mnemonic security podcast
Hosted by Robby Peralta from mnemonic, one of Europe’s leading cybersecurity companies, the show features conversations with researchers, founders, operators, and security leaders working across the cybersecurity landscape.
Each episode explores a specific topic within cybersecurity: from incident response, threat intelligence, AI, and geopolitics, to leadership, resilience, and the changing role of security leaders.
The podcast is tailored to cybersecurity practitioners and decision-makers who want grounded conversations about where cybersecurity is going, what organisations should prepare for, and what experienced people are seeing.
mnemonic security podcast
Email and Human Centric Security
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
In this episode of the mnemonic security podcast, Robby is joined by Matt Cooke from Proofpoint.
They discuss the evolving landscape of email security, emphasising the need for a multi-layered approach beyond traditional prevention methods, as well as the importance of pre-delivery, post-delivery, and click-time protection to combat phishing and business email compromise (BEC) attacks.
Matt notes that 76% of data breaches involve human error, and stresses the significance of threat intelligence and machine learning in detecting and mitigating threats. The conversation also touches on the role of AI in enhancing email security, the importance of DMARC for email authentication, and the concept of "very attacked people" (VAPs) to prioritise security efforts.
Evolution of Email Security in 2024
SpeakerFrom our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the Mnemonic Security Podcast.
Robby PeraltaLove it or hate it, we all have to use email. Both in business and in our personal lives. I at least appreciate all the cheesy signatures and enjoy imagining the embarrassment one will have when realizing they press the reply to all button. On the other hand, I highly dislike the need to be so formal all the time, the unenevitable pile-up of homework, aka on Red Emails, and the absolute worst of all, vendor newsletters. But one thing we've all seen without actually seeing it are the thousands of people around the world plotting and planning on how they're gonna get us to click on something and enter our credentials. According to my LLM, Microsoft and Google handle around 500 billion emails a day and have huge security teams to prevent bad stuff from happening in our inbox. But experience shows they can't stop them all. And in their defense, even if they were to stop 99.999% of those, that would still leave 5 million bad ones. So a modern approach to email security these days requires more than just prevention. Therefore, I've invited a friend of ours, which loves email more than all of us, to come and provide proof to their points around email security. Matt Cooke, welcome to the podcast.
Matt CookeHey, how you doing?
Robby PeraltaI'm doing uh lovely. How about yourself?
Matt CookeUh I'm doing very well, thank you, sir. Very well indeed. I'm looking forward to the chat today. Been looking forward to this for a while.
Robby PeraltaBelieve it or not, you're the first marketing person on the podcast. So I'm gonna count how many times you say AI.
Matt CookeI can't actually can't believe that you've not ever had any marketing people because I know that there's a lot of people out there like me that that kind of hide marketing behind their job titles, right? So externally, when I'm out there talking, I'm I'm a cybersecurity strategist, but internally within the organization, I'm marketing. And you found out that I was marketing on LinkedIn, so I've I've been out, I've been out it. It's how it goes.
Robby PeraltaAnd I'm just kidding, yeah. You've been uh a consultant pretty much your whole life. So that's a very interesting uh career path move.
Matt CookeMy background is actually I was hands-on IT. I used to run an IT team, I used to do a lot of the work myself, and then from there I kind of re-evolved through a whole bunch of different vendors um, you know, before finding my way to Proof Point. And I've I I guess I that's the experience that I bring. Hopefully, both sides of the fence, right? I can see it from hey, we're a vendor and we need to sell products, to hey, actually, we're out there trying to defend our organizations and you know we need to uh we need to actually make a bit of a difference. So it's a balance, it's about keeping it real.
Robby PeraltaAnd hey, I'm I'm just giving you shit. I saw that you came from the technical side. So if you were just marketing your life, I probably I wouldn't make that joke. No, no, exactly. And also I'm it'd be the pot calling the kettle black. I'm a sales guy working with marketing, so I'm probably the worst of anybody.
Matt CookeWell, there you go. We're both imposters.
Robby PeraltaWolf and sheep uh sheep clothing, right? But hey, as you know, we have a tendency in security to like uh pop on like the new, new and cool bandwagon, right? So, you know, these days, uh one thing I hear a lot about in these walls or when a lot of stuff we're doing instant response on, right, is like internet-facing appliances, VPN gateways. I would almost think that like email security is kind of like over like a thing of the past. We solved that. I would assume that's not the case.
Matt CookeThat would be great if we did though, wouldn't it?
