Story image

25% of malicious emails still make it through to recipients

12 Dec 2018

Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.

The company’s latest quarterly Email Security Risk Assessment (ESRA) found that out of the 181.9 million emails scanned, 21.2 million spam emails were not picked up by organisations’ email security systems.

Those email security systems also missed more than 25% of emails containing dangerous file types .jsp, .exe, .dll, and .src.

Mimecast says these file types are rarely sent by email for legitimate purposes and they are often used to conduct an attack.

The report also found 21,183,014 spam emails, 17,403 malware attachments, 42,350 impersonation attacks and 205,363 malicious URLS, all of which were missed by email security systems. 12% of all secured and filtered email were unwanted emails, so they were false negatives.

“Attacks we are seeing include key executives being targeted with cloud storage services exploits, impersonation attacks targeting legal, finance and administrative assistance as well as social engineering attacks against the C-suite,” explains Mimecast security service director Lindsay Jack. 

“Mimecast has seen an increase in security efficacy versus legacy vendors along with detailed information on the proliferation of threats of all types. The ESRA provides deep insights for our customers on the types of attacks threatening their business.”

Mimecast cybersecurity strategist Matthew Gardiner adds that criminals are constantly adapting email-based attacks.

Criminals are looking for new ways to bypass security solutions that rely too heavily on signature-based files or reputation-based detection.

“Mimecast uses multiple layers and types of detection engines, combined with high performance analytics, a diverse set of threat intelligence sources, and computer aided human analysis to identify and stop unsafe emails from getting into our customers’ inboxes.”

Mimecast determined that 160.6 million of the emails it analysed were safe. This quarter’s assessment found that these email security systems are missing more than 25% of emails containing dangerous file types in comparison to last quarter’s findings.

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.