Real-World Examples of Threat Actors Exploiting CrowdStrike Incident

Real-World Examples of Threat Actors Exploiting CrowdStrike Incident

by | Jul 26, 2024 | Email Security

The CrowdStrike global IT outage was an unfortunate event for millions worldwide ranging from IT services downtimes to airport delays and serious healthcare disruptions.

Threat actors swiftly exploit real-world events, launching targeted phishing attacks that capitalize on recent disruptions in emails. By leveraging the context of these incidents, they establish credibility and prey on employees’ fear and stress. The Security Lab at Hornetsecurity recently detected several new targeted phishing campaigns exploiting the CrowdStrike IT outage, using sophisticated social engineering tactics and harvesting Microsoft credentials.

In this blog, we will share real-world examples of the phishing attacks that we’ve intercepted in the past week, providing you with the knowledge to identify and avoid them, thereby safeguarding your business during these vulnerable times.

Real-World Phishing Campaigns: What to Look out for

In the phishing attempts listed below, we discuss key characteristics that reveal their malicious intent. As attackers persist in exploiting the CrowdStrike bug, they will likely adapt and use variations of these tactics.

phishing emails example 1
phishing emails example 2

Sender information

The emails claim to be from “Department Internal” and use urgent subject lines about a “Global Outage” and “IT-Ticket” issues.

Sense of urgency

  • They create a sense of urgency by mentioning a “GLOBAL IT OUTAGE REPORT” in all caps.
  • The phishing emails falsely claim that a global IT outage occurred, blaming it on Microsoft and Windows updates.
  • They state that general services have been disabled as a precaution, adding legitimacy to the fake scenario.
  • The emails mention potential impacts on banks, airlines, and media outlets to increase concern.

Call to action

A “RE-FIX ALL ISSUES” button is prominently displayed, likely leading to a malicious link.

RE-FIX ALL ISSUES malicious link

Legitimacy appearance

  • The HTML attachment names include terms like “sys_update” to appear legitimate.
  • When opened, the HTML attachment shows a nearly identical message to the email body.

Malicious links

  • The link in the HTML attachment leads to a suspicious external site (share-eu1.hsforms.com), abusing HubSpot forms.
  • This page shows a generic “Click here if you’re not automatically redirected” message.
  • The final destination appears to be a fake Microsoft login page aiming at harvesting legitimate users credentials.
  • It displays a Windows logo and email icon to mimic a legitimate Microsoft site.
  • A CAPTCHA is present, likely to give a false sense of security to the targeted user and to evade automated detection systems.
  • When the user passes the CAPTCHA, a fake M365 login page is displayed.
malicious links 1
malicious links 2
malicious links 3

How to Prepare your Organization for Phishing Attacks

As we’ve demonstrated in this article, threat actors are constantly looking to exploit real-world events that would be known by the average end-user. Here are practical measures your organization can implement to enhance your defenses and ensure your business remains secure against these sophisticated and opportunistic threats.

Train your employees

Security awareness training will train your staff to be wary of emails from unknown or unexpected sources, be cautious of emails that create a sense of urgency, avoid clicking on links, and avoid downloading attachments from suspicious emails.

Implement Advanced Threat Protection

Hornetsecurity is pioneering the threat intelligence capability to actively track and analyze the impact of significant world events on the cybersecurity landscape in real-time. Our proactive approach allows us to adapt our protection measures quickly, keeping you one step ahead of emerging threats and ensuring your organization stays secure.

Advanced Threat Protection (ATP), available within 365 Total Protection is specifically designed to neutralize these risks before they reach your inbox. Start your free trial today.

FAQ

What are the main tactics used in phishing attacks exploiting the CrowdStrike incident?

Phishing emails exploit the CrowdStrike incident by creating a sense of urgency with fake “Global Outage” reports, using urgent subject lines, and misleading links that lead to fake Microsoft login pages.

How can I identify phishing emails related to real-world events like the CrowdStrike outage?

Look for emails from unknown senders with urgent messages about global IT issues, suspicious links, and attachments with names like “sys_update.” Always verify the legitimacy of such communications.

What measures can I take to protect my organization from these phishing attacks?

Train employees to recognize and avoid suspicious emails, implement advanced threat protection solutions like Hornetsecurity’s 365 Total Protection, and stay updated with threat intelligence to enhance your cybersecurity defenses.

We Ranked the Olympic Nations on their Security Strength. The Gold Medal Goes to…

We Ranked the Olympic Nations on their Security Strength. The Gold Medal Goes to…

by | Jul 18, 2024 | Email Security, Security Awareness

As the world eagerly anticipates the 2024 Paris Olympic Games, athletes are not the only ones making final preparations. Behind the scenes, a different kind of competition is brewing as cybercriminals are gearing up to exploit the global event for malicious purposes.

The intersection of cyber attacks and the Olympic Games has become a significant concern for organizers, governments, and cybersecurity experts but how are Olympic federations responding to this threat? We built a tool to check the security posture of all the Olympic federations to find out.

The Playing Field

Email remains the #1 entry point for cyberattacks. With more than 1.5 million phishing sites created every month, email users are at risk of seeing their personal and business data breached. Indeed, the Olympics has a history of major email cyberattack breaches: in 2018 a fileless malware campaign was discovered targeting organizations associated with the winter Olympics held in Pyeongchang.

For this reason, checking the strength of an organization’s email security is an excellent indicator of their overall cyber security posture and is how we ranked the Olympic federations. But how exactly did we assess their email strength?

Olympics

The Rules of the Game

The following criteria were used to score the Olympic federations and committees, and build our rankings:

  • Has Email Security Gateway: Having an email security gateway is crucial because it acts as a barrier against various email-borne threats such as impersonation attempt, phishing, malware, etc… and can ensure the continuity of email services.
  • Has SPF record: An SPF record is important because it helps prevent email spoofing and protects against phishing attacks by specifying which mail servers are authorized to send emails on behalf of a domain.
  • SPF record is good: Here, we’re considering SPF records effectiveness, for instance whether they are configured with a “softfail” option, which is weak.
  • Has DMARC record: DMARC is crucial for preventing email spoofing and phishing by authenticating emails and specifying how to handle those that fail authentication, ensuring only legitimate emails reach recipients.
  • DMARC record is good: We consider DMARC records to be good when they receive a positive mark on a scan, such as from https://tools.sendmarc.com/.
  • Immune to bypass: Email security bypass is an old trick, but it is still working these days. This means that an organization has not restricted access to their email server, and as such, an attack can completely bypass their email security solution and directly reach their email server.  A recent paper on the topic: https://sumanthvrao.github.io/papers/rao-www-2024.pdf

Using the above criteria we created a very simple grading system. We built two different scales,  one for countries which had an email security gateway, one for those who did not, and attributed different weightings of the scoring criteria depending on our assessment of the respective contribution to email security.

