# Digital Security Workshop Email

## March 2025

# Contents

- Introduction • Cyber Landscape
- Protecting Email • Securing Cloud Email
- Protecting Against Compromised Accounts • DMARC
- Blacklisting and Breaches • Email from Devices and Software
- Visibility • Final Thoughts
- Discussion

# Introduction

# Who am I

- John King
- 021476622 • [john.king@thinking.net.nz](mailto:john.king@thinking.net.nz)
- 39 years in IT, 32 in Cyber Security

# Who are we and what do we do

- Cyber Security and Managed Services Provider • NZ and Australia predominant
- Purple Team
- Simultaneously test and defend the organization and its assets
- To improve the overall security posture and preserve the health of the organization over both the short- and long-term
- Specialise in OT (operational technology), Cloud and Identity
- Email • Authentication
- Cloud Migration

# What are we discussing today

- Protecting against spam, phishing and malware • Protecting against compromised accounts • Verifying that email is legitimate • How to check for blacklisting of my email and exposure to public breaches • Dealing with photocopiers, printers, other software and similar products • Reporting for visibility

# Cyber Landscape

# Threat Intelligence Summary

- An organization in New Zealand is being attacked on average 1489 times per week in the last 6 months.
- The top malware in New Zealand is FakeUpdates.
- The top malware list in New Zealand includes 4 Botnets, 1 Mobile (Anubis), 1 RAT (Remcos), 1 Infostealer (Anubis) and 1 Downloader (FakeUpdates).
- The most common vulnerability exploit type in New Zealand is Information Disclosure, impacting 55% of the organizations.

# Threat Landscape

- Cyber Wars – Nation-states are leveraging AI-driven tactics, including disinformation campaigns, destructive and disruptive malware, state-affiliated hacktivism, and financial warfare, to weaken trust in systems and sow chaos globally.

- Ransomware – Criminals are shifting from data encryption to data-leak extortion, with ransomware emerging as one of the most significant cyber threats to businesses worldwide in 2024.

- Infostealers – These malware attacks have surged by 58%, stealing credentials and sensitive data, impacting both individuals and organizations.

- Cloud - Misconfigurations and poor API security are leaving cloud environments exposed.

# Attacks per Organisation – last 6 months

- Recent work conducted by Thinking on a 20 seat organization saw the info inbox being brute force attacked 4 times a second continually.

### New Zealand APAC

3500 3000 2500 2000 1500 1000 500 0

#### Most Impacted Industries - Last 6 Months

# Protecting Email

# Why bother?

- Objections
- We are small no one will care about us • It’s too expensive
- Too much effort, I don’t have time • We have antivirus

# Reality

- Email is critical to business function • Cost of being without

# Where is your Email

- ISP based email is very hard to protect
- POP/IMAP/SMTP accounts
- On premise email is expensive to maintain • For SMB use a larger cloud provider
- Microsoft/Google/Zoho • Commercial security tools available for Microsoft and Google

# How to find out…

- [https://mxtoolbox.com/](https://mxtoolbox.com/)

# Legitimate Email

- Did I expect to receive it?
- Attacks are sophisticated.

# Securing Cloud Email

# Protecting Yourself

- Major providers have built in protection
- Usually it isn’t very good and requires administration.

# The Evolution of Email Security

### Inline AI

### Secure Post-Delivery Email Protection Microsoft

### Gateway 365

# Protecting Against Compromised Accounts

# Practical Steps to Reduce Exposure

- General
- NZISM Section 16 [https://nzism.gcsb.govt.nz/](https://nzism.gcsb.govt.nz/) • Strong password
- Unique accounts for users • Enable MFA – no argument
- Yubikeys for password less access

# DMARC

# Notes

- It's not a product • It’s a configurable standard that prevents email impersonation.

# SPF  
- [https://mxtoolbox.com/spf.aspx](https://mxtoolbox.com/spf.aspx)

# DKIM
- [https://mxtoolbox.com/dkim.aspx](https://mxtoolbox.com/dkim.aspx)

# DMARC
- [https://mxtoolbox.com/dmarc.aspx](https://mxtoolbox.com/dmarc.aspx)

# Blacklisting and Breaches

# What's my situation

- [https://mxtoolbox.com/blacklists.aspx](https://mxtoolbox.com/blacklists.aspx)
- [https://haveibeenpwned.com/](https://haveibeenpwned.com/)
- [https://www.knowbe4.com/free-cybersecurity-tools/email-exposure-check](https://www.knowbe4.com/free-cybersecurity-tools/email-exposure-check)

# What to do if I am breached

- Before
- Cyber Insurance
- Policies

# What to do if I am breached

- During
- Preserve data and act

# Email from Devices and Software

# Risks

- Older devices require the use of legacy protocols

# Printers..

- Put printers in VLAN’s

# Visibility

# Demos

- Look and see
- DMARC Portal • HEC Portal

# Final Thoughts

# Notes from the field

- Breaches are notifiable especially where private data is involved.
- Office of the Privacy Commissioner investigates.