Evolving Strategies in Email Security
Robby PeraltaRight? What's the status of email security in uh in 2024?
Matt CookeDo you know it it's constantly evolving, and and you're right, because you look at it from the outside and you think, hey, email security, that was done, right? We used to buy an appliance and stick there and it used to do do all that for us. We filtered everything and and then all of a sudden we went cloud and we went, I don't know, maybe most of us went with Office 365 and your Google Workspace, whatever it happens to be, and they kind of did the email thing for us. And so we all thought that that problem was done. Um, but the reality is it hasn't because it's if you think from a from a cyber criminal's perspective, like the the most, the easiest thing for me is actually to get you to do bad stuff for me, right? Because if I've got to sit there and try and exploit a zero day and try and hack into a system, whatever I've got to do, that involves a lot of work. And if I'm burning you know those zero days or burning the use of those vulnerabilities, that's it, that's a challenge that's really expensive for me. What's really easy for me is to effectively be a grifter, is to turn around and try and con you into doing stuff. And that hasn't changed because that can scale, right? I can if I can get you to click on a link, if I can get you to give me information, if I can get you to send me money, then you know, I've I'm achieving, I'm achieving, I'm out there, I'm winning as a cyber criminal. And so the way I communicate with you, well, it's ubiquitous, right? It's email. We've all been doing it. And so uh the job of the cyber criminal is actually just to evade those defenses. And so the job of email security, and you know, email security as a platform, really, rather than just a single thinking it has a single box, it's actually kind of much bigger than that now. Um, you know, is to try and stay ahead of that, is to try and spot some of those social engineering techniques, not just like, hey, it's a bit of malware, it's a virus, whatever it is. It's actually someone trying to trick you into doing something. Um, that's a much more, much harder equation to solve for sure. Right.
Robby PeraltaSo email is uh still in a threat vector that's uh increasing, or what do the numbers look like there?
Matt CookeYeah, I mean it is, and if you get you know, you only have to look at like all the standard reports. I think was it viral Verizon came out, was it a month or two ago at uh with their data breach report? About 76% of all incidents had some kind of human element involved in them. Because for the reasons that we just explained, right, you're the one that's been targeted rather than anyone else. Uh rather than any it's not systems per se, it's just much easier to target you as an individual. So those risks are kind of increasing. And then you know, similarly, you throw in the mix the types of risk. You know, clearly, if I compromise an account, that could easily lead to ransomware. We know that's a big challenge. We don't need to kind of go and and and chew over that one again. But business, we we call this thing in the industry business email compromise, which is more like this imposter fraud, right? And me trying to trick you into sending money. Um, that is is is massively on the rise. Unfortunately, that's one of the biggest areas where companies are losing money because it's just simple social social engineering and often actually involves accounts that have been taken over. So I guess that those are the reasons I guess that the market has evolved. Um, you know, and everyone thought you know that that actually what we had was good enough. And and actually now everyone's realizing no, it isn't good enough anymore. Um with the market kind of evolved to saying, hey, we've got this package with let's say Microsoft 365 or Google Workspace includes email security, but we need something else. And so the market said, well, okay, let's try and do this thing called post-delivery protection, where you know we can bolt a product onto behind that technology and start looking at emails after they've arrived in inboxes and trying to work out what's good and bad. Um, but very quickly, I think the market evolved again and said, Hey, actually, that's still a problem, because that's that's actually too late. If you think about, if you think about that, like like if I want to send you an email and get you to send to click on a link and give up your details for credential phishing or whatever, if that email's hit your inbox, I reckon, I don't know, I feel like you're like an inbox zero kind of character, right? If it pops up, you click on it, you're you're there, right? And so then that's how people work. And so just relying on this post-delivery protection becomes a bit of an issue. And I think, yeah, that was again, that was kind of bought out in in in sort of some of the stats recently. I think it was again in the same Verizon report. They said that um with within 60 seconds, if you're likely to engage within a fit with a fish, you're likely to have done everything, like given up your account details within 60 seconds of it arriving in your inbox. Yeah. And and then, in fact, our own research, we see that like one in seven malicious URLs that land in the inbox get clicked within 60 seconds as well.
Robby PeraltaAnd so maybe that's why they disabled links. Me, I can't press a link in my on my phone at least.