The Podium

Having carried out the assessment of Olympic federations we have determined “Team Great Britain” is in first place. They achieved this position by exhibiting the strongest overall email security posture. Most notably, they use an email security gateway and have strong SPF and DMARC protection. “Team USA” is in second place, and “Team Netherlands” in third place.

False start!

As we don’t want to draw the attention of malicious agents to specific federations, we decided not to reveal the full rankings but in carrying out this investigation we noticed some concerning email security practices.

We have observed that around 60% of federations are using the Microsoft 365 solution. This is likely because it’s one of the most reliable suites of collaborative tools on the market. However, we have identified that two nations are directly exposing their mail servers on the internet, which is not a recommended behavior.

We found that the majority of SPF records are well configured, except for one nation that has the softfail option in their configuration.  This means that the emails are likely to get delivered to the intended recipient even though the sender has failed the SPF check, and as such, it may open the door to successful spoofing attempts. We took a look on each DMARC configurations, we found that only a minority have a good configuration based on our analysis.

Most countries do not use an email security gateway and one country was vulnerable to the “email security bypass”.  Once again, while this is not a groundbreaking attack technic, it is concerning considering the nature of the poorly protected organization, the nature of today’s threat landscape as well as the timing with the Olympics looming in.

To properly protect your email technology environment, use Hornetsecurity email services such as:

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

Final Thoughts

The Olympics has long been a hotbed for cybercrime and the 2024 Paris Olympics Games will be no different. Unfortunately, most of the Olympic Federations we tested fall short of the level of email security that is necessary. And this threat extends to companies and individuals. This is particularly alarming considering that email remains the #1 threat vector.

This is not just limited to Olympics committees. Small and large business will once again be the targets of cybercriminals using the upcoming games as the backdrop of their cyberattacks, whether they are ticket scams or extorsion attempts. So over the next few weeks if you receive an email from your HR department informing you that they have free tickets to the Olympic Games to give away and the first 10 that reply get them, be sure to think carefully before clicking that link.

Want to see how you score on the same criteria we used to rank the Olympic federations? Try out our Email Security Check. 

FAQ

Why is email security so important for the Olympic federations?

Email security is crucial because email remains the primary entry point for cyberattacks. Olympic federations handle sensitive information, and a breach could have severe consequences, including data theft and operational disruptions.

What criteria were used to rank the Olympic nations on their email security strength?

The rankings were based on several criteria, including the presence of an email security gateway, SPF and DMARC records, and protection against email security bypass. These factors indicate how well an organization can prevent email spoofing, phishing, and other cyber threats.

Which Olympic nation ranked highest in email security strength?

“Team Great Britain” ranked highest in email security strength, followed by “Team USA” and “Team Netherlands.” Great Britain achieved this by having a strong email security gateway and robust SPF and DMARC protection.

Is Ransomware Data Recovery Impossible?

Is Ransomware Data Recovery Impossible?

by | Jul 5, 2024 | Backup, Email Security

“I will find you and I will decrypt you”

Unfortunately, we can’t call up Liam Neeson if our data is encrypted via ransomware. Although he is a man with a particular set of skills, we do have to take proactive steps to ensure we can recover from ransomware.

What if you don’t have backups, is all hope lost?

How can we recover files from ransomware and what steps can we put in place to improve ransomware data recovery?

How Does a Ransomware Attack Typically Work?

There are several different entry methods for a ransomware attack, most of which involve malicious software. Ransomware encryption typically works by using a combination of symmetric and asymmetric encryption methods to lock and encrypt files.

Infection: The ransomware infects the victim’s system, often through phishing emails, malicious downloads, or exploiting vulnerabilities.

Key Generation: Once on the system, the ransomware generates a unique pair of keys for encryption: a public key and a private key. The public key is used to encrypt the files on the victim’s computer, while the private key is saved by the attacker.

File Encryption: The ransomware scans the system and network shares for files and encrypts them using the public key. This encryption is often strong and cannot be broken without the corresponding private key. The private key, which is needed to decrypt the files, is transferred and stored by the attacker.

Ransom Demand: The victim is presented with a ransom note via malicious software or through email demanding payment, usually in cryptocurrency, in exchange for the private key. If the victim pays the ransom, the attacker may provide the private key to decrypt the files.

It’s important to note that paying the ransom does not guarantee that the files will be decrypted or that the attacker will not demand more money. Additionally, ransomware can also include tactics to increase pressure on victims, such as threatening to publish the encrypted data or incrementally deleting files until the ransom is paid.

In most cases, it is best to contact your country’s federal cybercrime division or police department to assist with any ongoing investigations. In some cases, they have dedicated teams to help with ransomware data recovery and available ransomware recovery processes.

The Evolution of Ransomware

Response Strategies for a Ransomware Attack

When it comes to ransomware attacks, as with so many other business risks, planning ahead is vital. If you have a well thought out and practised Incident Response Plan, you’ll be more prepared and will respond to the attack in a more effective way if you implement the proper email security technology approach.

This can drastically improve ransomware data recovery time and reduce the risk of the ransomware spreading.

Record Important Details: Note down all known locations that have been encrypted along with the encryption extension. The ransom note or software can help identify the type of ransomware and in some cases, certain ransom keys have been broken or otherwise leaked online. This can greatly assist with ransomware data recovery.

Turn off the Infected Device: Ensure that the infected machine is disconnected from the network and shut down after you have recorded details. Removing the machine from the network is crucial to prevent the spread of infection or encryption.

Disconnect your Other Devices: Check your network to ensure that no other devices have been encrypted or infected. If any are identified, immediately disconnect them from the network.

