Latest / Tech Talks With Kinsoft / Importance of Email Security

Transcript

Importance of Email Security · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft, your shortcut
• 0:02
  to staying sharp on the tech that matters. Today,
• 0:05
  we're doing a real deep dive in something called
• 0:08
  business email compromise, or BEC. It's a threat
• 0:13
  that's, well, it's more than just growing. It's
• 0:15
  really changing how businesses have to think
• 0:17
  about security. It absolutely is. Email is still,
• 0:20
  you know, the main way we communicate in business,
• 0:22
  but that also makes it the number one way criminals
• 0:24
  try to get in. Our goal today is to unpack BEC,
• 0:28
  see how it's changing, and look at the advanced
• 0:31
  security that can help protect you. All right,
• 0:33
  let's get into it. We've looked at some really
• 0:35
  interesting sources here, everything from the
• 0:37
  latest stats on BEC to the psychology behind
• 0:39
  why these scams work. And we'll also explore
• 0:42
  how cutting edge solutions like those from Acronis
• 0:45
  are actually fighting back. You might be genuinely
• 0:47
  surprised at how sophisticated this is all become.
• 0:49
  So maybe starting with the basics, even though
• 0:51
  BEC isn't new, what makes it such a huge deal
• 0:54
  right now? Why is it so persistent? Yeah, that's
• 0:56
  a good place to start because BEC is different.
• 0:59
  It's not like your typical virus attack. Basically,
• 1:01
  it's a financial scam, a really sneaky one. Criminals
• 1:04
  pretend to be someone you trust, could be your
• 1:06
  boss, a supplier, maybe even just a colleague.
• 1:09
  And the whole point is to trick you, trick you
• 1:11
  into sending money or giving up sensitive info.
• 1:13
  And it's not just a threat anymore. It's kind
• 1:15
  of become the main threat. Our sources are showing
• 1:17
  that back in 2024, BEC made up a massive 73 percent
• 1:23
  of all reported cyber incidents. 73 percent.
• 1:26
  Wow. That's. That's almost everything. It's huge.
• 1:29
  Yeah. And the cost is just as startling. As of
• 1:31
  March 2025, there's been about a 30 percent jump
• 1:35
  in these attacks. It's the second priciest type
• 1:38
  of breach out there. We're talking an average
• 1:39
  cost of nearly five million dollars, four point
• 1:42
  eight nine million dollars to be exact. Nearly
• 1:44
  five million per incident. Per incident. And
• 1:46
  the average amount they asked for in these fake
• 1:47
  wire transfers in early 2025, it was over twenty
• 1:50
  four thousand dollars. What's really concerning,
• 1:53
  too, is that it hits everyone, even smaller places
• 1:55
  like companies with under a thousand. employees,
• 1:58
  they have a 70 % chance of getting hit by at
• 2:00
  least one BEC attack every week. Every week.
• 2:03
  Every single week. And for the really big companies,
• 2:05
  you know, 50 ,000 plus employees, basically a
• 2:08
  guarantee, almost 100 % weekly chance. So bottom
• 2:11
  line, if your business uses email, you're a target.
• 2:15
  Simple as that. Those numbers are pretty stark.
• 2:18
  But sometimes abstract stats don't quite hit
• 2:21
  home. Can you maybe give us some real world examples?
• 2:23
  Show us the impact. Sure. And yeah, the real
• 2:25
  stories are quite sobering. Take December 2024,
• 2:29
  two companies over in Zamora, Spain. They lost
• 2:32
  almost 20 ,000 euro. The criminals just got into
• 2:35
  their email chain, changed some bank details
• 2:37
  in an invoice and poof, payment rerouted. Just
• 2:39
  like that. Just like that. Now they got most
• 2:41
  of it back, which is good. Shows quick action
• 2:43
  helps. But it demonstrates how easily it can
• 2:45
  happen. Right. Or look at Australia in 2024.
• 2:48
  Attackers there were using AI, believe it or
• 2:51
  not, to mimic partners, managers, leading to
• 2:53
  estimated losses around $2 .9 billion a year
• 2:56
  for businesses there. Using AI. Wow. Yeah. And
• 3:00
  maybe the most dramatic one, Orion Chemical Manufacturing
• 3:04
  in Luxembourg, August 2024. An employee was tricked
• 3:07
  into making multiple fraudulent wire transfers.
