Work Traveling - You’re a Prime Hacker Target

As if the stresses and headaches of business travel weren’t enough, there’s one more thing to worry about while traveling in unfamiliar places: the security of your email. 

Thanks to the rapid ascent of spy-mail, email that secretly reveals a recipient’s location and behavior when it is opened, criminals can invade an out-of-office executive’s inbox to steal confidential information.

According to an FBI public service announcement issued in June, there has been a 1,300% increase in losses tied to “business email compromise” since January 2015. Although any company is at risk, these attacks are most likely to target firms that regularly send money overseas or those that have access to sensitive information, such as medical companies, attorneys, and accountants. To date, instances have been reported in all 50 US states and in 100 countries, amounting to a financial impact of $3 billion.

For the most part, these successful attacks are not the result of Cyber criminals blanketing companies with malware-laden links or attachments and hoping for a click (as was often the case in the past). Instead, infiltrating a corporate network and siphoning off sensitive data is about meticulously gathering information over an extended period, and then using that information to launch a precision strike targeted at one or two employees. One way this information is being gathered is via spy-mail, a regular email with a hidden tracking code.

Here’s how it works. Each time a traveling executive opens spy-mail, they reveal a wealth of private information, their current location, the time of day they read their email, the hotel at which they are staying. Scammers can use this information to craft believable phishing emails or phone calls, targeting the executive or their unsuspecting colleagues back at the home office. 

Because spy-mail looks like any other email, the receiver is unable to determine which emails are tracked with the invisible extension, making cybersecurity on the road much more difficult to manage.

Say, for instance, an executive opens a spy-mail while meeting with a supplier in a politically, economically, or socially unstable country. Knowing that the business leader is in a volatile part of the world, malicious third parties can formulate an attack by harnessing the fear and uncertainty that accompanies such travel. 

The attack may include, for example, spoofed emails from the executive abroad, saying that they are in a dangerous situation (e.g., there has been a terror attack, they have been kidnapped, etc.) and need money. In an extreme case, information gathered through spy-mail can be used to plan an actual kidnapping. According to one report, there are 40,000 kidnap-and-ransom cases each year, many of which involve executives on business travel.

Malicious actors also use the fact that an executive is out of the office to dupe their person’s coworkers into sending corporate files or other sensitive data. Earlier this year, companies including Advanced Auto Parts and Snapchat fell victim to fraudsters posing as company leaders, who pilfered employee W-2s and used them to file fraudulent tax returns. Information captured by spy-mail can help hackers can send believable emails, with the correct sender, recipient, context, and time-stamp, to an executive’s HR department or payroll vendor, asking for confidential records at a time when they know the executive won’t be around to detect it.

How can companies avoid an email-borne crisis? No corporate cybersecurity strategy is complete without a plan for safeguarding the organisation’s data when business leaders are away. And simply banning executives from checking email when traveling, even if it isn’t a work-related trip, is not a realistic solution. As the email threat landscape evolves, organisations must adapt their defenses accordingly. 

Here’s how:

Train for awareness. Employees can’t guard against Cyberattacks if they are ignorant of the threats that surround them. Offering periodic, engaging training that defines spy-mail and phishing from an end-user perspective, and that illustrates the ramifications of each, is a necessary step toward making employees more vigilant. According to PWC and KPMG, only 53% of companies have employee security-awareness and training programs, and only 50% of CEOs feel prepared for a cyberattack.

Establish executive travel email protocol. No IT manager will successfully unchain the C-suite from their inboxes, even when on vacation. Organizations should, however, implement policy controls to identify and mitigate the risk of spy-mail and phishing attempts while executives are on the road. For example, finance departments should outline a protocol that executives must follow in the event that they need to request money while traveling. When a request comes through that doesn’t adhere to the set protocol, the scam is less likely to succeed.

Add an extra layer of inbox security. When traveling, business leaders need to be focused on the task at hand, not on safety and Cybersecurity issues. Adding spy-mail protections to conventional spam filters and firewalls can help safeguard company data and give traveling executives peace of mind.

As companies are learning the hard way, email scams are a growing problem, resembling bank heists in the amount and sophistication of the intelligence gathering that goes into them. 

Knowing when and where executives are traveling and emailing is a necessary piece of information for many of these attacks. By training employees, putting appropriate travel policies in place, and adopting the latest security software, companies can reduce the risk of falling victim to one of these attacks.

HBR
 

 

« DDoS: Deceptive Denial Attacks
2016 Trends in Cyber Crime »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Senetas

Senetas

Senetas is a leading developer and manufacturer of certified high-assurance encryption solutions, dedicated to protecting network transmitted data without compromising performance.

CERT Syria

CERT Syria

CERT Syria is the national Computer Emergency Response Team for Syria.

SecurityHQ

SecurityHQ

SecurityHQ (formerly known as Si Consult) is a Global Managed Security Service Provider (MSSP) that monitors networks 24/7, to ensure complete visibility and protection against your cyber threats.

Cyber Intelligence (CI)

Cyber Intelligence (CI)

Cyber Intelligence is an award winning 'MSC status' cyber security education and training company.

Secure Soft

Secure Soft

Secure Soft are experts in Computer and Information Security with a presence in Peru, Colombia and Ecuador.

Center for Applied Cybersecurity Research (CACR) - University of Indiana

Center for Applied Cybersecurity Research (CACR) - University of Indiana

CACR serves Indiana and the nation by tackling cyber risk in research and other unusual environments through agile, holistic, principle-based cybersecurity.

SixThirty CYBER

SixThirty CYBER

SixThirty is a venture fund that invests in early-stage enterprise technology companies from around the world building FinTech, InsurTech, and Cybersecurity solutions.

OpSec Security

OpSec Security

OpSec Online is the only brand protection solution that spans all channels so your brands are protected no matter what digital venue the criminals target.

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo is the UK’s largest cloud and cyber security event.

Sygnia

Sygnia

Sygnia is a cyber technology and services company, providing high-end consulting and incident response support for organizations worldwide.

Pacific Cyber Security Operational Network (PaCSON)

Pacific Cyber Security Operational Network (PaCSON)

PaCSON is an operational cyber security network of regional working-level cyber security experts in the Pacific.

Diligent

Diligent

Diligent's SaaS GRC platform gives leaders a connected view of governance, risk, compliance and ESG across their organization.

Lodestone

Lodestone

Lodestone partners with clients to help them mitigate business and reputational risk, through our human-based, approach to cyber security, digital forensics and incident response.

CipherStash

CipherStash

CipherStash is a complete data governance and breach prevention platform.

Smarsh

Smarsh

Smarsh products are designed for user-friendly, efficient compliance. From archiving, supervision, and discovery to cybersecurity – Smarsh has you covered.

2021.AI

2021.AI

2021.AI serves the growing business need for full oversight and management of applied AI.