Change Important Passwords: Ransomware can be known to locate and extract passwords stored on devices or in files. It’s very difficult to determine the scope of the attack so as a general recommendation all important passwords should be changed from a clean machine.

How Do You Report a Ransomware Attack?

It’s crucial to record all details about the attack, as they can be helpful for any professional assistance, insurance claims, legal claims, ransomware data recovery or informing authorities. Remember, paying the ransom does not guarantee the return of your data and may encourage further criminal activity. It’s best to consult with professionals and follow the reporting procedures outlined by your company and law enforcement agencies. This is because, in our ransomware surveys, we found that more than half of the business owners are concerned about the security of their critical data.

Ransomware Attack Survey 2023

Techniques for Restoring Files After a Ransomware Attack

Several techniques can be leveraged for ransomware data recovery. Although we want to focus on proactive preventative measures, the steps below should be considered when looking to recover from an attack.

Implement an Incident Response Plan: As already mentioned, an effective response plan can be critical to ensuring that the blast radius of a ransomware attack is reduced, and the correct steps are followed to improve your chance of ransomware data recovery. The plan should include items such as: information collection, logging, communication internally/externally, legal requirements, investigation procedures, remediation steps and post-attack review.

Decryption Tools: Some ransomware encryption can be decrypted. This is why recording the ransomware information can be crucial. It’s best to reach out to a professional recovery team to help identify if your data can be decrypted without restoring from backup.

Restore from Backup: This can generally be the primary method of recovering files from ransomware. However, you must have good backup procedures in place before you need them. It is common for backups to become encrypted during a ransomware attack, therefore you need to ensure that your backup systems are isolated from production systems. If your backup storage is in the cloud, consider implementing immutable storage, which can’t be altered or deleted by anyone, including your own administrators. Regularly testing individual file, folder, Virtual Machine and system recovery is also important, as this will greatly assist in a crisis when the pressure is on to bring the business back to a working state quickly.

To properly protect your email technology environment from a potential ransomware attack, use Hornetsecurity’s hybrid approach email services such as:

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

Conclusion

The short answer to our question of “if ransomware data recovery is impossible” is no. There are a growing number of variants that can have their decryption keys applied but also good backup practices are the key to ensuring your data and business are protected.

FAQ

Is it possible to recover files from ransomware?

Yes, in most cases ransomware data recovery can be achieved if you have adequate backup systems in place, this isn’t usually a difficult task. If you do not have backups, then in some cases you can decrypt the data if the ransomware has been cracked by online communities.

What percentage of ransomware victims get their data back?

Excluding the victims who were able to restore their data from backup, according to a 2024 report from Sophos, approximately only 8% of victims who paid the ransom regained access to their data. This reinforces that paying for ransomware is usually not a good solution.

Is ransomware difficult to remove?

Typically, removing the ransomware software itself can be achieved by most Antivirus software but the decryption of data is where it becomes more difficult.

How long does it take to recover from ransomware?

This depends on a few factors. Do you have backups in place? Are they relevant and not encrypted? If you don’t have backups, are there decryption keys available for the variant?

In most cases, decryption takes as long as encrypting. Backup systems can take some time to restore depending on the amount of data encrypted but as a safe estimate allow at least 2-3 days of business downtime to recover. To sufficiently recover from ransomware proactive measures need to be in place.

HIPAA Compliance Training: Empowering Healthcare Staff with Cybersecurity Awareness

HIPAA Compliance Training: Empowering Healthcare Staff with Cybersecurity Awareness

by | Jul 3, 2024 | Compliance, Email Security

Addressing the human factor in healthcare cybersecurity, this post explores the importance of ongoing training and education for healthcare personnel to mitigate risks and uphold HIPAA compliance standards. It aims to spark thoughts on ways to improve the effectiveness of current procedures, create new ones, and protect your patients’ privacy.

The Weak Link in HIPAA Compliance: Humans

The technology world has no shortage of vendors and experts that work tirelessly to strengthen compliance in processes and products. Hornetsecurity’s 365 Permissions Manager product serves as a powerful example. However, we must always remember one standout word in the HIPAA acronym: “Accountability”. This applies to people, not technology.

Technological HIPAA solutions can work wonders for the “Portability” bit of the acronym. They also facilitate the vital “privacy” component of the law. Software can prevent unauthorized users from viewing sensitive information. A program can require all its communications to use encrypted channels. Unfortunately, nothing can prevent all accidental, negligent, or malicious activity.

The previous paragraph deliberately sorted “malicious” after “accidental” and “negligent”. Attackers draw everyone’s attention with mass havoc, but smaller HIPAA leaks with no ill intent occur almost constantly. As a patient leaves the building, a receptionist may exclaim, “I hope that rash clears up quickly, Susan!” loudly enough for everyone in the waiting room to hear. A provider might leave their appointment calendar open on a screen within a patient’s line of sight. A harried office worker might place a printed document with protected information where anyone standing at the front desk can view it. A group of doctors might discuss an interesting patient case using the patient’s name – in a crowded restaurant. You have no doubt witnessed multiple HIPAA violations that went unnoticed and unaddressed.

Technology will never stop those small leaks. It also can’t help when someone triggers HIPAA’s “Accountability” provisions. To ward that off, healthcare organizations must focus on staff training.

Why HIPAA Violations Occur So Frequently

Starting from the position that, “We need to protect patients’ personal and health information,” HIPAA-compliant behavior seems self-explanatory. That position leads to poor, ineffective training. You can tell people not to violate HIPAA, and they will happily agree not to do it, and then they will blithely do it anyway. If you start from a position of understanding why that happens, you will have an easier time reaching your staff.

Your People Mean Well

Many HIPAA violations happen simply because people don’t associate their actions with privacy breaches. People are helpful and trusting. It seems logical to expect that the average person that chose a career in healthcare has an even more helpful and trusting personality than the average person in another line of work. They know their patients and feel comfortable with them; why would they worry about that open file? A good provider would never dream of exploiting personal health information for their own gain; why would they suspect any regular person of it? To get the best help for a patient, a doctor might need the counsel of other doctors; why would anyone eavesdrop? The office won’t flow well if nurses don’t deliver information as quickly as possible; who would ever take advantage of an uncovered paper document? The idea of attackers as shady looking characters has pervaded the public consciousness to the point that few of us see threats in people that look “normal”. That’s especially true when those people are also our customers and patients.

