The email inbox and email addresses we use represent our identity in the digital world. Through email we exchange information, issue directives, and send documents. Given the role of email and its external exposure, it is straightforward to understand why threat actors have such strong interest in obtaining access to this space.
This article presents five practical recommendations to protect against potential attacks and fraud.<\/p>\n\n\n\n
The most common fraud schemes encountered:<\/p>\n\n\n\n
<\/p>\n\n\n\n
Enable two-factor authentication<\/strong> (2FA). Major webmail services offer this capability as an additional security layer. It is preferable to use smartphone applications rather than receiving codes via SMS (as the latter is vulnerable to MITM attacks).<\/p>\n\n\n\n Additionally, disable support for obsolete protocols<\/strong> in Office365 and Active Directory environments for email access, as these are exploited by threat actors for mailbox control and brute-force attacks (T1110 – Brute Force).<\/p>\n\n\n\n How to use complex passwords? The recommendation is straightforward: use song lyrics that you will not easily forget. In this manner it is simple to achieve the required length<\/strong> and obtain excellent complexity<\/strong>. Only add uppercase characters<\/strong> and symbols<\/strong>!<\/p>\n\n\n\n Alternatively, excellent password managers<\/strong> exist, particularly for those administering networks or systems.<\/p>\n\n\n\n What to verify in an email to ensure it is legitimate? Examine the message text (although fraud emails are now often written in excellent language).2.<\/span> Use complex passwords<\/strong><\/h3>\n\n\n\n
3.<\/span> Attention to detail<\/strong><\/h3>\n\n\n\n
Pay attention to the sender; threat actors frequently create similar domains (example: @gmail.com \u2192 @gmai1.com).<\/p>\n\n\n\n
If a link is present or you are requested to enter your credentials, it is not trustworthy.<\/p>\n\n\n\n4. <\/span>Strengthen anti-spam systems<\/strong><\/h3>\n\n\n\n