Story image

Email prime target for cyber attacks, FirstWave responds with domain filter

20 Apr 16

In response to increasing number of attacks targeting email, such as the C-Level Impersonation filter and other ‘whaling’ attacks, FirstWave Cloud Technology has launched a Typo Domain filter on its ESPTM Mail cloud security platform.

This new filter has been designed to deflect and block sophisticated email phishing threats targeting the wider attack surface of email users at any organisation level in the enterprise, according to a statement.

According to FirstWave, cyber attackers can take advantage of Internationalised Domain Names (IDNs) with special character sets to create and send phishing emails from servers using legitimately-established domain names - these are indistinguishable to most recipients from well-known or trusted domain names. Attacks such as this are sometimes known under the banner of homograph attacks or imposter email attacks.

FirstWave says attackers can apply this technique and use a homograph of a company’s own domain name or names to trick employees of that company to accept and click on links in emails that appear to be legitimately coming from within their own organisation.

The majority of existing email security and phishing filters cannot assure they will block such an attack, according to the company. Standard sender domain authentication techniques used by email transport nodes and email security gateways, such as SPF and DKIM, can be penetrated because these homograph domains can appear authentic in the DNS system.

To provide a broad yet enterprise specific defence against this form of attack, FirstWave Cloud Technology’s Typo Domain filter uses advanced ‘fuzzy matching‘ software library algorithms in its ESPTM Mail platform, tested against a wide range of homograph domain attack scenarios. As such, the filter is designed to provide high protection efficacy and very low false positives.

According to FirstWave, the Typo Domain filter will automatically protect all customer domains already configured on the FirstWave cloud Mail security service, without the need for any customer administrator configuration action.

Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.