"There is a lot of sneaky stuff happening in the e-mail channel," Bradley Anstis, vice president of M86 Security, told attendees of the Gartner Security & Risk Management Summit 2011 in London.
Many e-mail-based attacks seek to manipulate users through social engineering techniques that are a critical part of many attacks, he said.
Education of users continues to be an important part of any security strategy, said Anstis. Social engineering is not something that can be solved with a technical patch, which is why educating users about the current threat landscape is important.
Tackling the problem from the technology side should be multi-layered, including e-mail which can be an important conduit for malware, he said.
M86 Security has used the multi-layered approach in its product for defending against client-side attacks.
It is a combination of reactive technologies such as URL filtering and signature-based anti-virus, and proactive technologies such as virtual vulnerability patching, file content inspection, static and dynamic code analysis, and dynamic web repair.
"Proactive controls are critical to detect dynamic malware, polymorphic viruses, targeted attacks and zero-day attacks," said Anstis.
In making technology choices, he said IT security professionals should look for innovation and not take a supplier's word on the performance of their products.
"Use one of the tools available to verify [suppliers'] claims in your own environment before buying, and look for a supplier backed by research labs and independent certification," he said.
This story was first published by Computer Weekly