Email Social Engineering as the Main Vector for Data Breaches

Whether it’s because the amount of data worldwide has been increasing substantially, or it’s due to the ever-increasing sophistication of hackers' techniques, the problem with Breaches is still here.

Data breaches are, unfortunately, a very common problem in 2019. They've been growing exponentially, and the trend doesn't seem to be stopping. Whether it’s because the amount of data worldwide has been increasing substantially, or it’s due to the ever-increasing sophistication of hackers' techniques, the problem is still threatening businesses all around the world.

Just take a look at the numbers from Statista:

The number of breaches in the US grew significantly in the past few years. In 2017 there were more than 1,600 data breaches and 1,200 in 2018. However, despite the unusual fall in numbers, the scope grew by more than 100% with almost 200 million records exposed in 2018 and nearly 450 million in 2018.  One thing to notice is that recent legislation made it necessary for US and EU companies to report on the breaches - We suspect that "back in the old days", many breaches were left hidden from the public eye.

If that’s not enough, you should know that most of the largest data breaches ever have happened in the past few years. The same goes for the biggest scandals in online security.

However, that's not all. What can be noticed from many of these breaches is that social engineering seems to be the primary vector. In the first half of 2018, 56% of all breaches were social media related. 

The Problem of Email Social Engineering

The social engineering attacks are broad in scope, and email is usually a big part of them. The problem with them is that they are becoming increasingly common. More often than not, they target enterprises and small businesses, and regular people fall victim far less often. What's more, they are becoming increasingly sophisticated.

The problem with these attacks is that they always use some form of psychological manipulation. The hackers using them find ingenious ways of tricking employees and executives into handing sensitive data and information.

In most cases, a typical social engineering attack uses email to trick a person by invoking urgency to send data, praying on emotions, sending malware masked in regular attachments and links, and more. 

The problem here is that these attacks, especially the malware they send, rarely try to exploit a technical flaw in the system. According to KnowBe4, only 3% of malware does that, while 97% is a social engineering scheme of some sorts. This shows that going through humans is much better than trying to target the systems directly, and hackers and other cybercriminals know this.

How to Deal with Email Social Engineering

As the problem comes from emails seemingly appearing normal and from a trustworthy source, the solution would be to detect these emails. 

However, with hundreds, if not thousands of emails going to and from your company each day, it's hard to be thorough with each email. That's precisely what the hackers are counting on.

Remember that the social engineering has, most of the times, one or two great goals: attackers go after your private information or your money. And what this means, as a mantra, is that you should look at email has good for conducting business but not necessarily for closing it - meaning that when it's about transferring funds or signing legal and commercial documentation, you'll need to implement an extra dose of carefulness - involve other people,  verify emails by following up with phone calls, implement financial solutions for tracking down abuse, and other mechanisms. 

Invest in People & Technology to Protect your Business Email

And, obviously, you'll need to invest in both the people - educating the workforce - and the technology -a more robust email protection software, able to recognize dubious patterns in your email content and attachments, find malware, and work in conjunction with the worldwide set of reputation and fingerprints.

In the end, implement good security measures on the famous triumvirate of people, processes, and technology.  And your company is likely to be far more secure from the plague of email social engineering that exists today.