• 3:10
  They lost $60 million. $60 million. $60 million.
• 3:15
  It just highlights that even large, you know,
• 3:17
  presumably sophisticated companies are definitely
• 3:20
  not immune. And what really makes these BEC attacks
• 3:23
  work so well is they go straight for human behavior.
• 3:27
  It's like psychology. They don't always need
• 3:29
  fancy malware or viruses. Often it's just. Deception.
• 3:32
  Pure and simple. So less about breaking through
• 3:34
  firewalls and more about tricking the person
• 3:36
  sitting at the keyboard. Exactly. They know how
• 3:38
  we tend to react, like requests from the boss.
• 3:40
  Yeah. People tend to jump on those, right? Sure,
• 3:42
  yeah. Well, data shows that in almost 90 % of
• 3:44
  VEC attacks, 89%, to be precise, they're impersonating
• 3:47
  someone high up. Yeah. CEO, CFO, that sort of
• 3:50
  thing. Sometimes it's as simple as changing the
• 3:52
  display name in the email. One study found that
• 3:54
  in 36 % of VEC emails, looks legit at first glance.
• 3:58
  We've even seen... Cases using deep fake audio,
• 4:02
  fake voices mimicking the CEO over the phone
• 4:05
  to authorize payments led to huge losses. Hundreds
• 4:08
  of thousands. Voice clones. That's terrifying.
• 4:11
  It is. And then there's the urgency factor. They
• 4:13
  create this fake crisis. Urgent request. Need
• 4:15
  this done today. Act now. About three quarters
• 4:18
  of these attacks demand action within like 24
• 4:22
  to 48 hours. It pressures people, stops them
• 4:24
  from thinking it through or checking properly.
• 4:27
  Rushing them so they make mistakes. Precisely.
• 4:29
  And the other big one is trust. Posing as a known
• 4:32
  vendor, a supplier you work with all the time,
• 4:34
  or even just a colleague. Think about Google
• 4:36
  and Facebook. They lost over $100 million combined.
• 4:39
  The scammer just sent them fake invoices pretending
• 4:41
  to be a hardware supplier they actually used.
• 4:44
  Unbelievable. So the regular checks may be weren't
• 4:46
  applied because it looked like a routine vendor
• 4:48
  payment. Seems likely, yeah. The usual internal
• 4:51
  verification might just get bypassed when it
• 4:53
  looks like a normal external transaction. Okay,
• 4:55
  so with these tactics constantly evolving, what's
• 4:59
  next? How are things like AI changing the game
• 5:02
  here? It sounds like it's only getting tougher
• 5:03
  to defend against. It absolutely is getting tougher.
• 5:06
  And yeah, AI, especially generative AI, is a
• 5:09
  massive factor now. By mid -2024, estimates were
• 5:12
  that something like 40 % of BEC phishing emails
• 5:15
  were being generated by AI. 40 % already. Already,
• 5:19
  AI makes the emails sound much more convincing.
• 5:22
  No more awkward grammar or weird phrasing that
• 5:25
  used to be a giveaway. Plus, AI can churn out
• 5:27
  tons of variations super quickly, target specific
• 5:30
  people much more effectively. It's led to this
• 5:32
  explosion. We saw a 1 ,760 % year -over -year
• 5:37
  increase in BEC attacks reported. Wow, 1 ,760
• 5:40
  % increase. That's staggering. It is. And we're
• 5:42
  also seeing this other trend, vendor email compromise,
• 5:45
  or BEC. That jumped 66%. just in the first half
• 5:48
  of 2024. That's where they hack into your supplier's
• 5:51
  email, then send you fake invoices or payment
• 5:53
  instructions from their legitimate account, exploiting
• 5:55
  that supply chain trust. So they don't even need
• 5:57
  to trick your employees directly at first, just
• 5:59
  one of your partners. That's shush. Yeah, insidious
• 6:02
  is the right word. It really is. And then there's
• 6:05
  this blending of methods, multi -channel attacks,
• 6:07
  maybe an email first to set the stage, then a
• 6:10
  phone call to add pressure or a text message.
• 6:12
  And while it's still, let's say, emerging, those
• 6:15
  AI voice clones we mentioned, even video deepfakes,
• 6:18
  they're becoming more common, especially when
• 6:21
  targeting high value individuals or large transfers
• 6:24
  makes that second check absolutely vital. OK,
• 6:27
  so the threats are evolving fast, getting smarter.