Your People Have a LOT to Do

We must also remember that healthcare workers are busy people. Regulations and training place an additional burden on them. No one wants to take the extra moment to cover or uncover a document when they have dozens or more to handle along with all their other high priority duties. Insisting otherwise or trying to shame people into changing their behavior doesn’t help.

HIPAA Compliance Sounds Complicated

The overwork problem goes beyond daily activity. Healthcare workers also deal with substantial requirements for periodic credential renewals. Adding in HIPAA training can feel like another time-consuming annoyance of buzzword-filled box-checking busywork. Acronyms and the word “compliance” only make it all worse.

Viewers and readers struggle to absorb material that does not capture interest, content that does not make things easier, and activities that they do not feel use their time in a valuable way. HIPAA training that does not take this into account will have little effect on preventing breaches.

Account for Human Nature in Training Material

You cannot build an effective HIPAA training program that does not take these factors into account. Acknowledge that people frequently do not understand that a particular action qualifies as a HIPAA violation. Realize that the attitude of “I’m too busy, it will be OK just this once,” infects everyone.

Ways to Improve HIPAA Training Effectiveness

Fundamentally, you can make the most improvements to training procedures by understanding the barriers to learning. The preceding sections looked at those, and you likely have ideas of your own. Next, you must face the challenge of implementation. The following subsections outline a few suggestions to augment your plans.

Keep It Short and Simple

I believe that “Keep It Short and Simple” has become the modern, inoffensive expansion of the age-old “KISS” principle. Whatever words you prefer, the basic meaning holds. You know that people don’t want to sit in training. You know that they don’t like acronyms and buzzwords. Prepare accordingly. Avoid long-winded explanations. Don’t show blocks of legal text.

You might develop some sort of short saying, such as “Protect Patient Data the Way You Protect Patient Lives.” Of course, people often react to pithy mantras with eye rolls and exasperated sighs, but they still remember them. If the knowledge sticks, the training worked.

Instead of trying to “teach HIPAA compliance”, envision what you want people to understand and embody, and explain that. A few examples (some restatements of the same ideas):

  • No one other than the patient and their care team should know anything about the patient
  • The patient’s business is nobody else’s business
  • No release form, no information
  • What happens in the exam room stays in the exam room
  • The bad guys are always listening

Remember to address this topic from the angle that healthcare workers want to help.

Connect Arcane Data to Relatable Points

Healthcare workers work in healthcare, not the law. Don’t dazzle them with legalese. They do need to know the basics of what HIPAA means. They must also understand common acronyms, like PHI (personal health information). When you introduce such terms, immediately link them to something that anyone can understand.

  • For HIPAA, you might include a statement along the lines of, “if we lose control of patient information, we lose patient trust”.
  • With PHI, you can include something like, “Jill does not want everyone in town knowing that she was treated for hemorrhoids”.

While you have a legal obligation to obey HIPAA, it happens to align with most people’s morality about private information.

Give It Entertainment Value

Corporate and professional training does not need to follow sterilized tradition. Elements that perk up the presentation help to grab and maintain interest. You don’t need Hollywood-grade production value to make an impact.

However, if you have access to product design resources, use them. You might have talented individuals in your marketing department that can help. Numerous online and college courses exist to help with modern business communication. You can use these tools for much more than a HIPAA class.

Two things help: humor and shock. Both require awareness and finesse (drab corporate presentations arose from failure to employ these intelligently and respectfully). Humor can involve a mascot figure delivering your sayings. Shock can come from examples of HIPAA fines and violations. Since not everyone understands that a seemingly innocuous activity could lead to a breach, you should have little trouble finding ample material. Again, lean on internal and external resources with experience for help.

Reinforce Training with Reminders

Your technological toolbelt contains more than prepackaged, purpose-built applications. You likely have control over the lock screens and screensavers of office systems. You might also have overhead monitors for information presentation. Use these to rotate in HIPAA reminders. A few examples:

  • The first rule of PHI is that we do not talk about PHI.
  • Your patient can’t see this, can they?
  • Has anyone other than you seen your calendar?
  • Did you remember to turn that document face down?
  • Who overhead that diagnosis?

Many offices have routine internal communications, such as newsletters. Use all delivery methods at your disposal to disseminate small reminders.

Foster a HIPAA-Compliant Culture

Because compliance depends so greatly on moment-to-moment behavior, it may require a shift in “normal” behavior. Changing that requires more than an hour in a training room. Small, frequent, pervasive reminders help. Recruiting informal “HIPAA Ambassadors” to model behavior works in some environments. Periodic recognition for activities such as avoiding or correcting HIPAA violations create positive incentive. Avoid responses that shame as they typically cause more resentment and rebellion than positive change.

You can leverage the “Accountability” component with most people. Legally, it primarily means that violations can result in fines. However, the word also means that healthcare workers have a duty to patients to keep personal health information private. This gives a “shared and individual responsibility” aspect that resonates with most people.

Don’t Forget Those Bad Guys

Throughout all your HIPAA training and culture modification efforts, remember that the “bad guys” are real. If patient information wasn’t valuable, no one would be trying to steal it. You want staff to remember that they can’t recognize an information thief through everyday interactions. This hearkens back to things already discussed, such as reminders of, “No release form, no information.” The knowledge that someone out there might have nefarious reasons to ask too many questions or listen a bit too closely can put enough of an edge on those reminders to help staff retain them.

Therefore, it’s time to take it seriously, as your organization could face a situation similar to that of Change Healthcare.

Like humor and shock, this topic needs mindful presentation. You do not want to build an environment of constant fear and mutual distrust. Most people in a healthcare setting want to help others get better or receive treatment.

What the Change Healthcare Cyber Attack Means for the US Healthcare Industry 2

Shake It Up

As the proverb goes: “Familiarity breeds contempt.” Repeatedly presenting the same material, no matter how well made, will eventually cause staff to stop taking it seriously. Don’t create a bit of material and consider the task finished. Start with something simple. Refine it continually. Reword phrases. Replace sayings for a time and reintroduce them later.

If you can build a solid HIPAA-compliant culture, this becomes somewhat less important. People will always need reminders and refreshers, of course.

