If a group of criminals wanted to rob a bank, they’d need to hatch a plan that exploits security gaps in the bank’s daily operations. Maybe they’d scout out daily business activities. Someone on the inside might need to divulge information, whether that person was a paid informant or a member of the criminal group itself

Organizational cybercrime isn’t much different. Hackers gather intel that they can use to carry out future attacks. And one way they do that is by lingering in compromised email accounts after they have exploited them.

How Useful Email Is to Hackers

Partnering with UC Berkeley, Barracuda Networks conducted a study on corporate email hacking and discovered that about one-third of hacked accounts continued to experience attacks for more than one week. It appears the goal of these attacks was to monitor email exchanges so they could mimic typical communications in spear-phishing campaigns.

In some cases, the data retrieved in these monitoring activities might also be sold to other hackers online, enabling these hackers to create additional breaches.

Barracuda noted some alarming inferences from this report. Almost 80% of attacks involved no applications outside of email. At first blush, that might seem hopeful; maybe hackers weren’t able to access any other applications. However, it also could mean cybercriminals were able to find everything they needed given how heavily employees rely on email to store and transfer sensitive information.

What You Should Do About It

It’s clear that businesses need to establish and enforce safe and secure email practices. Organizations who can get their employees practicing good security hygiene will be in a much more secure position than others, even if hackers do find their way into their email system.

Let’s start with the basics. Employees should typically be made to follow some ground rules:

1. Don’t send sensitive information over email.
2. Don’t open attachments from sources you don’t recognize
3. Double-check the sender’s information before you click any links or download anything. You need to be sure it’s coming from a legitimate address, not one designed to spoof such an address.
4. Understand spear phishing. Attacks can look more legitimate than ever in current times. Think about what someone is asking you to do; don’t just follow their request.
5. Protect co-workers’ addresses. Don’t forward them indiscriminately, as this can lead to data leaks.

There are, of course, other aspects of email protocol to consider. If you need to get your employees trained for the times, Lunarline can help. Contact us today to learn more.