• 6:29
  What are organizations actually doing? Or maybe
• 6:32
  what should they be doing to stand a chance?
• 6:35
  Well, the good news is there's a big push now,
• 6:37
  not just recommendations, but actual regulations
• 6:39
  are stepping up. Industry standards are demanding
• 6:41
  better defenses, really focusing on multiple
• 6:43
  layers of security, not just one silver bullet.
• 6:46
  So regulations are forcing the issue? In many
• 6:47
  cases, yes. Like in the U .S. PCI DSS version
• 6:51
  4 .0. It now mandates DMRC email authentication
• 6:55
  by March 31st, 2025. DMRC basically tells email
• 7:00
  systems what to do with emails that fail. Authentication,
• 7:03
  reject them, quarantine them. Email providers
• 7:05
  are also getting much stricter about enforcing
• 7:07
  it. And globally, you've got things like the
• 7:09
  EU's NIS2 directive requiring businesses to report
• 7:12
  major cyber incidents within 24 hours. And the
• 7:15
  DORA regulation in the EU, specifically for financial
• 7:17
  services, it's all driving security upwards.
• 7:21
  So compliance is becoming a big driver. What
• 7:23
  about the core technical stuff? What needs to
• 7:24
  be in place? Absolutely crucial. First up, email
• 7:27
  authentication. We mentioned a DMRC, but it works
• 7:30
  with SBF and DKIM. These are protocols that verify
• 7:33
  the sender is who they say they are, stop spoofing,
• 7:37
  adoptions growing, but really enforcing strong
• 7:39
  DMRC policies, not just monitoring. That's key.
• 7:42
  Got it. SBF, DKIM, D -Air, FARC. What else? Multi
• 7:46
  -factor authentication, MFA. Especially on email
• 7:49
  accounts. This is a huge one for preventing account
• 7:51
  takeovers, which often lead to BEC. The stats
• 7:54
  show it works. In 2023, 58 % of BEC attacks hit
• 7:58
  organizations that didn't have MFA. Wow, over
• 8:00
  half. Yeah. But by early 2024, that number dropped
• 8:04
  to 25 % for orgs without MFA. Attackers had to
• 8:07
  shift tactics because MFA was blocking them.
• 8:09
  It clearly works. Okay, MFA is a must -have then.
• 8:11
  Definitely. And third, you need good email security
• 8:15
  filters. Modern ones use AI, machine learning,
• 8:18
  pattern detection. They can spot subtle signs
• 8:21
  of BEC. Things like alerting you if the display
• 8:25
  name says it's the CEO, but the actual sending
• 8:28
  domain is wrong, like a Gmail address instead
• 8:30
  of the company one. These filters are essential
• 8:32
  to just reduce the sheer volume of malicious
• 8:34
  emails hitting inboxes. Makes sense. Technology
• 8:37
  is clearly critical. But you said earlier these
• 8:39
  attacks exploit human psychology. So what about
• 8:42
  the people part of the defense? How do we make
• 8:44
  employees less vulnerable? Ah, yes. That's arguably
• 8:47
  the most critical piece of the puzzle. You need
• 8:49
  what some call human -centered security. Training
• 8:52
  and awareness are paramount. So ongoing training.
• 8:55
  Ongoing and practical. First, organizations absolutely
• 8:58
  need strict verification protocols. Any request
• 9:01
  for money or sensitive data changes must be verified
• 9:04
  through a different channel. Like get an email
• 9:06
  asking to change bank details. Pick up the phone
• 9:08
  and call a known trusted number for that vendor,
• 9:10
  not a number from the email itself to confirm.
• 9:13
  This simple trusted callback stops so many BEC
• 9:16
  attempts. That second check. Seems simple. But
• 9:19
  effective. Incredibly effective. Also, you need
• 9:22
  a plan for when things do go wrong. An incident
• 9:25
  response plan. Because even with the best offenses,
• 9:27
  something might slip through. If the victim or
• 9:30
  their bank acts really fast, often the funds
• 9:32
  can be frozen or even recovered. We saw data
• 9:35
  showing over half of BEC victims got back at
• 9:38
  least 82 % of the money if they reported it quickly.
