Story image

25% of malicious emails still make it through to recipients

12 Dec 2018

Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.

The company’s latest quarterly Email Security Risk Assessment (ESRA) found that out of the 181.9 million emails scanned, 21.2 million spam emails were not picked up by organisations’ email security systems.

Those email security systems also missed more than 25% of emails containing dangerous file types .jsp, .exe, .dll, and .src.

Mimecast says these file types are rarely sent by email for legitimate purposes and they are often used to conduct an attack.

The report also found 21,183,014 spam emails, 17,403 malware attachments, 42,350 impersonation attacks and 205,363 malicious URLS, all of which were missed by email security systems. 12% of all secured and filtered email were unwanted emails, so they were false negatives.

“Attacks we are seeing include key executives being targeted with cloud storage services exploits, impersonation attacks targeting legal, finance and administrative assistance as well as social engineering attacks against the C-suite,” explains Mimecast security service director Lindsay Jack. 

“Mimecast has seen an increase in security efficacy versus legacy vendors along with detailed information on the proliferation of threats of all types. The ESRA provides deep insights for our customers on the types of attacks threatening their business.”

Mimecast cybersecurity strategist Matthew Gardiner adds that criminals are constantly adapting email-based attacks.

Criminals are looking for new ways to bypass security solutions that rely too heavily on signature-based files or reputation-based detection.

“Mimecast uses multiple layers and types of detection engines, combined with high performance analytics, a diverse set of threat intelligence sources, and computer aided human analysis to identify and stop unsafe emails from getting into our customers’ inboxes.”

Mimecast determined that 160.6 million of the emails it analysed were safe. This quarter’s assessment found that these email security systems are missing more than 25% of emails containing dangerous file types in comparison to last quarter’s findings.

Aerohive launches guide to cloud-managed network access control
NAC for Dummies teaches the key aspects of network access control within enterprise IT networks and how you can secure all devices on the network.
Sungard AS named DRaaS leader by Forrester
It was noted for its disaster-recovery-as-a-service solution’s ability to “serve client needs at all stages of their need for business continuity.”
Gartner: The five priorities of privacy executives
The priorities highlight the need for strategic approaches to engage with shifting regulatory, technology, customer and third-party risk trends.
Thycotic debunks top Privileged Access Management myths
Privileged Access encompasses access to computers, networks and network devices, software applications, digital documents and other digital assets.
Veeam reports double-digit Q1 growth
We are now focussed on an aggressive strategy to help businesses transition to cloud with Backup and Cloud Data Management solutions.
Paving the road to self-sovereign identity using blockchain
Internet users are often required to input personal information and highly-valuable data from contact numbers to email addresses to make use of the various platforms and services available online.
Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within Tenable.io.