Matt CookeWell, um, that's probably one of the reasons. Yeah, and organizations look to do that in a different way. I mean, some people some companies will just completely disable them, some will put into isolation, some will build in click time protection. But interestingly, that then becomes a real key part of your overall, I guess, email security package, if you like. So you start off with actually saying, we can't just we can't just let the bad stuff arrive in the inbox anymore and deal with it there. We now need to focus on what pre-delivery is. Let's keep more stuff, more bad stuff away in the first place. In other words, let's do a better job than that kind of good enough protection that we thought was good enough that's packaged in those productivity suites that we use. Let's put something up front that says actually stop all the bad stuff there. Then let's do something post-delivery, just in case, but equally gives us the capability to remediate if something bad goes in. But we also need to build in click time protection for exactly the reason that you said, Because you click on click on things on your phone, because you click on things on your laptop, you click on things, yeah, it's just our nature, it's what we do. So, and I think you know, going back to your original point, how has the kind of the market evolved? And that's how it has evolved. It's evolved from just being you know one piece of technology to actually now being multiple stages of pre-delivery, post-delivery, click time protection, which covers the suite, I guess, if you like, and and gives us that that that that platform to uh to protect your your people because that's what we're we're in the business of. It's not email security anymore, it's people protection.
Robby PeraltaLayered defense. Yeah, cool. Uh I know for a fact that uh one of my friends I asked him, like, hey, what would you do if you didn't work in mnemonic? And he was like, probably like a researcher, maybe, maybe somebody like Proof Point. And I was like, okay, wow, so they must be really good at what they do. Nice. One of my colleagues here in mnemonic that said that. Okay, um LinkedIn collection, please. Link Z. No, you cannot have him. No, no, no. He's awesome. No, but uh that made me think like obviously they're good at threat intelligence, right? And I know that obviously, if you know, you must be collecting huge amounts of data. Yeah. Uh just uh just a few words. I'm not even gonna, I don't even know how to phrase the question, but like threat intelligence for proof point, what does that mean?
Matt CookeYeah, it it it means everything, actually. We see billions of emails every single day. I mean, the volume of business to business and business to consumer emails that we see on a daily basis is is astonishingly huge, but that gives us all of that intelligence, right? So a lot of our technology does also get put into some of the ISPs and some of the big platforms out there as well, um, in in various different ways. And and and it is that breadth of visibility, the volume of messages that we see. And then what we do with that is you you learn. Um, you don't just learn, hey, that's a bad IP address sending out a load of spam. Yeah, that's one of the things that you can learn. But more importantly, you can start to learn behaviors and profiles and you start to understand, you know, there's a really, really good uh example just recently, actually, of an organization that was a retail company, a retail company that sold essentially chairs, tables, that type of thing. And in order to sell them, they had to deal with a company that made them, right? The manufacturing company, really small industry, kind of, you know, five, ten people, something along those sorts, uh that sort of size. Made the uh furniture, gave it to the retailer, retailer sold it. Once a month, someone in the furniture manufacturer sends an invoice to the retailer. Someone in the manufacturer's account gets compromised, right? They got done with the phishing attack, the account, the account was taken over. And the sort of behaviors that you see right now is you see a cyber criminal is basically just going to sit there and look at the inbox, and in fact, look at the outbox and look at the conversation threads and realize that once a month they send invoices. And so when that thread happens, they jump on it and they hit reply all and it goes back through, right? And so at that point, the attacker's actually sending emails as if it were directly from that account. And so you're expecting it, everyone's comfortable with the conversation, it's completely normal. The only thing that's not normal is the attacker's actually saying in the message, hey, the bank account number's changed because we're having an audit at the moment. Can you send the money here instead? Now, if you look more closely, what they've also done is perhaps set the reply to address to be a domain externally, um, so that when the reply comes in, that conversation now happens to an external domain and it's not on the internal systems and it therefore invades the uh detection. But what's essentially what's happening there is an account compromise has led to a what we call a business email compromise uh scam. Basically, you've lost a load of money, right? Your money's been sent to the wrong place. That's the type of challenge that people are dealing with. Now, how do you spot that becomes the real challenge for organizations because the message itself looks normal. There's nothing different about it other than the bank account number changed, and so a lot of what we're doing is around that intelligence piece and understanding context to say, yeah, Matt and Rob email on a regular basis, and yeah, occasionally they'll talk about invoices, and yeah, actually, um, sometimes those numbers change, but this level of urgency being applied by Matt is unusual. And so maybe we'll put a little banner across your top of your message and say, hey, just pay a little bit more attention to this because this is maybe a little bit unusual. Um, you need to just just look into the details. Or, you know, maybe it turns out that that actually we detect that Matt's account has been compromised from that point. You know, we we make that decision and say it really does look like it's been compromised. But now when Matt starts to try and email that other retailer, the competitive retailer that they've also got business with, they've already had a warning in advance, and so that they can almost see that actually that that threat's going to come through, and so that they can take action to block it straight away. So I guess the point is there's never ever just one thing. But what we're doing right now and what that intelligence gives us is the understanding of content and context, um, and to be able to make those decisions um around those social engineering threats.
