Story image

25% of malicious emails still make it through to recipients

12 Dec 18

Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.

The company’s latest quarterly Email Security Risk Assessment (ESRA) found that out of the 181.9 million emails scanned, 21.2 million spam emails were not picked up by organisations’ email security systems.

Those email security systems also missed more than 25% of emails containing dangerous file types .jsp, .exe, .dll, and .src.

Mimecast says these file types are rarely sent by email for legitimate purposes and they are often used to conduct an attack.

The report also found 21,183,014 spam emails, 17,403 malware attachments, 42,350 impersonation attacks and 205,363 malicious URLS, all of which were missed by email security systems. 12% of all secured and filtered email were unwanted emails, so they were false negatives.

“Attacks we are seeing include key executives being targeted with cloud storage services exploits, impersonation attacks targeting legal, finance and administrative assistance as well as social engineering attacks against the C-suite,” explains Mimecast security service director Lindsay Jack. 

“Mimecast has seen an increase in security efficacy versus legacy vendors along with detailed information on the proliferation of threats of all types. The ESRA provides deep insights for our customers on the types of attacks threatening their business.”

Mimecast cybersecurity strategist Matthew Gardiner adds that criminals are constantly adapting email-based attacks.

Criminals are looking for new ways to bypass security solutions that rely too heavily on signature-based files or reputation-based detection.

“Mimecast uses multiple layers and types of detection engines, combined with high performance analytics, a diverse set of threat intelligence sources, and computer aided human analysis to identify and stop unsafe emails from getting into our customers’ inboxes.”

Mimecast determined that 160.6 million of the emails it analysed were safe. This quarter’s assessment found that these email security systems are missing more than 25% of emails containing dangerous file types in comparison to last quarter’s findings.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.