• 9:41
  Speed matters then. Hugely. And finally, back
• 9:44
  to training. Regular security awareness training
• 9:46
  combined with simulated phishing attacks. makes
• 9:49
  a massive difference. Sources show that with
• 9:51
  behavior -focused training, you can see like
• 9:53
  a 6x improvement in employees spotting phishing
• 9:56
  attempts within just six months. An 86 % drop
• 9:59
  in successful incidents. That's a huge improvement.
• 10:02
  It really is. You see things like the percentage
• 10:04
  of users who actually report real threats jump
• 10:06
  from maybe 13 % initially up to 50 % after just
• 10:09
  six months of good training. It's about teaching
• 10:11
  people those red flags. Weird domains, bad writing,
• 10:15
  though. AI is making that harder, that sense
• 10:17
  of urgency, unexpected attachments or requests,
• 10:20
  making them pause and think. Okay, so it really
• 10:22
  is a combination. You need the tech, but you
• 10:25
  absolutely need the trained human element, too.
• 10:28
  Given all that complexity, let's talk solutions.
• 10:30
  You mentioned Acronis earlier, and our sources
• 10:32
  highlight them, too. How do they fit into this
• 10:35
  multi -layered defense picture? Yeah, Akronis
• 10:38
  comes up strongly. They've been recognized, for
• 10:40
  instance, as a leader in the G2 grid for cloud
• 10:42
  email security, specifically for small businesses.
• 10:45
  And Gartner mentioned them in their 2023 market
• 10:48
  guide for email security. Their main offering
• 10:50
  here is Akronis email security, which, interestingly,
• 10:54
  is powered by perception point technology. The
• 10:57
  whole focus is on catching these modern, tricky
• 10:59
  email attacks and doing it fast, within seconds.
• 11:03
  Within seconds. How do they achieve that speed
• 11:05
  and coverage? It's through a pretty comprehensive,
• 11:08
  multilayered approach. They're designed to block
• 11:10
  all sorts of things. Spam, basic phishing, but
• 11:12
  also the advanced stuff like BEC, account takeover
• 11:15
  attempts, malware, APTs, those persistent threats,
• 11:17
  and even zero -day attacks. Zero days being the
• 11:20
  brand new threats nobody knows about yet. Exactly.
• 11:22
  And they do this by combining multiple techniques.
• 11:25
  They use powerful threat intelligence from, I
• 11:28
  think... six different leading sources plus their
• 11:31
  own engine. They use traditional signature -based
• 11:34
  detection and check URL reputations using four
• 11:36
  different engines for that. They even have unique
• 11:39
  image recognition tech that spots malicious websites
• 11:42
  just based on the logos or images used on the
• 11:44
  page, which is pretty clever for phishing detection.
• 11:46
  Image recognition. Okay, that's different. It
• 11:48
  is. And they combine machine learning with DMRC
• 11:51
  checks to prevent spoofing effectively. So it
• 11:54
  sounds like they're covering a lot of bases.
• 11:55
  How do they handle those really advanced hidden
• 11:58
  threats, the zero days and APTs you mentioned?
• 12:01
  Right. That's a key differentiator. Their system
• 12:03
  is designed to recursively unpack everything
• 12:06
  in an email. It digs deep into embedded files,
• 12:09
  follows links, analyses everything layer by layer
• 12:12
  to find hidden threats. And crucially, for APTs
• 12:15
  and zero days, they use unique CPU level detection
• 12:18
  technology. CPU level. What does that mean in
• 12:21
  practice? It means it operates at a very fundamental
• 12:24
  level of the computer's processor. This allows
• 12:27
  it to spot and block malicious exploits before
• 12:29
  the actual malware payload even gets released
• 12:32
  or executed. It acts much earlier in the attack
• 12:35
  chain than many traditional scanners, which might
• 12:38
  wait for the malware file itself. And because
• 12:40
  of this, they can give a clear yes -no verdict
• 12:42
  on an email within seconds. Which is a big deal
• 12:45
  compared to older systems that might take minutes,
• 12:48
  right, leaving a window of risk. Exactly. That
• 12:51
  speed is crucial. A few minutes delay in scanning
• 12:54
  could be enough time for a user to click a malicious
• 12:56
  link that arrived in their inbox before the scan
• 12:59
  finished. Acronis aims to prevent that. Okay,
• 13:02
  that advanced detection and speed sound impressive.
• 13:05
  But how easy is this to actually implement for
• 13:07
  a business? Especially, say, for MSPs managing
• 13:10
  multiple clients. That seems to be another major
• 13:12
  focus for them, ease of deployment and management.
