Industry executives and experts share their predictions for 2024.  Read them in this 16th annual VMblog.com series exclusive.

Top 5 Email Security Challenges Requiring a Zero-Trust Approach in 2024

By Itay Glick, VP of Products at OPSWAT

In 2023, the cybersecurity landscape faced an unprecedented wave of cyber threats, with email systems at the forefront of these attacks. This article explores the top five email security threats of the past year and highlights the importance of a zero-trust approach for organizations moving into 2024. 

1. Credential Harvesting

Credential harvesting emerged as a formidable threat in 2023, accounting for 41% of breaches. This method involves collecting user credentials to gain unauthorized access to systems and sensitive data. The sophistication of these attacks, often combining malware, phishing, and domain spoofing, poses a severe challenge to traditional security measures.

Credential harvesting is not just about unauthorized access; it's often the first step to more extensive cyber offensives. The acquired credentials can be used for data theft, system infiltration, and even as a precursor to more advanced attacks. 

2. Fileless Malware

Fileless malware attacks dramatically increased in 2023, recording a 1,400% surge in occurrences. This technique exploits legitimate system tools for malicious purposes, making it challenging to detect. It represents a shift in attack methodologies, requiring more advanced detection and prevention strategies.

Unlike traditional malware, fileless malware doesn't require the attacker to install any code on the target's system. This makes it a particularly insidious approach to cyberattacks, as it can evade standard detection methods. The significant rise in these attacks signals an urgent need for real-time and adaptive security solutions.

3. Unknown Malware

Unknown malware, characterized by its novelty and evasion techniques, poses a continuous threat. In 2023, the AV-TEST Institute registered over 450,000 new malicious programs, highlighting the scale of this challenge. Unknown malware's "unknown" status makes it particularly challenging to detect and prevent.

The continuous emergence of new malware families, often derived from open-source code or leaked source codes, along with the release of updated versions featuring enhanced evasion techniques, contributes to the expanding landscape of unknown threats.

4. Dormant Malware

Dormant malware, or sleeper malware, remains inactive within systems until triggered by specific conditions. Its stealthy nature makes it a formidable threat, capable of bypassing conventional detection methods.

Dormant malware is designed to evade detection and activate under certain conditions, such as a specific date, user actions, network connections, or environmental changes. This type of malware can lie undetected for extended periods, making it a significant threat to organizational security.

5. Business Email Compromise (BEC)

In the most recent Internet Crime Report published by the FBI's Internet Crime Complaint Center (IC3), Business Email Compromise (BEC) attacks were highlighted as a leading category of internet crimes. These attacks resulted in significant financial losses, totaling $83.8 million in the state of Illinois alone. 

BEC is a sophisticated cyberattack that leverages social engineering to manipulate victims. Byimpersonating trusted individuals to deceive employees or customers into taking harmful actions, these attacks exploit human trust and are challenging to detect through traditional security measures.The FBI identifies various types of BEC scams, including account compromise, attorney impersonation, CEO fraud, data theft, and fake invoice scams. The financial and reputational damage caused by BEC attacks makes them a critical threat to address.

A Zero-Trust Approach for Email Security in 2024

Adopting a zero-trust approach in email security is a critical strategy for combating the sophisticated cyber threats identified in 2023. This approach, which treats every email and file with the principle of "never trust, always verify," can be effectively implemented using various advanced technologies and practices:

• Credential Harvesting, Fileless Malware, and Unknown Malware
• These threats are collectively tackled by implementing advanced scanning and real-time analysis of all email attachments and links. This process is crucial irrespective of the sender's perceived trustworthiness.
• For credential harvesting, this approach helps in identifying phishing links or malicious attachments that could lead to credential theft.
• In the case of fileless and unknown malware, the focus is on detecting unusual behaviors or content patterns that may not match known malware signatures but still pose a significant threat. This includes identifying script executions or memory exploits typical of fileless malware, as well as new or previously unidentified malware types.

• Dormant Malware and BEC
• Dormant malware and BEC attacks require continuous monitoring and analysis of email content, even after initial delivery. This ongoing vigilance helps in identifying and neutralizing threats that may activate later or involve sophisticated social engineering tactics.
• For dormant malware, this means detecting changes or activities within the email system that could indicate malware activation.
• In combating BEC, stringent verification of email content and sender identity is essential, along with training users to recognize and report suspicious activities. Treating every email as a potential BEC attempt ensures a proactive stance against these targeted scams.

In summary, a zero-trust approach in email security requires a comprehensive set of technologies and practices. These include advanced threat detection systems, continuous monitoring and analysis tools, and ongoing user education and awareness. By implementing these measures, organizations can create a resilient email security posture capable of countering the evolving cyber threats of the cybersecurity landscape.

##

ABOUT THE AUTHOR

Itay Glick, VP of Products, OPSWAT

Itay Glick serves as Vice President of Products at OPSWAT and brings more than 17 years of executive management experience in cybersecurity at global technology companies based in the U.S., Europe, and Asia. Before OPSWAT, he served as AVP of network and cloud security at Allot, and before that, founded his own company and played a key role in managing the development of equipment for the lawful interception market on behalf of Verint Systems. Itay launched his career as a software engineer in an elite intelligence unit of the Israel Defense Forces. He holds an M.B.A. from Bar-Ilan University and a B.Sc. in electrical engineering from the Technion – Israel Institute of Technology.