Personal email:Pathway to Cybersecurity Breaches

Cloud Computing on CNBC – $100B market

By G C Network | May 28, 2008

Google’s Head In The Clouds Follow me at https://Twitter.com/Kevin_Jackson

IBM Blue Cloud

By G C Network | May 28, 2008

A short news interview on the IBM Blue Cloud . Follow me at https://Twitter.com/Kevin_Jackson

Amazon’s Cloud Overtakes Websites

By G C Network | May 27, 2008

May 27, 2008 See NY Times article, Cloud Computing: So You Don’t Have to Stand Still Follow me at https://Twitter.com/Kevin_Jackson

May 1 IBM, Google Partnership Announcement

By G C Network | May 27, 2008

In this video, IBM and Google announce their joint cloud computing initiative. As I said in my earlier post, Google and IBM have teamed up to provide a “Google-like” infrastructure.…

“The Missing Piece in Cloud Computing”

By G C Network | May 27, 2008

First Software as a Service – SaaS…Then Hardware as a Service – HaaS…Now, Middleware as a Service – MaaS? GigaSpaces’ CMO Geva Perry will be presenting on middleware virtualization at…

How the NRO can leverage Cloud Computing

By G C Network | May 26, 2008

Last Thursday, May 22nd, I had the pleasure of attending an Intelligence Community Executive Forum hosted by Carahsoft. The topic of this forum was “”Innovative Technology for the Intelligence Enterprise”.…

Green Cloud Computing

By G C Network | May 26, 2008

The other day I was asked “Why is cloud computing considered green?” Wouldn’t you know, The Economist provided the perfect answer. “In future the geography of the cloud is likely…

Oracle in the Cloud

By G C Network | May 25, 2008

Oracle (NSDQ: ORCL) is building new data centers to support cloud computing. The company is investing $285M and will break ground on the 200,000-square-foot facility this summer. Oracle’s president Safra…

Explaining Cloud Computing

By G C Network | May 23, 2008

In the video Explaining Cloud Computing Christopher Barnatt, author of ExplainingComputers.com, and Associate Professor of Computing and Organizations in Nottingham University Business School, provides a very understandable explaination of cloud…

Cloud Computing supports Net-Centric Warfare

By G C Network | May 23, 2008

Netcentric warfare theory contains the following four tenets in its hypotheses: 1) A robustly networked force improves information sharing;2) Information sharing enhances the quality of information and shared situational awareness;3)…

As a business communications tool, email is the dominant option, and many corporations have policies that allow the use of personal email on corporate computers. In a recent Adobe Systems commissioned online survey of 400 U.S. white-collar, adult workers, more than 90 percent of them admitted checking personal emails at work. The workers questioned in the poll estimated they spend 6.3 hours a day checking emails, with 3.2 hours devoted to work emails and 3.1 hours to personal messages. Nearly half of the respondents also said that their use of emails for work will increase in coming years with 19 percent saying it will go up substantially.

Employers generally have the discretion to monitor and restrict employees’ personal computer usage as they see fit and, in most cases, email messages are not subject to any personal privacy laws. But even with these stipulations, Dell SonicWall channel partner Michael Crean, President and CEO of Solutions Granted, says that allowing personal email on corporate PCs is just not worth the risk. Solutions Granted, a small veteran-owned business, is certified as a SonicWALL Managed Security Service Provider. According to Crean, the threat of malicious attacks and subsequent remediation cost far outweighs any gain from allowing personal email access. “If your employees need to check their email in the car, they use their personal phone. So why can’t they do the same at work?”

Email phishing, the attempt to acquire sensitive information for malicious reasons by masquerading as a trustworthy entity, is a significant cybersecurity threat.

“In one incident investigated by Dell SecureWorks, attackers phished an employee at a manufacturing company to obtain the login credentials for the company’s Citrix platform. The attackers were able to use the credentials to connect to internal corporate resources, then move laterally through the network and harvest intellectual property using the company’s Altris platform, which remotely distributes new software and patches to all the endpoints.”

The most sophisticated attacks are grouped in two categories:

  • Indirect Phishing Attacks –attackers direct a series of emails, usually in combination with organizational information from other sources such as LinkedIn, that add up to a successful phishing campaign. An example would be an employee being tricked into giving away Yahoo credentials as part of an attack, which can give access to contact or calendar information. Another example would be an employee with a cloud-based company email (i.e. Office 365 or Gmail for Business accounts) could be successfully phished. This could give the attacker a platform for sending malicious emails that appear safe.
  • Direct Phishing Attacks – Cybercriminals seek login credentials for actual business systems. During Q2 2015 security analysts found multiple examples of phishing attempts on Outlook credentials. Aside from email access, these credentials are frequently used for domain logins, providing an attacker with access to other cloud-based services, such as Dropbox or Salesforce. This sort of breech could also provide an attacker with direct access to corporate proprietary information.

Phishing is often described as spam and, according to Secure List, generally followed the same template:

  • Very little text (the email generally contains a typical header consisting of several words which is exactly repeated in the body of the message)
  • One or more links which load a brightly decorated picture (sometimes in parts) with all the necessary advertising data (a more detailed advertising text plus contacts: website address, phone number, company name)
  • Another long link that leads to a resource that corresponds to the content of the email
  • Additional ‘white noise’ text to bulk out the email

The white noise text consists of random phrases or single words in any language which may not be the same as the language of the mass mailing. This text is generally invisible to the reader of as it is written in white or pale color on a standard white background.  Email is also often used to distribute malicious attachments in Microsoft Word or Excel.

Phishing is an equal opportunity threat with “Global Internet Portals”, which include email and search portals taking the brunt of the attacks. As a trusted advisor to their customers, Solutions Granted recommends the following:

  • Severely restrict or eliminate employee access to personal email via company-owned assets;
  • Don’t let preferences of your human resources team overrule the need for IT security; and
  • Use industry proven cybersecurity technologies and best practices.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.

Cloud Musings

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2015)

Follow me at https://Twitter.com/Kevin_Jackson
Posted in

G C Network