replies showing that it is not from an allowed domain, enabling the user to cancel send and avoid falling for the phishing attack.

Conclusion

Email is arguably the key productivity tool in most working environments today, placing much of the responsibility for secure use of that tool on employees. But supporting staff with an extra prompt for them to double check they aren’t mistakenly sharing confidential data helps to raise awareness, understanding and provides that essential security lock-step – before it’s too late. The premise is not to add time or delay in the day-to-day management of email; it is about fostering an attitude of awareness and care in an area where a mistake is easily made 

No organisation is immune to human error, but by having a clear strategy in place to address the issue of misaddressed emails and data loss through emails, as well as mitigating the associated risks helps businesses to remain compliant and secure. It’s all about increasing awareness and improving email culture where mistakes can so easily be made, while reinforcing compliance credentials.

Find out more at https://global.vipre.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

BT launches new security platform
Security Services & Risk Management
Relentless growth and ever-changing nature of the threat landscape dictates a new, proactive approach to cybersecurity. Eagle-i addresses the more than 50% increase in malware traffic over the last six months.

Read more...
The state of the distribution market
ESDA (Electronic Security Distributors Association Bosch Building Technologies Dark Horse Distribution Elvey Security Technologies Regal Distributors SA G4S Secure Solutions SA Editor's Choice Security Services & Risk Management
The distribution industry has evolved over the years and its current challenges simply mean another change is in the wind, for those who can take the next step.

Read more...
Training that delivers
Technews Publishing Leaderware ESDA (Electronic Security Distributors Association BTC Training Africa Editor's Choice Security Services & Risk Management Conferences & Events Training & Education
Hi-Tech Security Solutions hosted a virtual conversation to address the challenges and solutions related to effective and measurable training and education in the security industry.

Read more...
The importance of traceable records
Technews Publishing Editor's Choice Security Services & Risk Management
Traceable records streamline performance management, training, evidence records and reduce fraud, corruption and criminal activities.

Read more...
Creating the district ID database
Technews Publishing Agriculture (Industry) Security Services & Risk Management
Continuing his series on preparing for and preventing farm attacks, Laurence Palmer discusses developing an identity system for districts at risk.

Read more...
Expand your security company offering with mySOS
Security Services & Risk Management
Expand your existing security solutions with a mobile, branded panic button from mySOS. You can now protect your existing client base beyond the perimeter of their property and add real value.

Read more...
Is industry inertia keeping SIM-swap fraud alive?
Security Services & Risk Management
SIM-swap fraud has been around for decades and according to the latest SABRIC figures, incidents increased 91% year-on-year when looking at digital banking fraud across all platforms.

Read more...
Personal security awareness
LD Africa Security Services & Risk Management
Whether it’s our homes, cars, family, businesses or assets, personal security is something that has to be considered daily.

Read more...
Threat level raised to Omega Status (plan for the worst)
Security Services & Risk Management
It is the security industry that is implementing the health protocols on the ground. They take the temperatures of people, manage the movement of people and are the ones criticised.

Read more...
Why co-sourcing is a smart choice for cybersecurity
Security Services & Risk Management
Todd Schoeman, BT client business director in South Africa, shares insights on how a collaborative model for security can help organisations defend against rapidly increasing cyber threats.

Read more...