Keep Sight of the Goal

While we all wish for a single, magical HIPAA training course that we can deliver once to everyone and they retain forever, that will not happen. Accept that you will need to create and maintain material that keeps up with people in a way that they can understand.

Most importantly, remember that effective HIPAA training depends on simple and relatable presentation. Appeal to what your healthcare employees do best: care for the patient.

How 365 Permission Manager Can Help Streamline Compliance

365 Permission Manager is a powerful tool that can streamline HIPAA compliance and make it easier for healthcare organizations to manage permissions and protect patient data. It offers automated permission management with simplified access control, ensuring only authorized personnel can view patient data, thereby reducing the risk of unauthorized access. Furthermore, regular audits keep permissions updated for ongoing HIPAA compliance. 365 Permission Manager’s intuitive dashboard makes it easy for staff to manage access levels, while real-time alerts notify administrators of unusual access attempts.

Enhanced security features protect patient data, preventing data breaches and ensuring confidentiality, in line with the principle, “Protect Patient Data the Way You Protect Patient Lives.”

To ensure HIPAA compliance and safeguard your healthcare environment, utilize Hornetsecurity’s Security Awareness Service to educate your employees on securing critical data. Additionally, the 365 Permission Manager is a powerful tool that streamlines HIPAA compliance, making it easier for healthcare organizations to manage permissions and protect patient data.

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

FAQ

Why is HIPAA compliance important for healthcare staff?

HIPAA compliance is crucial to protect patients’ personal health information (PHI) from unauthorized access, ensuring privacy and trust. Violations can lead to severe legal penalties and damage to the organization’s reputation.

How can healthcare staff prevent accidental HIPAA violations?

Healthcare staff can prevent accidental HIPAA violations by receiving regular training, being aware of their surroundings, covering documents containing PHI, and ensuring conversations about patients are private.

What role does Hornetsecurity play in enhancing HIPAA compliance?

Hornetsecurity offers solutions like 365 Permissions Manager, which help manage and secure email communications, ensuring that unauthorized users cannot access sensitive information, thereby supporting HIPAA compliance.

Understanding Email Security Technologies and the Power of Hornetsecurity’s Hybrid Approach

Understanding Email Security Technologies and the Power of Hornetsecurity’s Hybrid Approach

by | Jun 11, 2024 | Email Security

Email delivered threats such as phishing, malware attachments and Business Email Compromise (BEC) are still the number one favorite attack vector for cyber criminals. And they’re not letting up, with new flavors of attacks being tested every day. It just takes one legitimate looking email to sneak through into a user’s mailbox, and an unsuspecting user to click a link or open an attachment to open a door into your business for the bad guys.

In this article we’ll explain and provide a comparative analysis of the two main approaches to email security. We’ll then look at a few fictitious companies that suit one approach over the other and finally demonstrate how a hybrid approach, such as the one deployed by Hornetsecurity 365 Total Protection, offers the best of both worlds.

What are the Most Common Approaches to Email Security?

Email security isn’t a new problem. Even a decade ago when most businesses were still running their own email servers, they either had to install software on their edge servers to filter out the dross or subscribe to a hosted service to filter the incoming email feed before it reached said servers.

Today most organizations rely on hosted email, with Microsoft 365 and Google Workspaces being the most popular options. This provides the foundation for the two different approaches: Secure Email Gateway is the single point cloud service where all the incoming emails to your organization are filtered, and clean emails are delivered to your mailboxes.

The other approach is using Application Programming Interfaces (APIs) in the email cloud service to detect and respond to email threats, often called Integrated Cloud Email Security (a term coined by Gartner in 2021). This isn’t an either / or proposition either, you can combine both techniques, something called Hybrid Cloud Email Security.

Secure Email Gateway

This is the older of these two methods, having its roots in the appliances or hosted services that businesses used a decade or two ago. They filter incoming and (often) outgoing emails, removing spam, malware, and other threats, sometimes also providing data loss prevention by identifying sensitive data in outgoing emails. They can also encrypt outgoing emails with standard TLS (formerly SSL) encryption, as well as other approaches such as DNS-based Authentication of Named Entities (DANE), Mail Transfer Agent-Strict Transport Security (MTA-STS) and venerable encryption protocols such as S/MIME and PGP.

email filtering

Secure Email Gateway

An in-depth exploration of DANE and MTA-STS are beyond the scope of this article but suffice to say that they make sure that traffic between mail servers on the internet are always protected with TLS encryption, and not susceptible to attackers changing IP addresses in the DNS infrastructure.

Not all Secure Email Gateway servers are created equally, and their defense mechanisms vary. Often, they apply advanced threat protection features such as opening attachments in sandbox environments to identify signs of malicious activity or use Machine Learning (ML) to identify potentially misleading or dangerous language in the text of a phishing email.

Once an email has been deemed safe and delivered to user’s inboxes, these gateways have no way to remediate threats if it’s later discovered that the message was malicious.

A big benefit of Secure Email Gateways is that all external email pass through them (if used for outgoing filtering as well), enabling easy archiving and journaling opportunities, to fulfil compliance regulatory requirements, as well as enabling e-discovery. These gateways also employ current technologies for identifying spam, phishing and spoofing and protecting organizations email reputation such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC).

They can also apply corporate template signatures to all outgoing emails, and because they’re a separate service they can provide continuity if Exchange Online or Google Workspaces is having an outage, providing webmail access, and queuing of emails until service is resumed. Depending on the service, there may limited integration with other security tools and services – if for example a user’s workstation becomes infected with malware, it’d be nice to easily know if they received any suspicious emails in the last few hours.

Finally, as a central service, they can provide excellent reporting and statistics on traffic volumes, threats detected, and actions taken.

They require some setup, and they’re not easy to “try out” in a proof of concept, because you must redirect your organization’s email domains (company.com) to the Secure Email Gateway service by changing the Mail eXchanger (MX) DNS entry. This will tell every email server on the planet where to send any emails for your domain, so you can’t do a test setup with just a few users for example.

Integrated Cloud Email Security via an API

The rise of large scale, cloud hosted email services such as Microsoft 365 and Google Workspaces have also spawned new integration points that weren’t available in the old on-premises world. The lifeblood of cloud services are APIs and the ease with which they facilitate integration between different services, and email is no exception.

