Zero Trust issues in Email

Zero Trust is a concept regarding the unclear separation between what is previously trustable, and internal, and friendly, from what is external, unknown and potentially disruptive. This is a very valid preposition for modern email security.

Nowadays, the security landscape is more challenging than ever before. This is especially true for email security. 

Email threats have moved beyond delivering malicious links and attachments to manipulating sender identity in order to fool recipients and initiate social engineering attacks. Most of these attacks don’t contain any form of malware, and the lack of identifiable malicious content in such emails means they can easily bypass the latest email defenses. 

According to Google, 68% of phishing emails have never been seen before! This means that businesses need a security model that can quickly adapt in real-time to deal with fast-evolving threats and hackers who always seem to be one step ahead. 

What is Zero Trust Security?

Zero trust is a strategic approach that helps prevent data breaches by eliminating the concept of trust from an organization's network architecture. Based on the policy of "never trust, always verify," zero trust is created to protect the digital environment by leveraging network segmentation, delivering layer 7 threat prevention, and simplifying granular user-access control. 

In simple words, zero trust is an IT security model that demands strict identity verification for every device and person trying to access available resources within a private network, regardless of whether they are located inside or outside the network's perimeter. 

Why You Need a Zero Trust Approach to Email Security

When it comes to identifying trends in social engineering and malicious content, AI/ML solutions are perfectly effective, but when it comes to sender identity, these solutions cannot provide useful information due to the speed with which email attackers change their identities. 

On the other hand, the zero trust model doesn't allow the delivery of messages unless they come from a sender who can be verified and who has been granted specific permission to deliver emails to that inbox. It also requires users to have their email properly filtered for leaked information or for enclosed malware.

An additional problem with the email security issue is that companies no longer store their data in just one place. Nowadays, information is often spread across cloud vendors, making it more challenging for an entire network to have a single security control.

By setting up zero-trust boundaries, companies can better protect their data hosted in the cloud, reduce the exposure of vulnerable systems, and prevent the spreading of malware throughout the network.

Deploying Zero Trust

Executing zero trust is often perceived as costly and complex. However, this security model is built upon the existing architecture and does not require replacing existing technology. It is quite simple to implement and maintain with these steps:

1. Identify the protect surface and map the transaction flows - this means identifying which assets (information) you want to protect (remember that these include assets external to your organization) and map in which circumstances are this assets functioning (e.g. an employee getting email in the office computer, at home, travelling, using vpn, a lent device, ....)
2. Build a zero trust architecture and create zero trust policies - this means treating every user and every system as liable, either deliberately or accidental. 
3. Monitor and maintain

Conclusion

There's no filtering out the truth - you need to protect your company's email. The old model of defending from the outside-in is no longer functional. Your organization needs to be defended from inside-out, and that's one of the concepts that make zero trust a necessity. We recommend deploying an effective DMARC policy on all domains and subdomains with supporting SPF and DKIM implementations. We also recommend proper Outbound filtering, including DLP and even Malware Analysis.