Email Data Breaches: The Threat Keeps Giving

 

By most accounts, 2015 was a year of unprecedented data breaches. Several major government agencies, enterprises and consumer sites were hacked - leaking the personal information of millions onto the web.

But an initial security breach doesn’t end the vulnerability. For example, according to the data cultivated by email security firm MailChannels, spam and phishing emails to addresses stored in the Ashley Madison database - compared with the volume sent to a random sample of addresses - have increased exponentially since the hack.

“The data offers some insights into what consumers can expect: a steadily growing amount of scams and spam - both targeted and general - will hit inboxes in 2016,” according to Ken Simpson, CEO at MailChannels. “Anyone whose email has been exposed is a prime target for cybercriminals looking to profit from extortion, identity theft and data exploitation. The increased volume in email attacks won’t come right away, but evidence from the Ashley Madison data leak shows that the growth in volume of will be sustained throughout 2016; it isn’t going to tail off with time.”

Simpson spoke with Information Management about what he expects organizations will experience on the IT security front in 2016, and how those trends may impact customers.

Information Management: What does your data reveal that CIOs should know in terms of corporate email security issues?
Ken Simpson: CIOs should create a process for retrieving leak data when large leaks happen, because our analysis shows that the very appearance of someone's email address in a leak exposes them to more abuse after the leak occurs. Attackers use leaks to build their database of targets for all sorts of fraud - not just fraud related to the leak itself. For instance, with the Ashley Madison's breach, we saw users receiving regular spam and phishing attacks in addition to targeted attacks such as scams promising to remove users' personal information from the Internet.

Information Management: What types of data are most at risk?
Simpson: It's not so much the types of data that are at risk, it's the potential for social engineering that's the real risk. When an attacker knows something about your user because he or she was included in a breach, they can leverage that information to tailor an attack.

For example, let's say your HR SaaS provider experienced a breach, allowing an attacker to know not only that your employee "Sandra" in marketing makes $55,000/year, but also that she lives in London, England. You can now hit Sandra with a customized email claiming to be someone from the London office who needs some money because their passport was absconded during a trip to Egypt.

Information Management: Are organizations giving IT security enough attention, budget, and staffing?
Simpson: Security is never given enough attention until there is a major problem - this has always been true and probably always will be. Enlightened organizations invest more in security because they know that the cost of doing nothing is to guarantee - at some unknown time in the future - an incident that is very costly.

Ashley Madison's parent company nearly ceased operations after their disastrous breach. Were they doing enough on security? Not for a firm that deals in information that can destroy marriages. And we're only beginning to see the legal fallout that could hobble them for years to come.

Information Management: How does the CIO or the CISO best go about creating a culture of security awareness?
Simpson: I think it pays to keep on top of security events that receive widespread press, and to remind management and staff that they too are vulnerable. Part of the CIO's job is to provide information about the general threat landscape so that the organization starts to take security seriously. The CIO alone can't pull enough budget; but the collective concern of every department will start to make a difference.

Information Management: What do you predict will be the top IT security issues, challenges, and threats in 2016?
Simpson: In 2016, the threat for tailored attacks at the individual level will become commonplace. With this previous year having been one riddled with information breaches, our data shows cybercriminals have an increased repository of personal information pieces that will look to build out into comprehensive profiles that can be used for identity theft, extortion and hacking. The more built out a profile, the more possibilities for illicit activity and cybercriminals will be on the hunt to collect the missing information they need to exploit an individual or business through targeted emails and spam campaigns.

I also believe we'll see more nation state hacking and espionage causing real economic damage. For example, could a powerful Chinese SOE with influence in the Communist Party prod the red army's electronic division into hobbling a major US industrial company for competitive reasons? Say, through a major breach that was made to look like it came from Anonymous? Yes, that could happen in 2016. But this time, the linkage with the nation state will become clear.

Inormation-Management: http://bit.ly/1PrfIjw

« What Does a Cyber Security Strategy Look Like?
Third of UK Finance Logins Risk Client Data »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Sigma Payment Solutions

Sigma Payment Solutions

Sigma Payment Solutions offers a comprehensive suite of automated payment processing services, solutions, and technology to businesses in the USA.

NordForsk

NordForsk

NordForsk facilitates and provides funding for Nordic research cooperation and research infrastructure. Project areas include digitalisation and digital security.

First National Technology Solutions (FNTS)

First National Technology Solutions (FNTS)

First National Technology Solutions is a leading provider of flexible, customized hosted and remote managed services including IT security and compliance.

AlertEnterprise

AlertEnterprise

AlertEnterprise uniquely eliminates silos and uncovers blended threats across IT Security, Physical Access Controls and Industrial Control Systems.

EPIC Insurance Brokers & Consultants

EPIC Insurance Brokers & Consultants

EPIC is an insuarnce broker and consultancy firm. Risk management services include risk consultancy and cybersecurity insurance.

Yellow Brand Protection

Yellow Brand Protection

Yellow Brand Protection operates 24/7 to protect brands' Intellectual Property (IP) from infringements on all kinds of online distribution channels.

Veridium

Veridium

Veridium is a leader in single step - multi factor biometric authentication, designed to safeguard enterprises’ most critical assets.

Guardian Digital

Guardian Digital

Guardian Digital makes email safe for business. Threat-ready business email protection. Fully supported.

Almond

Almond

Almond is positioned as a key independent French player in audit and consulting in the fields of Cybersecurity, Cloud and Infrastructure.

Raiven Capital

Raiven Capital

Raiven Capital is a global early-stage technology venture capital fund. We focus on founder-led, driven companies on the leading edge of disruption.

Zokyo

Zokyo

Zokyo is a venture studio that builds, secures, and funds legendary web3/crypto businesses.

Edgio

Edgio

Edgio provides unmatched speed, security, and simplicity at the edge through globally-scaled media and applications platforms.

Dexian

Dexian

Dexian is a leading provider of staffing, IT, and workforce solutions with nearly 12,000 employees and 70 locations worldwide.

Espria

Espria

Espria is a leading independent managed service provider with expertise in Cloud, IT, Communications and Document Solutions.

Zafran

Zafran

Zafran is a Risk & Mitigation Platform that defuses threat exploitation by mobilizing existing security tools.

Secher Security

Secher Security

Secher Security is a professional and secure partner with a high level of professional expertise in simplifying and optimizing complex IT infrastructures.