Work Traveling - You’re a Prime Hacker Target

As if the stresses and headaches of business travel weren’t enough, there’s one more thing to worry about while traveling in unfamiliar places: the security of your email. 

Thanks to the rapid ascent of spy-mail, email that secretly reveals a recipient’s location and behavior when it is opened, criminals can invade an out-of-office executive’s inbox to steal confidential information.

According to an FBI public service announcement issued in June, there has been a 1,300% increase in losses tied to “business email compromise” since January 2015. Although any company is at risk, these attacks are most likely to target firms that regularly send money overseas or those that have access to sensitive information, such as medical companies, attorneys, and accountants. To date, instances have been reported in all 50 US states and in 100 countries, amounting to a financial impact of $3 billion.

For the most part, these successful attacks are not the result of Cyber criminals blanketing companies with malware-laden links or attachments and hoping for a click (as was often the case in the past). Instead, infiltrating a corporate network and siphoning off sensitive data is about meticulously gathering information over an extended period, and then using that information to launch a precision strike targeted at one or two employees. One way this information is being gathered is via spy-mail, a regular email with a hidden tracking code.

Here’s how it works. Each time a traveling executive opens spy-mail, they reveal a wealth of private information, their current location, the time of day they read their email, the hotel at which they are staying. Scammers can use this information to craft believable phishing emails or phone calls, targeting the executive or their unsuspecting colleagues back at the home office. 

Because spy-mail looks like any other email, the receiver is unable to determine which emails are tracked with the invisible extension, making cybersecurity on the road much more difficult to manage.

Say, for instance, an executive opens a spy-mail while meeting with a supplier in a politically, economically, or socially unstable country. Knowing that the business leader is in a volatile part of the world, malicious third parties can formulate an attack by harnessing the fear and uncertainty that accompanies such travel. 

The attack may include, for example, spoofed emails from the executive abroad, saying that they are in a dangerous situation (e.g., there has been a terror attack, they have been kidnapped, etc.) and need money. In an extreme case, information gathered through spy-mail can be used to plan an actual kidnapping. According to one report, there are 40,000 kidnap-and-ransom cases each year, many of which involve executives on business travel.

Malicious actors also use the fact that an executive is out of the office to dupe their person’s coworkers into sending corporate files or other sensitive data. Earlier this year, companies including Advanced Auto Parts and Snapchat fell victim to fraudsters posing as company leaders, who pilfered employee W-2s and used them to file fraudulent tax returns. Information captured by spy-mail can help hackers can send believable emails, with the correct sender, recipient, context, and time-stamp, to an executive’s HR department or payroll vendor, asking for confidential records at a time when they know the executive won’t be around to detect it.

How can companies avoid an email-borne crisis? No corporate cybersecurity strategy is complete without a plan for safeguarding the organisation’s data when business leaders are away. And simply banning executives from checking email when traveling, even if it isn’t a work-related trip, is not a realistic solution. As the email threat landscape evolves, organisations must adapt their defenses accordingly. 

Here’s how:

Train for awareness. Employees can’t guard against Cyberattacks if they are ignorant of the threats that surround them. Offering periodic, engaging training that defines spy-mail and phishing from an end-user perspective, and that illustrates the ramifications of each, is a necessary step toward making employees more vigilant. According to PWC and KPMG, only 53% of companies have employee security-awareness and training programs, and only 50% of CEOs feel prepared for a cyberattack.

Establish executive travel email protocol. No IT manager will successfully unchain the C-suite from their inboxes, even when on vacation. Organizations should, however, implement policy controls to identify and mitigate the risk of spy-mail and phishing attempts while executives are on the road. For example, finance departments should outline a protocol that executives must follow in the event that they need to request money while traveling. When a request comes through that doesn’t adhere to the set protocol, the scam is less likely to succeed.

Add an extra layer of inbox security. When traveling, business leaders need to be focused on the task at hand, not on safety and Cybersecurity issues. Adding spy-mail protections to conventional spam filters and firewalls can help safeguard company data and give traveling executives peace of mind.

As companies are learning the hard way, email scams are a growing problem, resembling bank heists in the amount and sophistication of the intelligence gathering that goes into them. 

Knowing when and where executives are traveling and emailing is a necessary piece of information for many of these attacks. By training employees, putting appropriate travel policies in place, and adopting the latest security software, companies can reduce the risk of falling victim to one of these attacks.

HBR
 

 

« DDoS: Deceptive Denial Attacks
2016 Trends in Cyber Crime »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Cortado Mobile Solutions

Cortado Mobile Solutions

Cortado Mobile Solutions is the manufacturer of the mobile device management solution Cortado MDM.

GrammaTech

GrammaTech

GrammaTech is a leading developer of software-assurance tools and advanced cyber-security solutions.

RSA Insurance Group

RSA Insurance Group

RSA is one of the world’s leading multinational quoted insurance groups. Commercial services include cyber risk insurance.

Crossmatch

Crossmatch

Crossmatch is a world leader in risk-based composite authentication and biometric identity management.

Resolver

Resolver

Resolver’s Integrated Risk Management platform helps plan and prepare your organization to limit the likeliness or impact of security risk and compliance events from occurring.

Odyssey

Odyssey

Odyssey is an ISO 27001 certified, Cyber -Security, Infrastructure and Risk Management Solutions integrator and a Managed Security Services Provider.

Cyberarch Consulting

Cyberarch Consulting

Cyberarch is a security-focused consulting firm. We provide services specializing in information security, digital forensics, penetration testing and cyber security training.

M2SYS

M2SYS

M2SYS is a worldwide leader in identification and authentication solutions.

Clone Systems

Clone Systems

Clone Systems is an award winning global cloud based managed security as a service provider.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

riskmethods

riskmethods

riskmethods helps you proactively identify, assess and mitigate supply chain risk. You need to master supply chain risk management—we can help.

Oxford Internet Institute - University of Oxford

Oxford Internet Institute - University of Oxford

The Oxford Internet Institute is a multidisciplinary research and teaching department of the University of Oxford, dedicated to the social science of the Internet.

Truvantis

Truvantis

Truvantis is a cybersecurity consulting organization providing best-in-class cybersecurity services to secure your organization’s infrastructure, data, operations and products.

Glasstrail

Glasstrail

Glasstrail are single-minded about helping organisations gather intelligence and manage vulnerabilities in their attack surface before adversaries exploit them.

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Auto-ISAC provides a forum for companies to analyze and identify threats sooner and share solutions that enhance vehicle cybersecurity.

Alcatel-Lucent Enterprise (ALE)

Alcatel-Lucent Enterprise (ALE)

We are Alcatel-Lucent Enterprise. Our mission is to make everything connect with digital age networking, communications and cloud solutions.