Robby PeraltaAnd I would assume that um to be able to build that, you're doing like natural language processing, you're looking at like the you've brought you're using machine learning to like break down the sentence itself and say urgency, uh looking at all the different factors and those together make a banner come up or something. Yeah, so you said that.
Matt CookeYou said you were going to talk about AI, but yes, yes, that is but you because that is it, that is exactly it,
Dynamic Adaptive Controls for Email Security
Matt Cookeright? Yeah, it is. It's using essentially machine learning models. I mean machine learning has been working within email security platforms for a long, long time already. But what the benefits we've got right now is that we can take some of those large language models that because they're much more freely available, and you know, we work um uh quite extensively with a few of them and we build some of our own and and use others as well, that helps us understand that context a bit better. That helps us work out what is the intent here? Is this conversation typical? Can we can we get those indicators from it? And and so, yeah, absolutely. That helps us do that at scale. And again, we're now able to sit in line and do that pre-delivery. And so if we can make these decisions that actually are based on content and context as the email's coming through, then all of a sudden now we can stop a vast majority of these types of threats actually landing in the inbox. And so where the market, you know, previously had had evolved to saying, hey, we need this post-delivery thing looking at just for these business email compromise email uh emails, actually that's not good enough. Now we're doing that I use a marketing term at wire speed um on pre-delivery, right? As the messages are coming through. Um and that's kind of huge because that's I guess what the advances in in AI have meant to have meant to us.
Robby PeraltaCool. Um so do you have lockdown mode on your phone? If you assuming you have an iPhone?
Matt CookeNo, I don't actually.
Robby PeraltaOkay. So uh one of the things about lockdown mode, if Apple sees something new, they have so much control over their telemetry, like, oh, that's new, block it, or it gets it goes to their like super, super sock or their IR team, right? Yeah. Um does Proof point have something like that in place for emails? Like stuff that you've you know you've never seen this and it I guess it'll react to the AI machine learning uh discussion.
Matt CookeWell, it kind of is, yeah. And and actually one of the best sources of telemetry is actually all the bad emails that we're seeing, right? In your organization. Because that can tell us like who's targeting your organization, right? Which which criminal gangs are kind of after you at the minute, what are the type of scams that we're seeing? What are the objectives? Are you facing ransomware threats? Is it business email compromise? But also it tells us who he's going to, and we can now now say, hey, Robbie is currently being targeted by a number of different criminal gangs with business email compromise threats because they've worked out that actually he's not a salesperson like he said he was. He works in finance, he's got access to money, um, you know, he's got access to money, he's got privilege, and so we're going to target him with those scams. Now, of course, we can start to see that in through the intelligence, and based on that, we can almost grade and score all the bad stuff that we're seeing and blocking and say, actually, that now gives us an indication to say actually, Robbie is one of our very attacked people within the organization. And very attacks doesn't necessarily mean just volume, it doesn't mean that hey, you're getting tons of rubbish coming at you coming your way, it means that really unique stuff as well. Maybe just that one threat that was completely unique. We'd never seen it before. And so all of a sudden your very attacked people score rate goes up. The algorithm says, hey, you're right now kind of pretty high at the top of the list. And what you've got there then is a list of of essentially where your risk lies within the organization. Because underneath that, we can also take a view as to you know, do you have access to money? Do you have access to data? What's your privilege look like? Are you an admin? Those types of things. If we can factor that into the algorithm, now we can say, okay, they're vulnerable, they're being attacked, and they've got privileged. That is risk. That's where we can kind of then center that risk in an organization. And in fact, one of the crace, we've got this super cool thing called the Nexus People Risk Explorer, which is a Venn diagram of risk, and it shows those people that essentially you present the most risk for the organization right now, right in the middle, and you can then apply better controls over that. So you talked about lockdown mode on your phone. One of those controls could be hey, you're in the VAP list. Well, we're going to now tell your authentication gateway who's in that list automatically. And so that you might be required to re-authenticate a couple of extra times during the day when you're logging into various different websites rather than using cash credentials. Or maybe we apply that to isolation. Again, you talked about links on your phone. Anyone in that VAP list will any link that gets sent to them right now, we're going to isolate that. So they've got click time protection on everything. Or perhaps we'll force all of their web traffic through isolation. Um, and that's just examples of some of the controls that you can kind of do because that that it actually opens the door to pretty much anything because that information we can offer it up through APIs, and we can then hook that into your other reporting tools within your security ecosystem to say, yeah, here's where we think most of your risk is right now, at this moment, on this day, at this time, and it's always there and it's available for you. Um, and you can then utilize that how you need to. So, yeah, those those lockdown kind of you know, we we call them adaptive controls, I guess, um, is is kind of the what we refer to them because because it's dynamic, um, because the risk profile of the organization is always changing.
