Actu
New Mimecast Service Disarms Spear Phishing Threat
April 2014 by Marc Jacob
Mimecast, a cloud email security provider, has announced Targeted Threat Protection a new service to protect enterprises from the growing risk they face from spear phishing. These are targeted attacks using embedded malicious URLs or links in email that appear to come from a ‘trusted’ or known individual that then compromise an organisation’s security when clicked. Mimecast Targeted Threat Protection scans all URLs in inbound email every time they are clicked by the end-user to ensure the linked site is clean and risk free. If the user attempts to visit an ‘at risk’ site, they are warned or automatically barred from viewing it. This protection will be provided on all devices used for their enterprise email account including smartphones and tablets whether they are provided directly by the employer or not. Mimecast Targeted Threat Protection will be available in July.
This new service is easy to manage for IT and security teams, as it’s controlled from a single Administration Console alongside other Mimecast services. They also get full logging and visibility of blocked links and sites to assist them with ongoing threat management, reporting and any end-user education designed to reduce future risky online behavior.
Security scanning or gateway services like Mimecast have made it hard for traditional spam or phishing attacks to target enterprises. As a result, determined attackers are increasingly using sophisticated and targeted spear phishing emails. These emails are often created following social engineering reconnaissance that helps to make them look legitimate. Once a link in the email is clicked, it can take users to malicious webpages that trick them into giving away sensitive credentials or even exposes their systems to malware.
Spear phishing attacks are designed to defeat even the most sophisticated security defenses. These attacks can pass through existing security gateways as the emails and embedded URLs are initially inactive and therefore clean when scanned. Phishing web content is activated later when the attacker knows all gateways have passed the email and link. Several major data breaches and hacking attacks have been initiated through the use of spear phishing or targeted email attacks of this kind.
How Mimecast Targeted Threat Protection works
Mimecast rewrites URLs for all inbound emails - when the end-user receives an external email containing a URL, Mimecast rewrites the link at the gateway so when it is clicked, they are directed to the Mimecast cloud where the original link is checked for risks before being opened. If the link is safe, they won’t even notice the check has happened as the site will appear to open as normal.
Links are scanned every time they are clicked to ensure they are safe - a check is done every time a link is clicked on not just the first time. This is done for all links in every email whether the sender is ‘known’ or not. Wholesale protection of this kind is more safe and effective than attempting to detect a single phishing email and recognises that links can start safe but be compromised at a later date.
Links are safe on any device used to access them - Targeted Threat Protection provides the same protection whether the end-user is accessing a link in their enterprise email from their work or personal mobile or desktop device.
Benefits of Mimecast Targeted Threat Protection
For end-users:
Peace of mind knowing all links clicked on in email are protected - every email is scanned and every link is protected. If they do click on something malicious they know their data and systems are protected.
No interruption to how they work - they will hardly notice the scanning if the link is safe. The site will open as normal in the browser.
Automatic blocking, and clear warnings and guidance if a malicious link is clicked- Mimecast will block any bad site and let them know, giving them options on what to do next based on their security profile set by the IT team.
For IT Teams:
Simple and comprehensive protection against spear phishing for all end-users without the need for additional infrastructure or staffing on-premise - this is a simple to activate service integrated into Mimecast’s extensive cloud email security portfolio. No additional equipment or resources are needed on-premise to manage this service.
Central administration and visibility for all email security issues from a single Mimecast Administration Console covering all services including Targeted Threat Protection - administrators can also set different policies by end-user based on their security profile e.g. block outright any at risk site or offer a warning page to alert more informed users.
