Gmail and other common mail providers are failing to filter out a quarter or more of dangerous emails from users’ inboxes.
According to Mimecast’s third quarterly Email Security Risk Assessment (ESRA), these mails can contain malicious attachments and dangerous files types, be used for business email compromise and impersonation attacks, or be spam and phishing attempts. Also, the risks to email remain whether delivered to a cloud-based, on-premises or to a hybrid email environment.
“Email remains the top attack vector for delivering security threats such as ransomware, impersonation, and malicious files or URLs,” the firm said, noting that 91% of cyberattacks start with an email. “Attackers’ motives include credential theft, extracting a ransom, defrauding victims of corporate data and funds, and, in several recent cases, sabotage with data being permanently destroyed.”
When the data was sliced by incumbent email security vendor (including Google G Suite, Microsoft 365 and Symantec), the report found that even these top players were missing commonly found advanced security threats, highlighting the need for a multi-layered approach to email security. Notably the cloud vendors are leaving organizations vulnerable by missing millions of spam emails and thousands of threats and allowing them to be delivered to the users’ email inboxes: More than 10.8 million pieces of spam made it through incumbent email security systems, as well as 8,682 dangerous file types, 1,778 known and 503 unknown malware attachments, and 9,677 impersonation emails.
“Many organizations have a false sense of security believing that a single cloud email vendor can provide the appropriate security measures to ensure protection from email threats,” the report noted.
From a historical perspective, Mimecast has examined the inbound email received for 62,323 email users over a cumulative 428 days, more than 45 million emails were inspected, all of which had passed through the incumbent email security system in use by each organization. Of this, 31 percent were deemed “unsafe” by the firm.
Late last year, Mimecast commissioned Forrester Consulting to evaluate drivers of cloud-based email adoption and to evaluate their related business concerns and expectations. That report, titled Closing the Cloud Email Security Gap, revealed that only 5% of respondents are very confident in the overall security capabilities of their chosen email cloud provider. In fact, 44% of respondents said they would review the security implications of their cloud provider more thoroughly if they were to deploy a cloud-based email platform again.
“To achieve a comprehensive cyber-resilience strategy, organizations need to first assess the actual capabilities of their current email security solution. Then, they should ensure there’s a plan in place that covers advanced security, data management and business continuity, as well as awareness training to the end user, which combined help prevent attacks and mitigate business impact,” said Ed Jennings, chief operating officer at Mimecast. “These quarterly Mimecast ESRA reports highlight the need for the entire industry to work toward a higher standard of email security.”