These cloud services can easily integrate AI and ML for threat detection into user’s mailboxes (temporarily blocking access to delivered emails until scanning is complete), and unlike a gateway, they have continuous access to the entire platform, so that if an email is later identified as malicious, they can reach into mailboxes and delete or quarantine them “after the fact”.

Their ability to provide archiving is controlled by the APIs that the cloud provider offers, in fact, all their flexibility is entirely dependent on what the provider chooses to expose. They generally offer email authentication standards configuration (SPF, DKIM, DMARC) but this again depends on the underlying APIs.

Because they’re dependent on the cloud platform, they can only offer limited support for continuity in the case of an outage, and they don’t manage email encryption with PGP or S/MIME. Integrated Cloud Email Security services also don’t manage routing of emails, instead relying on the cloud platform for handling this. Reporting is likewise dependent on the APIs offered, but integration with other security tools is often excellent (as long as those tools are also cloud services). Being integrated “into the mailbox itself” means they can provide excellent data loss prevention services. If you have a large tenant, your provider must take into account API throttling limits as you can’t overwhelm the capacity of the platform with too many simultaneous requests.

Their real strength shines when it comes to setup – because no infrastructure or MX records need to change, they often only take a few minutes to deploy, and they can be scoped to a set of test users easily.

API - Approach default - (most common)

API – Approach default – (most common)

API - Approach - (safe mode)

API – Approach – (safe mode)

Hybrid Cloud Email Security – The best of both

In many scenarios, a combination of these technologies, like the hybrid model developed by Hornetsecurity, provides the best protection against email borne threats. The Secure Email Gateway will block most low-level threats, whereas the Integrated Cloud Email Security can deeply analyze the text of emails and attachments, using advanced AI and ML models to identify risks. Deployment is seamless, with easy integration into Microsoft 365 and Google Workspaces.

And the strength of each gives a better experience overall, if an email isn’t identified as malicious initially, but then received by other users later and this time blocked / quarantined (perhaps due to updated signatures), the gateway can tell the integrated service to delete the already delivered emails straight away.

During outages you get the benefits of continuing email access, reporting is even more comprehensive as not only incoming and outgoing emails are included, but also internal emails between employees which do not pass through the Secure Email Gateway. Data loss prevention is more comprehensive, with deep analysis of emails by the Integrated Cloud Email Security service, and the option to instruct the gateway to encrypt particularly sensitive emails based on the results.

Finally, because of the API driven nature of the Integrated Cloud Email Security they can extend beyond emails and mailboxes, such as managing permissions for attachments saved to OneDrive for Business from Outlook for example.

Hybrid (MX+API) - Approach - (safe mode)

Hybrid (MX+API) – Approach – (safe mode)

Hornetsecurity’s hybrid technology enables it to leverage gateway technology to provide solutions such as its Spam & Malware Protection, Signature & Disclaimers, Email Encryption, Archiving, and Continuity Service in addition to featured powered by integrated cloud technology such as Advanced Threat Protection, AI Recipient Validation, and 365 Extended Email Protection.

Use Cases

As always in IT, the right solution depends on the specific needs and existing environment of an organization. We’ll look at four different fictitious companies, and their situation and recommend an email hygiene solution to suit.

GlobalTech Inc. is a large multinational corporation that has diverse email services across different countries, including on-premises, Google Workspace and Microsoft 365. In this mixed, complex environment, a single, cloud based Secure Email Gateway service, integrating the different email domains will provide comprehensive control and reporting.

They’ll need to meet varying regulatory requirements in different regions, so enabling data loss prevention and email encryption through the gateway will be crucial. If there are email system outages, they’ll rely on the gateway’s continuance services to minimize business impact. Depending on IT needs, they may also add Integrated Cloud Email Security to their Microsoft 365 and / or Google Workspace tenants.

GlobalTech email system

GlobalTech email system

FinSecure Corp on the other hand relies on secure email communications with their clients. They’ve used S/MIME for many years to ensure end to end protection and non-repudiation of emails (proving that the sender of an email hasn’t been spoofed) and rely on DANE to mitigate the risk of criminals performing attacker-in-the-middle attacks against their email infrastructure. They will rely on a Secure Email Gateway service to enforce email encryption policies, and to demonstrate compliance with stringent regulations that are common for financial services firms.

FinSecure Corp

FinSecure Corp

Our third example is CloudInnovate, a tech startup in Silicon Valley, relying exclusively on SaaS cloud services for collaboration and email. They’re growing rapidly and require an easy to integrate service for their cloud-first strategy. They’ll use an Integrated Cloud Email Security service for Microsoft 365 for easy scaling and providing advanced AI and ML protection against emerging threats.

TechGen Robotics

CloudInnovate

Finally, TechGen Robotics, a leading robotics research and development company, operates at the forefront of innovation in autonomous systems and AI technologies. They have a lot of sensitive intellectual property, and are financially successful, making them targets for BEC attacks as well as industrial espionage. They’ll use both technologies together to ensure encryption of all sensitive emails (and attached documents), along with deep data loss prevention inspection to protect their IP.

They’ll need the advanced protection in their Integrated Cloud Email Security to identify and stop sophisticated attacks, and use the encryption provided by the gateway to protect communications end-to-end. They need the email continuity provided by the gateway in case of a service provider outage, whilst relying on the advanced protection of the API solution to inspect emails and attachments, including when those are saved in cloud storage.

CloudInnovate

TechGen Robotics

Conclusion

Hornetsecurity’s cutting edge email security solutions relies on providing both a Secure Email Gateway and Integrated Cloud Email Security for complete protection. As you have seen, both approaches have their strengths and weaknesses and by combining them, you truly get the best of both worlds, and the cleanest possible email feed.

365_Total_Protection_1200x628_EN

FAQ

What is the difference between Secure Email Gateway and Integrated Cloud Email Security?

Secure Email Gateway filters incoming/outgoing emails via a cloud service, while Integrated Cloud Email Security uses APIs in email platforms like Microsoft 365 to detect/respond to threats within the platform itself.

Why should I consider a hybrid approach for email security?