Robby PeraltaVery interesting. Uh, tell me more about the uh the the very attack people, I would assume, like you said, finance developers, I would also assume. Yeah, I would also assume salespeople just because we're just clicking on shit.
Matt CookeTrue. Um I mean, true. I mean, quite often it's you said you tend to see a lot of VIPs in there, right? The the important people in the company, the execs. Um, more often than not because their name is out there, right? And and everybody knows they've got privilege and stuff like that. So they'll tend to float up there, but you certainly you'll see a lot of finance in there. You often will see a lot of HR in there as well. Um HR dealing with people information, right? A good source of data that criminals are kind of after. Um, but as I say, it's quite dynamic, and it you'd be surprised how much it can change on a fairly regular basis. Um but when once you factor in things like vulnerability and privilege as well, it does add a little bit of stability to that list.
The Platform Play in Cybersecurity
Matt CookeUm, because you you know you then need to know where to target your training, you know, for example. Another one of those adaptive controls might be hey, let's, you know, salespeople are always clickers, let's make sure that that we keep them up to date with their with their awareness training, that we feed them those little snippets every now and again just to keep their knowledge levels up and their awareness levels up. So yeah, and VAPs is um it's an interesting concept. These are people that we currently think are imminent targets within our business. And this is what we're doing about them, and these are the controls that we're putting in place, and it it can be really powerful to um to help optimize the risk within an organization.
Robby PeraltaI got an email from my um, probably shouldn't be saying this, but I'm saying anyway, I got an email from my salary department, and they were like, uh, this must this can't be you, right? Smiley face, and it was like, you know, obviously it's from the super shady Gmail, but it was written in perfect Norwegian, and it was asking my colleague to change my account number for my salary, right? And she laughed because she was like, You it was written in Norwegian, uh, that's obviously not you. Perfect Norwegian. So I was like, ow, but yes, that's not me, you know.
Matt CookeThe good thing about that is your colleague, you know, immediately thought, yeah, this is not right. Um, but it it if you think about that from an attacker's perspective, if they can scale that, yeah, that's worth quite a lot of money. And again, those types of scams are incredibly annoying, but incredibly popular as well at the moment.
Robby PeraltaSo the million dollar question, I think one that everybody in this uh podcast Appreciate hearing is like, why doesn't Microsoft just get their shit together and do what you're doing on their side since they are like the default uh choice included in the package, right? Uh yeah. And I'm I know that Microsoft has a big threat intelligence team that does a lot of the similar work that you guys are doing, right? Of course. So why does proof point exist? Yeah.
