Guest Author: Edward Amoroso, Chief Executive Officer & Analyst, TAG Cyber
For over a decade, a quantitative index hosted at NYU’s Center for Cyber Security (CCS) has been used to measure the sentiment of expert practitioners across a range of cyber threat and enterprise security issues. While the index value has increased continually over the years, which indicates growing concern among the participating experts that threats are increasing, significant spikes in any measured attribute have rarely occurred – until recently.
Since early 2020, the NYU research team has measured increased concerns regarding email security risk, and, in particular, with phishing messages reaching user in-boxes. This result might seem somewhat expected, given the increased number of people working from home during the COVID-19 pandemic. But enterprise teams routinely include world-class commercial security solutions such as secure email gateways (SEGs), so this seemed inconsistent with the sentiment spike.
Working with the phishing defense experts from Leesburg-based Cofense, Dr. Edward Amoroso, head of research advisory company TAG Cyber, which helps to administer the NYU CCS index, sought to investigate what was going on. A brief survey was constructed and shared with a dozen experts operating secure email infrastructure. Each was asked whether, and how frequently, phishing attacks were finding their way past their existing email defenses, all of which included a SEG.
The results were interesting: fully half reported that potentially dangerous phishing messages reached employee in-boxes roughly once per week, and the other half reported not having sufficiently accurate data to even answer the question. Frankly, both of these answers seemed disturbing – even though they helped to explain the spike in the NYU index. Clearly, something troublesome has been going on recently with email security.
Aaron Higbee, Cofense CTO and Co-Founder, and Tonia Dudley, Cofense Security Solutions Advisor, shared their own approach to this growing problem during a recent webinar jointly hosted by TAG Cyber. In short, the Cofense solution introduces a human layer of protection to complement existing defenses to create a more defense-in-depth model for addressing phishing risk. The human aspect is enhanced in the Cofense approach using crowdsourced support, which results in complementary intelligence about email threats. It seems a sensible addition.
What you’ll find from the discussion during this recent webcast is that while traditional firewalls and other security gateway devices are important parts of a layered defense, they are obviously nowhere near sufficient to protect an enterprise. The Cofense team believes, and makes the strong case, that SEGs also benefit from the introduction of additional complementary protections – which involve the human-oriented controls mentioned above.
If you’re like the experts who respond to the NYU CCS index, then you are feeling increased stress about phishing risks to your enterprise. This suggests that adding some sensible security controls into a multilayered protection solution would be advised.
Learn more about how Cofense helps organizations by combining the power of human detection with automated response, enabling your teams to stop phishing attacks in minutes.