A hybrid approach to email security is necessary for certain businesses because relying on just one solution leaves gaps in protection. Secure Email Gateway (SEG) offers robust threat detection and compliance features but lacks continuous scanning and advanced threat protection capabilities. Conversely, Integrated Cloud Email Security (ICES) provides real-time scanning and post-delivery threat remediation but may not offer the same control and compliance as SEG. Additionally, businesses can reduce dependency on a single technology, mitigating the risk of vulnerabilities. A hybrid model also offers scalability and flexibility, allowing businesses to adapt their security measures as they grow and their needs evolve.

How does Hornetsecurity’s hybrid model improve email security?

Hornetsecurity’s hybrid model enhances email security by blocking most threats with a Secure Email Gateway and using Integrated Cloud Email Security for advanced threat detection and response, providing seamless integration and robust protection.

AI in Cybersecurity: How Large Language Models Are Changing the Threat Landscape

AI in Cybersecurity: How Large Language Models Are Changing the Threat Landscape

by | Apr 24, 2024 | Email Security, Security Awareness

Since late 2022, we’ve seen a dramatic rise of Large Language Models (LLMs) based AI in the form of ChatGPT (Generative Pre-trained Transformer) and its cousins. There’s been quite a lot written about how these tools will impact cyber security.

In Hornetsecurity’s 2024 survey, a staggering 45% of business leaders voiced concerns about AI exacerbating the threat landscape. This alarming trend mirrors the global rise of AI-driven malicious activities, with threat actors leveraging automation and sophistication to orchestrate attacks.

The UK’s National Cyber Security Centre (NCSC) has also noted a troubling consequence: AI is democratizing cybercrime, enabling even novice criminals to engage in sophisticated attacks previously reserved for seasoned adversaries.

It is difficult to ascertain with a high degree of certainty if malicious emails were created or enhanced by LLMs, primarily because if they’re good, they’ll look indistinguishable from a well (hand) crafted phishing email.

However, these are the areas where we know that LLMs are having an impact on cyber security:

Code quality: GitHub Copilot (and other similar tools) is showing some quite astonishing improvements in productivity for developers, both beginners and seasoned hands. While there are safeguards in place to stop these tools developing obvious malware they can be circumvented, so it’s very likely that malware developers are using these tools to crank out more malicious code faster.

Sophisticated phishing: Drafting and enhancing phishing and especially spear phishing emails. We have an example of one of these below, but it’s probable that criminals are using these tools to fine tune their wording to achieve maximum results. Again, various LLMs have safeguards in place to stop these sorts of malicious uses, but they can often be bypassed. There are also GPT tools that lack these safeguards, such as WormGPT and others. Hornetsecurity’s 2024 survey revealed that 3 in 5 businesses describe AI-enhanced phishing attacks as their top concern.

Translating attacks into other languages: Many Phishing and Business Email Compromise (BEC) defenses are tuned for English, having less success stopping attacks in other languages. There are also geographies around the world where phishing and BEC attacks have been uncommon up until now, making the average finance department worker less suspicious (Japan, other countries in East Asia, and Latin America comes to mind). Here, we’re likely to see a surge in attacks based on the ability to translate emails into near perfect prose, by attackers who aren’t fluent in the language, expanding their potential target pool manyfold.

Targeted research: To pull off a successful spear-phishing attack, or social engineering phone call attack on helpdesk staff, requires detailed understanding of a company, individuals that they’re impersonating and their relationship to others in the hierarchy. Traditionally this is often done through LinkedIn, company websites research and the like, but with the advent of LLM based search engines, this is changing. As you’ll see in our example below, AIs can help immensely with this task, and shorten the time investment required.

To demonstrate how easy it is to generate a phishing email through an LLM we decided to create our own. The following is an attack on Andy Syrewicze, a Technical Evangelist here at Hornetsecurity. Here is the initial research prompt and output:

The following is an attack on Andy Syrewicze, a Technical Evangelist here at Hornetsecurity

As you can see, a simple prompt provides a detailed breakdown of a social engineering strategy to target Andy drawing on his professional and personal online footprint. Something that would take far longer to achieve manually.

This is then followed up with a very convincing draft of a spear-phishing email for Andy.

This is then followed up with a very convincing draft of a spear-phishing email for Andy

The email generated here is of a much higher quality than the average phishing email and far more likely to succeed. The personalization of the references and context demonstrates how effective AI tools such as LLMs can be in crafting targeted spear-phishing attacks.

Why We Fall for Scams

A thorough investigation of social engineering and hacking human psychology is a topic for an entire book on its own, here we’ll just focus on the highlights to bring an understanding of the basic characteristics that make us so susceptible.

A well-crafted phishing email has the following characteristics:

  • It’ll blend in and be part of the normal communication flow. We’re used to receiving emails about a parcel delivery, or a notification from our bank, or a reminder from our boss, so a fake email with the same characteristics is less likely to raise our suspicions. It has the right logos, structure, format, and it looks like the expected sender so we’re more likely to take the requested action.
  • It’ll appeal to our emotions. The most important part of any social engineering endeavor is to bypass the cold, logical thinking part of our mind (Cerebrum), and activate the emotions and the “fight or flight” center (Amygdala) so that we take actions we wouldn’t normally contemplate. Some approaches will appeal to greed / reward (“click here for free tickets”), some to shame / embarrassment (“I’ve got video recordings of what you did last night”), or fear / dread (“I need you to transfer this amount now or you’ll be fired”). The most common appeal is urgency; when something needs to be done “right now”, we tend to skip past our normal, suspicious questions and just get it done, often to avoid feeling the uncomfortable emotions mentioned any longer.
  • It’ll have a requested action that’s not too unusual. Examples include providing personal details to your “bank”, something we remember having to do when opening an account in a new bank or resetting our network password by clicking a link and being presented with a normal looking sign-in page.

The whole effect of an effective phishing lure is short-circuiting our questioning rational mind by invoking emotions and urgency and providing an easy way to “fix the issue” quickly.

This leads us neatly to the next step – the importance of security awareness training for all your users.

User Training is Crucial

This cannot be understated; you cannot build a cyber-resilient organization without involving every single person who works there. This starts with the basic awareness of asking someone unknown who isn’t wearing a badge in the office to identify themselves, and if the answer doesn’t stack up, calling security.

When someone calls you claiming to be from the IT helpdesk and asks you to approve the MFA prompt you’re about to receive on your phone, don’t assume they’re telling the truth. Always double-check their credentials first to ensure that it’s a legitimate request.