Matt CookeNo, absolutely. Yeah, I'll answer the question with a um with a question. Why doesn't Microsoft get their shit together? Absolutely. I mean, I I like it that they don't because actually it means that there's there's an ecosystem that can kind of focus on on doing the right thing with protecting people and is not necessarily just focused on you know building that productivity suite. And I think that's kind of that's the balance. Is you've got, you know, I'm using it right now, right? Office 365, using it every single day, and it's awesome to a certain degree. Yeah, and there are things we uh we don't all like in there, but there are things we love, right? It works, it's ubiquitous. So there are things in there, like imagine I I stick a file on OneDrive and I decide, hey, I Robbie, I need to send you the PowerPoint presentation, I'll just share it with you on OneDrive, it's fine. You get the link that kind of comes through. There used to be a time in cybersecurity where you know you'd look at, you'd basically tell people when you get an email, hover over that link. And if it looks legit, okay, click on it. If it looks a bit dodgy, don't do that. You can't do that with OneDrive or a SharePoint link or anything like that these days because there's these massive graving long links and they're really hard to understand. Of course, attackers know that. Attackers know that we're all using Office 365, they know it's ubiquitous. So what do they do? Well, they abuse those technologies as well. They actually launch their campaigns, they'll stand up a 365 tenant, they'll share malicious files in OneDrive, they'll use the tools that we're using against us, and of course, that then becomes incredibly hard for someone like Microsoft to be able to defend against because essentially the attackers are using their own their own platform to attack people on their own platform, and so you get to a point where you actually need to look at security slightly differently and say, actually, are they best placed in order to defend our people? Um, and the answer for most organizations um you know is often no, because actually that there's huge value to be had in that whole everything that we talked about, and you know, it's not just email security as being one product anymore, it's pre-delivery, it's post-delivery, it's click time protection, it's that complete story. It's also security awareness training, is also how we integrate with all those other um pieces of technology in your in your security stack. It's all of that that now becomes, you know, faithfully, email security is now a platform, if you like, um rather than one piece of technology. And and that's something that you know organizations like Microsoft that are building those suites, they they don't necessarily get that. And I think that's part of the reason why. Um they you know they do a good enough job to keep bad enough stuff away. Uh it's okay, but it's not stopping any of this, um, all the types of threats and things that we we talked about. And and organizations are not getting those values of understanding where their risk is and ultimately mitigating human risk with marketing terms. I said I'll try and pretend not to be a marketing person. We call it human-centric cybersecurity because that's ultimately what it is, right? It is protecting people.
Robby PeraltaYeah. They have this super complex uh environment now. And I guess they're if they were to get their shit together, you know, Proof Point would be struggling, CrowdStrike, all these uh other companies that we know and love would be.
Matt CookeBut would I would they? I mean, I and again, I I wrestle with this one because I think about that and I think actually, would they? If they really did, you know, if they really, really did a really good job, are we as cybersecurity professionals happy to put all of our eggs in one basket and say, do you know what Microsoft to have everything and become now not only the platform that we use, but we're the platform that to protect the platform that we use. And I I don't know, I I think I see that. Yeah, I think that becomes a problem.
Robby PeraltaBut it but we both can agree that people are gravitating towards a platform plate now.
Matt Cooke100%.
Robby PeraltaYeah, no, 100%. But then your point stands even more importantly than you should use something else to secure if you're putting everything in the platform.
Matt CookeYeah, no, absolutely. I mean, you you're a salesperson, right? You understand that at the minute people are looking at consolidation, they're saying, actually, can I reduce the number of vendors that I work with and and get actually these in the larger platforms in order to protect my organization? And to a certain degree, we see a lot of that happening with, I guess SASE is kind of one industry where that's kind of happened, where you know, zero trust is come kind of combined into Sassy, and people are looking at, hey, have I got one platform play there? Maybe on EDR you mentioned CrowdStrike, you know, Sentinel One and all those other good vendors that are doing some great stuff on the endpoint. That's almost a platform play there as well, from an EDR or managed um detection response XDR type stuff. And then you've got what we've just described as human-centric cybersecurity as well. And I think that's the third platform.
Robby PeraltaThey say uh identity is a new perimeter. How does identity have uh relation to human-centric security?
Matt CookeIt comes in a number of a number of ways. So one is you know, account takeover is a real problem. The biggest source, I guess, of account takeover is usually credential phishing. You know, we see things like multi-factor authentication phishing kits being used where you know we all thought that that token would prevent people taking our account over, but actually it doesn't. You know, when we see some of these reverse proxy phishing attacks, we're actually logging into the main websites and they're just stealing our session tokens and taking our accounts on from there. So that's a problem. And so again, we're hooking in via APIs into Microsoft and actually working out to say piecing it all together, say phishing came in. We know Matt clicked on phishing link. After Matt clicked on phishing link, a rule was set up in Outlook that says redirect emails to this place or something along those lines, or maybe a login happened from this particular site, or even another one, a third-party application. You know, those plug-ins to Outlook that we love to use, like to schedule a meeting or to book a Zoom or whatever it happens to be, when those those accounts we see we see those apps kind of getting compromised, then
Importance of Email Authentication Standards
Matt Cookeactually getting have permissions to the accounts as well. So being able to monitor that all forms part of the human-centric story because we need to control identity.
Robby PeraltaAnd identity's at the center, yeah.
Matt CookeAnd identity is at the center. And it actually then goes beyond that as well, because if you get to the point where, you know, all right, my account's got compromised. I've got a small problem. We now need to stop that small problem becoming a much bigger problem. And the attacker ultimately is going to look to try and escalate privileges on the device, move laterally within the organization before it then moves on to data, because it then finally gets into data loss. And and you know, data loss also forms part of that whole human century piece as well.
