Story image

25% of malicious emails still make it through to recipients

12 Dec 2018

Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.

The company’s latest quarterly Email Security Risk Assessment (ESRA) found that out of the 181.9 million emails scanned, 21.2 million spam emails were not picked up by organisations’ email security systems.

Those email security systems also missed more than 25% of emails containing dangerous file types .jsp, .exe, .dll, and .src.

Mimecast says these file types are rarely sent by email for legitimate purposes and they are often used to conduct an attack.

The report also found 21,183,014 spam emails, 17,403 malware attachments, 42,350 impersonation attacks and 205,363 malicious URLS, all of which were missed by email security systems. 12% of all secured and filtered email were unwanted emails, so they were false negatives.

“Attacks we are seeing include key executives being targeted with cloud storage services exploits, impersonation attacks targeting legal, finance and administrative assistance as well as social engineering attacks against the C-suite,” explains Mimecast security service director Lindsay Jack. 

“Mimecast has seen an increase in security efficacy versus legacy vendors along with detailed information on the proliferation of threats of all types. The ESRA provides deep insights for our customers on the types of attacks threatening their business.”

Mimecast cybersecurity strategist Matthew Gardiner adds that criminals are constantly adapting email-based attacks.

Criminals are looking for new ways to bypass security solutions that rely too heavily on signature-based files or reputation-based detection.

“Mimecast uses multiple layers and types of detection engines, combined with high performance analytics, a diverse set of threat intelligence sources, and computer aided human analysis to identify and stop unsafe emails from getting into our customers’ inboxes.”

Mimecast determined that 160.6 million of the emails it analysed were safe. This quarter’s assessment found that these email security systems are missing more than 25% of emails containing dangerous file types in comparison to last quarter’s findings.

Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nozomi and RIoT to deliver advanced ICS security solutions to Australia
''As a specialised integrator of robust and resilient ICT and IoT solutions within Australia, we are delighted to be partnering with Nozomi Networks."
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.
SIS announces a partnership with Platform 4
“We are looking forward to a strong future in the New Zealand security industry with this global giant as our strategic partner."
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
Developing APAC countries most vulnerable to malware - Microsoft
“As cyberattacks continue to increase in frequency and sophistication, understanding prevalent cyberthreats and how to limit their impact has become an imperative.”