What you’re trying to foster is “polite paranoia”, making it normal to question unusual requests, and understanding the risk landscape and sharpening instincts. Most people who work in businesses aren’t cyber or IT savvy and weren’t hired for those skills. However, everyone needs to have a basic understanding of how identity theft works in our modern digital world, both in their personal and professional lives.

They also need to have a grasp of the business risks introduced by digital processes, including emails.

By having this context they’ll be able to understand when things are out of context or unusual and have enough suspicion to ask a question or two before clicking the link, wiring the funds, or approving the MFA prompt.

And this isn’t a once-off tick on a form to achieve compliance with a regulation.

Often, the long, tedious, and mandatory presentations that organizations conduct once a year or quarterly, followed by multiple-choice quizzes, are perceived as time-wasters by the staff. They want to rush through them quickly and typically forget any insights gained.

Instead, the training program should be designed to be ongoing, consisting of bite-sized, interesting, immediately applicable, and fun training modules combined with simulated phishing attacks to test users. If any user clicks on a phishing email, they should be given additional training.

Over time, the system should automatically identify users who rarely fall for such attacks and interrupt them with infrequent training, while the persistent offenders are given additional training and simulations on a regular basis.

The other reason for ongoing training is that the risk landscape is continuously changing. Some months ago, malicious emails with QR (Quick Response) codes to scan were the exception, now they’re a very familiar sight, requiring ongoing awareness of staff not to scan them on their phones (outside of established business processes).

Security experts often lament the priorities of staff, saying, “if they only took a second to read the email properly, they’d spot the signs that it’s phishing”, or “they just don’t take security seriously”.

This is a fundamental misunderstanding of the priorities and psychology of the average office worker, clicking a link in an email will at most get you a slap on the wrist, not fulfilling an urgent request by the boss can get you in serious trouble or even fired.

And this is why the entire leadership, from middle managers all the way to the C-suite must lead by example. If they do and communicate their understanding of the basics and secure processes, staff will follow suit.

But if the CFO requests an exemption from MFA or bypasses security controls regularly because “it’s more efficient”, there’s no chance that his underlings will take cyber security seriously.

A Day in the Life at Cyber Resilient Inc.

What does it look like at an organization that has embraced this approach? First of all, no one fears speaking up or asking “silly questions” about weird emails or strange phone calls. If there is an incident and someone clicks something they shouldn’t have, there’s no blaming and accusations, it’s not personal, there was a failure of a process.

This brings a strong sense of psychological safety, an important foundation for cyber resiliency.

Transparency is promoted from the leadership all the way throughout the organization. Understanding that we’re all human, we’re “all in this together” and being upfront about making mistakes, without fear of retribution, will improve the cyber resiliency culture.

Talking about new cyber risks and exploring not just business risks but also the risks in people’s personal lives is another strong result of a good security culture.

Our working and personal lives are blended like never before, with people sending and receiving emails from their personal devices, sometimes even working from their personal laptops (BYOD), which means that the risks to the business aren’t confined to corporate assets and networks.

Compromises of users’ personal identities can be used by criminals to then pivot to compromise business identities and systems.

Looking at it in the mirror – in an organization where cyber resiliency isn’t valued, staff will be fearful of making mistakes and be unsure what processes to follow if they think they might have made one. Individuals are blamed when incidents do occur, ensuring that any future issues are swept under the rug to avoid the same fate.

And staff don’t understand IT, they don’t understand the risk landscape and they routinely put the organization at risk because of this lack of understanding.

Implementing Security Awareness Service

As mentioned, it’s important that security awareness training is incorporated into the work life of your users, it can’t be something that’s done once every six or twelve months. Hornetsecurity’s Security Awareness Service was designed with exactly this in mind, providing short video trainings, coupled with spear phishing simulations.

But overworked IT teams also don’t want to spend a lot of time on scheduling training and simulations, so it incorporates the Employee Security Index (ESI) which measures each user’s (and group, department) likelihood to fall for targeted, simulated, attacks.

This is mostly hands-off for the administrators, so the users who need extra training and tests receive it, whereas staff with already sharp instincts are tested less frequently. You can also track ESI over time and see the forecast for it.

Employee Security Index dashboard

Employee Security Index dashboard

There’s also a gamification aspect where users can compare themselves to others, which creates a strong incentive to be more cautious and sharpen instincts. The training material is available in multiple languages.

Another benefit of the Security Awareness Service is the statistics, it gives the security teams and business leaders data to understand the current risk profile of their staff, and where boosts of extra training might need to be deployed.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection and Advanced Threat Protection strategies.

Discover the latest in cybersecurity: How to Spot a Phishing Email in The Age of AI. Learn how AI fuels sophisticated phishing attacks and gain actionable insights to protect your business.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

Everyone in business today is somewhat aware of the risks of cyber-attacks, phishing messages, and identity theft. It’s essential for businesses to recognize that cybersecurity threats are constantly evolving, especially in the age of AI.

Threat actors are leveraging AI tools to create sophisticated phishing attacks that can lead employees to click on malicious links or disclose sensitive information. The phishing samples we’ve shared should serve as a good source for communicating the signs of scam emails to your staff.

FAQ

How are Large Language Models (LLMs) impacting cybersecurity?

LLMs, such as ChatGPT, have significantly altered the threat landscape by enabling automation and sophistication in malicious activities. They’ve democratized cybercrime, allowing even novice criminals to conduct sophisticated attacks. Specifically, LLMs are enhancing code quality, refining phishing emails, translating attacks into multiple languages, and facilitating targeted research for social engineering attacks.

What characteristics make phishing emails successful?

Successful phishing emails blend seamlessly into normal communication flows, evoke emotions such as greed, shame, or fear, and prompt urgent actions. They mimic the appearance of legitimate messages, utilize familiar logos and formats, and contain requests that seem plausible, like providing personal details or clicking on links.

How can organizations improve their cyber resilience?

Organizations can enhance cyber resilience through comprehensive user training, which fosters a culture of “polite paranoia” and encourages questioning unusual requests. Continuous, engaging, and practical training modules combined with simulated phishing attacks help users recognize and respond to threats effectively. Leadership plays a crucial role in setting the tone for security awareness and adherence to secure processes throughout the organization.