• 13:15
  Akronis email security is cloud native. It integrates
• 13:18
  directly with email systems like Microsoft 365.
• 13:20
  They talk about API -based provisioning for M365
• 13:24
  being like the flip of a switch. Flip of a switch.
• 13:26
  So quick setup. That's the idea. Rapid deployment,
• 13:29
  quick time to value, which is obviously important
• 13:32
  for businesses and especially for managed service
• 13:35
  providers, MSPs, who need efficiency. Another
• 13:39
  important point is that it scans 100 % of email
• 13:41
  traffic, both inbound and outbound, in real time.
• 13:45
  Outbound too? Why is that important? Well, if
• 13:49
  one of your internal accounts gets compromised
• 13:51
  somehow, scanning outbound traffic stops that
• 13:54
  account from being used to send phishing emails
• 13:56
  or malware out to your partners, customers, or
• 13:59
  even other employees. It prevents that lateral
• 14:02
  movement of threats. Ah, stopping internal spread.
• 14:06
  Makes sense. Right. And they also offer incident
• 14:09
  response services as part of it. So you get access
• 14:11
  to their cyber analysts who can help monitor
• 14:13
  things and assist with remediation if an attack
• 14:15
  does occur. It's like having an extension of
• 14:17
  your own security team. So it sounds like more
• 14:19
  than just a filter. It's kind of a managed security
• 14:21
  component. You could see it that way. And it's
• 14:23
  important to understand Acronis email security
• 14:25
  isn't just floating out there alone. It's part
• 14:27
  of their bigger platform, Acronis Cyber Protect
• 14:30
  Cloud. OK, what's that? That platform is really
• 14:32
  designed with service providers in mind, but
• 14:34
  it integrates a whole suite of protection. backup
• 14:37
  and disaster recovery. There are next -gen anti
• 14:40
  -malware endpoint management tools all in one
• 14:43
  place. Email security is just one piece. They
• 14:46
  actually have, I think, seven different services
• 14:48
  specifically aimed at protecting Microsoft 365
• 14:52
  environments. Things like security posture management,
• 14:55
  security awareness training tools, XDR integration.
• 14:58
  So it's about bringing everything together, integration
• 15:00
  and consolidation. Exactly. The idea is to reduce
• 15:04
  complexity, reduce the number of different vendors
• 15:06
  and dashboards you need to manage and provide
• 15:09
  a more holistic, streamlined security posture.
• 15:12
  Less complexity often means better security and
• 15:15
  less strain on resources. Right. That makes a
• 15:17
  lot of sense. It feels like a very integrated
• 15:18
  approach is needed for a threat like BEC. So
• 15:22
  wrapping this up then, what's the main takeaway
• 15:24
  from this deep dive on business email compromise
• 15:27
  and how we can actually fight back? I think the
• 15:29
  core message is yes, email is still probably
• 15:31
  your biggest digital weak spot. It's critical
• 15:33
  but vulnerable. But the good news is comprehensive,
• 15:36
  multilayered defenses are available and effective.
• 15:39
  The key is understanding that technology alone,
• 15:42
  while essential, isn't enough. That human awareness,
• 15:46
  the training, the verification protocols, they're
• 15:49
  just as vital. It's about... combining smart
• 15:51
  technology like the advanced detection in Acronis
• 15:54
  email security with really solid internal processes
• 15:57
  and ongoing employee education. The threat landscape
• 16:00
  is changing fast, especially with AI getting
• 16:02
  into the mix. But thankfully, the defenses are
• 16:05
  evolving, too. It definitely leaves us with something
• 16:08
  to think about. It prompts the question for you
• 16:10
  listening right now. What steps are you actually
• 16:12
  taking proactively to lock down your organization's
• 16:15
  most vital communication channel? Because it's
• 16:17
  clearly an ongoing effort, isn't it? Not a one
• 16:19
  -time fix. Absolutely right. It's a continuous
• 16:21
  process. And if you are looking to discuss your
• 16:25
  specific security needs, your IT environment,
• 16:27
  we certainly encourage you to visit www .kinsoft
• 16:30
  .com .au. Great advice. Well, thanks for tuning
• 16:33
  in to Tech Talks with Kinsoft. We really hope
• 16:36
  this deep dive leaves you feeling not just informed,
• 16:39
  but actually empowered to take action. We'll
• 16:41
  see you next time.