Robby PeraltaI want to come back to data loss, but I had a colleague, he told me that I had to ask you about so I don't I keep forgetting what it was. It's probably because I don't understand it, but it's uh, you know, DMARC, DKIM, SPF, these things. What what what's happening in the world right now that makes those important?
Matt CookeSo these are these are email authentication standards, right? And what they allow us to do is to say, okay, that email that we've just received, it came from a place that we know it should have come from. In other words, this isn't somebody trying to spoof and trying to send emails on our behalf from a domain. You know, is that a valid sender? Is it has it come from a valid host? We can we can check all of those things before we let that message appear in your inbox.
Robby PeraltaIf those standards are in use.
Matt CookeIf those standards are in use and applied correctly, yes, because that's another big part of it. And they've been about for a little while, actually. Um, and uh to the point where a lot of governments actually around the world and kind of national security and cybersecurity agencies and governments turn around and said, Hey, all our government departments, you have to be doing this. And um, and and some countries took that on board and some countries didn't. Like Denmark, for example, did an awesome.
Robby PeraltaI was just gonna say Denmark did that, yeah.
Matt CookeThey did. I think it was like 2020, maybe even before slightly before that, that they came out and said, Hey, you know, government uh institutions, you need to actually start enforcing this because we need yeah, we want to take advantage of that. And what it does, it it both basically you know it prevents people from spoofing domains, it prevents emails looking like they've come from somewhere but they that they haven't. And so that's a cool thing. The problem was uh industry didn't really adopt that very much. Um, yeah, it didn't massively take off. And I and I was I was complicated or something? What is it what's up what's up with that? Yeah, it's it can be a lot of there's a perception of risk around it, right? If you're a big business and you send emails, the last thing you want to do is break email. Because if you break email, that's a problem, right? Your phone is gonna ring, that's an impact to the business. In fact, we did some analysis back in January that the looked at the the Forbes Global 2000, right? So largest 2000 organizations around the world, only I think it was uh more than one quarter of the global 2000, they ultimately hadn't deployed DMARC to the right levels, and so that's a that was disappointing. And so what happened was Google and Yahoo at the same time, and also Apple, although they did it kind of quietly, came out with an announcement that said if you're gonna send emails to people on our platforms, if you're gonna send lots of emails to people on our platforms, you need to be using DMARC, you need to be authenticating your emails properly. They said a few other things as well around that, and it that gave a huge amount of organizations a kick up the backside to say we need to uh we need to deploy it. And so there was this big rush to try and get it done. I think it was before April before they that that those platforms turned around and said we're going to start rejecting emails at that point. And of course, if you think about it, if this is on Google, if it's on Yahoo, if it's on Apple, it's consumer. So it's really business to consumer type companies that we're talking about here. Um, but they had to do it and they did, right? Which is great. Um, that that made that was really, really good. Now the knock-on impact has been now these companies that can stand up and say, hey, we've done this authentication piece in our business-to-business conversations. We now want you to do that authentication piece. Because when you send me that those emails with those invoices for those pieces of wooden furniture for me as the retailer to send, I want to be sure that those emails are coming from your systems and they're not coming from anybody else. And so what we're starting to see now is organizations in their kind of supply and procurement contracts actually saying you need to do email authentication. And so we're at a point where email authentication and DMAX specifically has become not just a nice to have, it's become an essential part of kind of doing business. And so that's the perceived problem. It's not a problem, but it is a perceived problem. Um, it gives us that intelligence and ultimately it then feeds our overall picture as to what risk looks like for the business. Because now, in that same place of where you see all your people risk, you can actually see all the risk that's associated with your brand as well. You know, who's spoofing your brand out to the uh the outside world, and it gives you that great visibility into that as well. So if you haven't done it, do it. Um, definitely look at it. It's it's in some cases it's a zero cost um thing. Um, in other cases, you can work with companies like Proof Point and others to to help you do it um without the risk. Um and it will make a huge difference to um to your risk profile. Um, not only just the the messages that you're sending and the way your brand can be abused, but also how you know enforcing it on the inbound as well um can make a big difference.
Robby PeraltaUh who was that? I forgot who said it, but like, don't be a digital asshole, fix your DMARC.
