Digital Security Workshop Email

March 2025

Contents

  • Introduction • Cyber Landscape
  • Protecting Email • Securing Cloud Email
  • Protecting Against Compromised Accounts • DMARC
  • Blacklisting and Breaches • Email from Devices and Software
  • Visibility • Final Thoughts
  • Discussion

Introduction

Who am I

Who are we and what do we do

  • Cyber Security and Managed Services Provider • NZ and Australia predominant
  • Purple Team
  • Simultaneously test and defend the organization and its assets
  • To improve the overall security posture and preserve the health of the organization over both the short- and long-term
  • Specialise in OT (operational technology), Cloud and Identity
  • Email • Authentication
  • Cloud Migration

What are we discussing today

  • Protecting against spam, phishing and malware • Protecting against compromised accounts • Verifying that email is legitimate • How to check for blacklisting of my email and exposure to public breaches • Dealing with photocopiers, printers, other software and similar products • Reporting for visibility

Cyber Landscape

Threat Intelligence Summary

  • An organization in New Zealand is being attacked on average 1489 times per week in the last 6 months.
  • The top malware in New Zealand is FakeUpdates.
  • The top malware list in New Zealand includes 4 Botnets, 1 Mobile (Anubis), 1 RAT (Remcos), 1 Infostealer (Anubis) and 1 Downloader (FakeUpdates).
  • The most common vulnerability exploit type in New Zealand is Information Disclosure, impacting 55% of the organizations.

Threat Landscape

  • Cyber Wars – Nation-states are leveraging AI-driven tactics, including disinformation campaigns, destructive and disruptive malware, state-affiliated hacktivism, and financial warfare, to weaken trust in systems and sow chaos globally.

  • Ransomware – Criminals are shifting from data encryption to data-leak extortion, with ransomware emerging as one of the most significant cyber threats to businesses worldwide in 2024.

  • Infostealers – These malware attacks have surged by 58%, stealing credentials and sensitive data, impacting both individuals and organizations.

  • Cloud - Misconfigurations and poor API security are leaving cloud environments exposed.

Attacks per Organisation – last 6 months

  • Recent work conducted by Thinking on a 20 seat organization saw the info inbox being brute force attacked 4 times a second continually.

New Zealand APAC

3500 3000 2500 2000 1500 1000 500 0

Most Impacted Industries - Last 6 Months

Protecting Email

Why bother?

  • Objections
  • We are small no one will care about us • It’s too expensive
  • Too much effort, I don’t have time • We have antivirus

Reality

  • Email is critical to business function • Cost of being without

Where is your Email

  • ISP based email is very hard to protect
  • POP/IMAP/SMTP accounts
  • On premise email is expensive to maintain • For SMB use a larger cloud provider
  • Microsoft/Google/Zoho • Commercial security tools available for Microsoft and Google

How to find out…

Legitimate Email

  • Did I expect to receive it?
  • Attacks are sophisticated.

Securing Cloud Email

Protecting Yourself

  • Major providers have built in protection
  • Usually it isn’t very good and requires administration.

The Evolution of Email Security

Inline AI

Secure Post-Delivery Email Protection Microsoft

Gateway 365

Protecting Against Compromised Accounts

Practical Steps to Reduce Exposure

  • General
  • NZISM Section 16 https://nzism.gcsb.govt.nz/ • Strong password
  • Unique accounts for users • Enable MFA – no argument
  • Yubikeys for password less access

DMARC

Notes

  • It's not a product • It’s a configurable standard that prevents email impersonation.

SPF

DKIM

DMARC

Blacklisting and Breaches

What's my situation

What to do if I am breached

  • Before
  • Cyber Insurance
  • Policies

What to do if I am breached

  • During
  • Preserve data and act

Email from Devices and Software

Risks

  • Older devices require the use of legacy protocols

Printers..

  • Put printers in VLAN’s

Visibility

Demos

  • Look and see
  • DMARC Portal • HEC Portal

Final Thoughts

Notes from the field

  • Breaches are notifiable especially where private data is involved.
  • Office of the Privacy Commissioner investigates.