Work Traveling - You’re a Prime Hacker Target

As if the stresses and headaches of business travel weren’t enough, there’s one more thing to worry about while traveling in unfamiliar places: the security of your email. 

Thanks to the rapid ascent of spy-mail, email that secretly reveals a recipient’s location and behavior when it is opened, criminals can invade an out-of-office executive’s inbox to steal confidential information.

According to an FBI public service announcement issued in June, there has been a 1,300% increase in losses tied to “business email compromise” since January 2015. Although any company is at risk, these attacks are most likely to target firms that regularly send money overseas or those that have access to sensitive information, such as medical companies, attorneys, and accountants. To date, instances have been reported in all 50 US states and in 100 countries, amounting to a financial impact of $3 billion.

For the most part, these successful attacks are not the result of Cyber criminals blanketing companies with malware-laden links or attachments and hoping for a click (as was often the case in the past). Instead, infiltrating a corporate network and siphoning off sensitive data is about meticulously gathering information over an extended period, and then using that information to launch a precision strike targeted at one or two employees. One way this information is being gathered is via spy-mail, a regular email with a hidden tracking code.

Here’s how it works. Each time a traveling executive opens spy-mail, they reveal a wealth of private information, their current location, the time of day they read their email, the hotel at which they are staying. Scammers can use this information to craft believable phishing emails or phone calls, targeting the executive or their unsuspecting colleagues back at the home office. 

Because spy-mail looks like any other email, the receiver is unable to determine which emails are tracked with the invisible extension, making cybersecurity on the road much more difficult to manage.

Say, for instance, an executive opens a spy-mail while meeting with a supplier in a politically, economically, or socially unstable country. Knowing that the business leader is in a volatile part of the world, malicious third parties can formulate an attack by harnessing the fear and uncertainty that accompanies such travel. 

The attack may include, for example, spoofed emails from the executive abroad, saying that they are in a dangerous situation (e.g., there has been a terror attack, they have been kidnapped, etc.) and need money. In an extreme case, information gathered through spy-mail can be used to plan an actual kidnapping. According to one report, there are 40,000 kidnap-and-ransom cases each year, many of which involve executives on business travel.

Malicious actors also use the fact that an executive is out of the office to dupe their person’s coworkers into sending corporate files or other sensitive data. Earlier this year, companies including Advanced Auto Parts and Snapchat fell victim to fraudsters posing as company leaders, who pilfered employee W-2s and used them to file fraudulent tax returns. Information captured by spy-mail can help hackers can send believable emails, with the correct sender, recipient, context, and time-stamp, to an executive’s HR department or payroll vendor, asking for confidential records at a time when they know the executive won’t be around to detect it.

How can companies avoid an email-borne crisis? No corporate cybersecurity strategy is complete without a plan for safeguarding the organisation’s data when business leaders are away. And simply banning executives from checking email when traveling, even if it isn’t a work-related trip, is not a realistic solution. As the email threat landscape evolves, organisations must adapt their defenses accordingly. 

Here’s how:

Train for awareness. Employees can’t guard against Cyberattacks if they are ignorant of the threats that surround them. Offering periodic, engaging training that defines spy-mail and phishing from an end-user perspective, and that illustrates the ramifications of each, is a necessary step toward making employees more vigilant. According to PWC and KPMG, only 53% of companies have employee security-awareness and training programs, and only 50% of CEOs feel prepared for a cyberattack.

Establish executive travel email protocol. No IT manager will successfully unchain the C-suite from their inboxes, even when on vacation. Organizations should, however, implement policy controls to identify and mitigate the risk of spy-mail and phishing attempts while executives are on the road. For example, finance departments should outline a protocol that executives must follow in the event that they need to request money while traveling. When a request comes through that doesn’t adhere to the set protocol, the scam is less likely to succeed.

Add an extra layer of inbox security. When traveling, business leaders need to be focused on the task at hand, not on safety and Cybersecurity issues. Adding spy-mail protections to conventional spam filters and firewalls can help safeguard company data and give traveling executives peace of mind.

As companies are learning the hard way, email scams are a growing problem, resembling bank heists in the amount and sophistication of the intelligence gathering that goes into them. 

Knowing when and where executives are traveling and emailing is a necessary piece of information for many of these attacks. By training employees, putting appropriate travel policies in place, and adopting the latest security software, companies can reduce the risk of falling victim to one of these attacks.

HBR
 

 

« DDoS: Deceptive Denial Attacks
2016 Trends in Cyber Crime »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

SealPath

SealPath

SealPath enables companies to protect and control their documents wherever they are: In their PC, in their corporate network, on a partner’s network, in the cloud.

Quttera

Quttera

Quttera provides Website Security Solutions for Small & Medium Businesses, Enterprises and Organizations.

Maximus Consulting (MX)

Maximus Consulting (MX)

Maximus designs and delivers corporate-wide information security management system with our full-time IRCA Accredited consulting team.

ITRenew

ITRenew

ITRenew is a leading global IT lifecycle management solutions company, specializing in onsite data center decommissioning and data erasure services.

Secure IT Disposals

Secure IT Disposals

Secure IT Disposals specialise in professional Computer Recycling, Computer Disposals, Computer Destruction, Data Erasure and end-of-lifecycle solutions.

M12

M12

M12 (formerly Microsoft Ventures) is the corporate venture capital subsidiary of Microsoft.

Everbridge

Everbridge

Everbridge provides enterprise software applications that automate and accelerate organizations’ operational response to critical events in order to keep people safe and businesses running.

The Citadel Department of Defense Cyber Institute (CDCI)

The Citadel Department of Defense Cyber Institute (CDCI)

CDCI is established to address the critical national security needed for a skilled cybersecurity workforce.

Tide Foundation

Tide Foundation

Tide's breakthrough multi-party-cryptography enables TRUE-zero-trust technology that unlocks cyber-herd immunity.

Entara

Entara

Entara (formerly YJT Solutions) is an eXtended Service Provider (XSP) focused on providing cutting edge technology and cyber security solutions to companies in regulated industries.

Rolls-Royce Cybersecurity Technology Research Network

Rolls-Royce Cybersecurity Technology Research Network

Rolls-Royce has partnered with Purdue University and Carnegie Mellon University to create the Rolls-Royce Cybersecurity Technology Research Network.

Topsec Cloud Solutions

Topsec Cloud Solutions

The Topsec Managed Email Security Platform eliminates Spam, Viruses, Malware, and Phishing.

eCloudvalley Digital Technology

eCloudvalley Digital Technology

eCloudvalley Digital Technology is a born-in-the-cloud partner focused entirely on AWS services across APAC region.

Exalens

Exalens

With deep roots in AI-driven cyber-physical security research and intrusion detection, at Exalens, we are enhancing operational resilience for cyber-physical systems at the OT edge.

Triangle

Triangle

Triangle enable innovative business transformation by ensuring critical hybrid infrastructures are optimised, interoperable and secure.

dWallet Labs

dWallet Labs

dWallet Labs is a cybersecurity company specializing in blockchain technology. We believe that the future of Web3 relies on cutting edge cryptography and unabated security.