Share:

Guest Author: Edward Amoroso, Chief Executive Officer & Analyst, TAG Cyber

For over a decade, a quantitative index hosted at NYU’s Center for Cyber Security (CCS) has been used to measure the sentiment of expert practitioners across a range of cyber threat and enterprise security issues. While the index value has increased continually over the years, which indicates growing concern among the participating experts that threats are increasing, significant spikes in any measured attribute have rarely occurred – until recently.

Since early 2020, the NYU research team has measured increased concerns regarding email security risk, and, in particular, with phishing messages reaching user in-boxes. This result might seem somewhat expected, given the increased number of people working from home during the COVID-19 pandemic. But enterprise teams routinely include world-class commercial security solutions such as secure email gateways (SEGs), so this seemed inconsistent with the sentiment spike.

Working with the phishing defense experts from Leesburg-based Cofense, Dr. Edward Amoroso, head of research advisory company TAG Cyber, which helps to administer the NYU CCS index, sought to investigate what was going on. A brief survey was constructed and shared with a dozen experts operating secure email infrastructure. Each was asked whether, and how frequently, phishing attacks were finding their way past their existing email defenses, all of which included a SEG.

The results were interesting: fully half reported that potentially dangerous phishing messages reached employee in-boxes roughly once per week, and the other half reported not having sufficiently accurate data to even answer the question. Frankly, both of these answers seemed disturbing – even though they helped to explain the spike in the NYU index. Clearly, something troublesome has been going on recently with email security.

Aaron Higbee, Cofense CTO and Co-Founder, and Tonia Dudley, Cofense Security Solutions Advisor, shared their own approach to this growing problem during a recent webinar jointly hosted by TAG Cyber. In short, the Cofense solution introduces a human layer of protection to complement existing defenses to create a more defense-in-depth model for addressing phishing risk. The human aspect is enhanced in the Cofense approach using crowdsourced support, which results in complementary intelligence about email threats. It seems a sensible addition.

What you’ll find from the discussion during this recent webcast is that while traditional firewalls and other security gateway devices are important parts of a layered defense, they are obviously nowhere near sufficient to protect an enterprise. The Cofense team believes, and makes the strong case, that SEGs also benefit from the introduction of additional complementary protections – which involve the human-oriented controls mentioned above.

If you’re like the experts who respond to the NYU CCS index, then you are feeling increased stress about phishing risks to your enterprise. This suggests that adding some sensible security controls into a multilayered protection solution would be advised.

Learn more about how Cofense helps organizations by combining the power of human detection with automated response, enabling your teams to stop phishing attacks in minutes.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.