SecureMail: How SMEs can improve their email security

The National Cyber Security Centre (NCSC) reports weekly on phishing attacks by email, ransomware distributed by email, and spam, which at best only clog up email inboxes. Small and medium-sized enterprises are popular targets for cyber criminals. This is partly because they are generally less well protected than large companies, and partly because they lack internal cyber security expertise. This is why email security is the Achilles heel in the security arrangements of many SMEs in Switzerland. It doesn't have to be that way: SMEs can effectively protect their business-critical email communication, and thus their sensitive data, with just a few measures.

For many companies, email is the most important communication channel. This is why cyber criminals prefer to use email inboxes to penetrate IT systems and cause damage. The most common threat scenarios:

• Phishing: In this scam, cyber criminals send fake emails to trick recipients into revealing confidential information such as passwords or credit card details. The emails often look deceptively genuine and appear to come from a trustworthy sender. Read here how you can protect yourself against phishing.
• Malware: Cyber criminals send malware by email. One click on an attachment or link is enough for them to access the system, block it or delete, steal and sell data. They often demand a ransom to release the system or data. Read here how you can protect yourself against ransomware.
• Spam: Cyber criminals use junk mail to flood and block email inboxes, affecting the productivity of recipients. The mass emails are often phishing attempts or contain malware. Spam is therefore a risk to email security.
• Fraud: Cyber criminals send emails with false or manipulated invoices. In invoice manipulation fraud, for example, they send an old invoice with a new IBAN number or ask you to transfer the money to a different account in future. They work with social engineering tricks and refer to previous email communication, for example.

The consequences – from data leaks, financial losses and operational downtime to reputational damage – can threaten a company's very existence. Regardless of their size. Read here how you can protect yourself against hacker attacks.

Technical protective measures are an important part of a holistic security strategy. With these measures, SMEs effectively protect their email accounts and thus their data:

• Passwords: Strong passwords are the first line of defense in the security system and protect against unauthorized access to email accounts. A secure password is at least 12 characters long, varied (upper- and lower-case letters, numbers and special characters), random, unique and individual. Test how secure your password is here.
• 2FA (or MFA): Two-factor authentication provides an additional layer of security. To retrieve emails, a second factor is required in addition to the password, for example a security code on a smartphone. This makes access much more difficult for cyber criminals. Read here how you can protect your network and your data with 2FA and MFA.
• Encryption: Emails that are encrypted with PGP (Pretty Good Privacy) or S/MIME, for example, can only be opened and read by the correct recipient. There are also user-friendly services such as the GDPR-compliant SEPPmail, which was developed in Switzerland and Germany.
• Secure format: Only send and receive emails in secure formats and avoid HTML emails, for example. This is because cyber criminals like to hide malicious links or executable malware code in the HTML code.
• Image display: External content, such as images in HTML emails, can automatically load and execute malicious code. You should therefore deactivate the display of external content in your email program.

People are often the weakest link in the security system. This is why employee awareness and training are at least as important as technical protective measures. Well-informed employees significantly minimize the risk of cyber attacks. They must therefore receive regular training on how to recognize fraudulent emails, identify suspicious messages and react appropriately so that no damage is done. Possible training topics:

• Fake invoices: Employees learn how to recognize fake invoices and avoid falling for fraudulent requests for payment.
• CEO fraud: Employees learn how fraudsters who pretend to be CEOs, for example, operate, how to recognize such fraud attempts, and how best to report them.
• Phishing emails: Employees learn how to recognize phishing emails and are made aware of the special characteristics of this type of attack.
• Attachments and links: Employees learn how to safely handle attachments or links in emails in their work and thus minimize the risk of malware infection.
• Data privacy: Employees learn how personal data must be processed, stored and protected in accordance with the Swiss Federal Act on Data Protection and the European Union's General Data Protection Regulation, so that it does not fall into the wrong hands.

The whole is more than the sum of its parts. Individual measures are effective but only unleash their full power when they work together. With the right measures, even small or medium-sized companies can increase their email security with relatively little effort. This includes, for example, the use of strong passwords and two-factor authentication for email accounts, the encryption of emails, restriction to secure formats, and awareness-raising and regular training for employees. In addition, SMEs should also introduce data protection guidelines and continuously monitor their systems for suspicious activities.

Calculate now how little cyber insurance costs for your company, or arrange a consultation. Our experts will recommend customized security solutions for your company.