Email remains the vector of choice for cyber-criminals, with half of firms (51%) suffering a ransomware attack and even more (58%) seeing an increase in phishing over the past year, according to Mimecast.
The security vendor’s annual State of Email Security report is based on data collected from over 1000 global IT decision makers over February and March, and so is heavily influenced by the COVID-19 crisis.
In fact, while 60% of respondents said they experienced an increase in impersonation attacks (including BEC) over the past year, there was a 30% spike in the first 100 days of the pandemic alone (Jan-April 2020).
Downtime (82%) and data loss (31%) were two of the most common impacts of email attacks and an overall lack of cyber-resilience.
“The increase in remote working due to the global pandemic has only amplified the risks businesses face from these threats, making the need for effective cyber-resilience essential,” said Joshua Douglas, vice-president of threat intelligence at Mimecast. “It’s likely that cyber-resilience strategies are lacking key elements, or don’t have any at all, depending on the organization’s maturity in cybersecurity.”
Interestingly, 60% of respondents claimed that they had suffered an attack which spread from one infected user to other employees, highlighting the importance of enhanced staff training to stop that first attack.
Unfortunately, the report claimed that over half (55%) of those polled don’t provide awareness training on a frequent basis.
Perhaps unsurprisingly, the vast majority (85%) of IT leaders said they expected web and email spoofing volumes to stay the same or increase over the coming year, while 60% believe it is inevitable or likely they will suffer an email-borne attack.
“Security leaders need to invest in a strategy that builds resilience moving at the same pace as digital transformation,” argued Douglas.
“This means organizations must apply a layered approach to email security, one that consists of attack prevention, security awareness training, roaming web security tied to email efficacy, brand exploitation protection, threat remediation and business continuity.”