Matt CookeYeah, and we we talk in security about doing the basics, right? We always talk about that. Like people say, oh, you know, the do the basics, just make sure you you're keeping your patches up to date, you know, patching those vulnerabilities, make sure you've got a firewall running, just do all those basic things. I kind of feel like email authentication is one of those basics now. Yeah, just don't be a doofus. Do demail. Right.
Robby PeraltaUh architecture recommendations that you typically give your clients. What does that look like these days?
Matt CookeI think the vast majority of clients that we talk to, most of them are probably using Office 365, unless they've got some kind of reason that they can't. Um, that then maybe they're running their own mail servers on premise or whatever it happens to be for confidentiality, jurisdiction, what whatever that happens to be. Um what we tend to talk about when we're talking about architecture is we talk that overall story of that pre-delivery. It's basically the journey of an email, right? It's like what happens before it comes in, what happens once it's in, what happens when it's been set on the inbox and someone's interacted with it. So that pre-delivery, post-delivery, click time. And so for us, when we we talk about email security as a platform, we do talk about those kind of three steps and making sure that you've got all those three steps covered in your security architecture rather than just one of them, which seems to be the most popular um, you know, with a lot of organizations, which is that they just reliant on post delivery, which is for those reasons we talked about earlier, that you know, people interact too quickly with emails, seems mad. Um, so definitely um, you know, that thinking about the journey, the lifecycle of an email email, and and making sure that you you're covering all the basis is kind of key in that architecture flow, I guess.
Robby PeraltaAll right. So we've talked about AI, threat intelligence. Combine those two. What's the future of email security look like? I would assume it's something to do with those two.
Matt CookeYeah, I think you're right. Um, we don't know how the attacks are going to evolve. Um, but we've kind of got a good feel for what those techniques look like. We also know that actually that probably the hardest attacks to stop are the ones that are just the words. If there's something malicious in there, it's easy. We say it's easy, but you know, we can find it. Um, so we need to work out how you know how attackers are getting creative and we need to stay ahead of that. But we also need to think about you know what happens after the fact, you know, what happens after bang. Um, and often it's around data loss. We talked about you know email security as a platform, we talked about human-centric security ultimately being that platform. Data loss forms a big part of that, and I think that's where a lot of where the future is going. Working out actually, does Matt regularly email Robby? And if if I was maybe, maybe do I regularly email you invoices, do I regularly email you attachments with lots of customer information in? Um, you know, did I try and send you that email by mistake? Because we have all done this thing where you've tried to send an email to Matt, you've typed Matt in, and it ended up going to the different Matt, the wrong map. That happens all the time. Or you put the wrong attachment on the email and you send the whole file instead of the subset of the data that you wanted to share. And so where that falls an hour under the banner of email security, picking that up and saying, actually, did you mean to send that to Matt? Because normally you send it to the other map and like maybe you should just change that.
Robby PeraltaSo they'll stop it at one, yeah.
Matt CookeExactly. So we stop it when you send it. Because you it's a problem for everyone. We've all done that misdirected email. And in fact, here in the UK, um, we have the information commissioner's office, right? Which is so if anyone has a data breach or anything like that, they have to report it to the information commissioner. That's the kind of setup here. And they put a report together every quarter that says, you know, how do people lose data? And every quarter at the top of the list is misdirected email. It's it's again, it goes back to being a human problem. It goes back to being a human-centric problem. It's us like, I mean, it's not a problem, it's just it's just the way the technology is built. It allows us to send things to the wrong place, it shouldn't do that. Also, what that has the added benefit of is hey, Rob, Robbie, you're leaving the company right now. You've just emailed the company's contact database out to your Gmail account. Being able to stop those types of exfils as well. Um, did you really mean to do that? Um, and that helps us kind of understand the overall picture and uh protect against simple, the simplest and most common form of data loss, which is um yeah, misdirected email. Mr. Cooke, do you have any closing uh closing thoughts?
Robby PeraltaI would just implore people to take a look, just to rethink email security. It it isn't one piece of technology anymore, it is human-centric security. And and to actually almost use human-centric as the lens that they look through when they're examining their security operation. Hmm. Well, human-centered security. Talk to proof point. Awesome. And mnemonic, hopefully. Thank you so much, Mr. Cooke.
Matt CookeCool. Thank you, sir.
Robby PeraltaHave a great summer and uh we'll talk soon. Awesome. Thank you. Well, that's all for today, folks. Thank you for tuning in to the mnemonic security podcast. If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to nemonic.no. Thank you for listening, and we'll see you next time.
