Last week, we announced comprehensive protection for Business Email Compromise and the deepest visibility into advanced email attacks. Today, we’re pleased to deliver new, simplified impersonation controls in the latest release of Symantec Cloud Email Security! With Business Email Compromise fraud on the rise and becoming increasingly dangerous by using advanced techniques such as machine learning to drive successful attacks, these capabilities help Symantec defend your organization from Business Email Compromise, spear phishing, and other spoofing threats with the strongest protection and visibility.
Comprehensive Protection with New Impersonation Controls
Let’s understand how these controls work. First, we uncover scams impersonating an end-user in your organization with user impersonation controls. You can either protect groups of users or focus on specific users that are more likely to be spoofed (see Figure 1). This comes in handy, since many Business Email Compromise attacks pretend to be senior executives such as your CEO or COO. Furthermore, these controls include protection from user impersonation attacks leveraging free email providers such as Gmail or Yahoo. For instance, we stop threats that claim to be from an executive’s personal email account such as ‘Joe_CEO@gmail.com’.
Figure 1: User Impersonation Controls
Next, we detect Business Email Compromise threats that masquerade as legitimate email domains in your organization through domain impersonation controls. This includes scams that use cousin or lookalike domains (think ‘@Symanlec.com’) to trick users into falling for them. Similar to user impersonation controls, you can have this protection apply to all of your domains or just certain selected domains (see Figure 2).
Figure 2: Domain Impersonation Controls
Both user and domain impersonation controls are powered by our sophisticated impersonation engine, which easily sniffs out Business Email Compromise attacks that evade detection by traditional email security solutions. Moreover, you can exclude trusted senders from these controls by whitelisting specific users, domains, and IP addresses. This includes third-parties that send email messages on your behalf (See Figure 3).
Figure 3: Approved users, domains, and IP addresses
Deepest Visibility through Reporting and Analytics
In addition to these simple, yet powerful controls, we provide visibility into Business Email Compromise fraud through dashboard and detailed reporting on these threats (see Figure 4). These reports help you better understand schemes targeting your organization as well as fine-tune protection against Business Email Compromise through insights into these scams. This visibility also includes rich threat intelligence on malicious emails that provide deep visibility into Business Email Compromise attacks with data points such as subject lines, email senders, and email recipients.
Figure 4: Dashboard Reporting on Business Email Compromise
We’ve expanded this visibility through advanced email security analytics on both clean and malicious emails, which will provide more visibility than ever into Business Email Compromise. For instance, you can get information such as email domains and headers used in Business Email Compromise scams.
Additional Protection with Sender Authentication
Although relying on sender authentication such as DKIM, SPF, or DMARC to block Business Email Compromise is often ineffective, there are certain scenarios where these tools can help. Therefore, Symantec enables customers to use these open-source standards to block Business Email Compromise via support for SPF and DMARC (which includes SPF and DKIM) authentication (see Figure 5). Note that these methods are only effective for schemes that directly spoof an email sender. In addition, these standards also help protect your brand from threats that try to spoof your email domains.
Figure 5: SPF and DMARC settings in Symantec Cloud Email Security
Unparalleled Security and Insights for Business Email Compromise
When combining the new user and domain impersonation controls, detailed reporting and analytics, and sender authentication tools, Symantec provides the strongest protection and visibility for Business Email Compromise. Most importantly, while other vendors require a lot of tuning to get their Business Email Compromise protection to work with hand-holding required, the Symantec solution has low false positives and simple, out-of-the-box setup. No other vendor offers both this level of security and insights into Business Email Compromise with low false positives and easy configuration. Moreover, we’re always enhancing and improving our solution to evolve with the changing threat landscape and help you stay ahead of the latest threats.
To learn more about the Symantec solution for Business Email Compromise and to see our new impersonation controls in action, join our webcast on August 30! In addition, please see the above video to learn more about Business Email Compromise, including how these attacks work, why they are successful, and how to defend against these threats.
Follow us on Twitter: @SymantecEmail
Join the Symantec Email Security Community