March 2015 – Osterman Research Blog

Organizations of all sizes face a wide variety of threats, ranging from seemingly innocuous incursions like spam that create storage problems and general annoyance, to highly targeted email attacks that can create major breaches of sensitive or confidential information. Among the range of threats to consider are the following:

Phishing emails: Phishing emails are comparatively unfocused email messages that are designed to elicit sensitive information from users, such as login credentials, credit card information, Social Security numbers and other valuable data. Phishing emails purport to be from trustworthy sources like banks, credit card companies, shipping companies and other sources with which potential victims already have established relationships. More sophisticated phishing attempts will use corporate logos and other identifiers that are designed to fool potential victims into believing that the phishing emails are genuine.

The impact of phishing emails should not be underestimated. An Osterman Research survey conducted in late 2014 found that there have been a variety of security incidents that were attributable to malicious emails, such as 41% of organizations that have lost sensitive data on an employee’s computer and 24% that have lost sensitive data from the corporate network.

Spearphishing emails: A spearphishing email is a targeted phishing attack that is generally directed at a small group of potential victims, such as senior individuals within a company or other organization. Spearphishing emails are generally quite focused, reflecting the fact that a cybercriminal has studied his or her target and has crafted a message that is designed to have a high degree of believability and a potentially high open rate.

One of the reasons that spearphishing is becoming more effective is that potential victims provide cybercriminals with the fodder they need to craft believable messages. For example, Facebook, Twitter, LinkedIn and other social media venues contain enormous amounts of valuable information about travel plans, personal preferences, family members, affiliations, and other personal and sensitive information that can be incorporated into spearphishing emails.

Remote users accessing corporate resources: Employees, contractors and others who access resources on the corporate network, such as those working from home or in another remote site, are a key source of threats. An unprotected user accessing a corporate asset, such as Outlook Web Access that is not accessed via a VPN, or a laptop computer that becomes infected and later is connected to the corporate network, can constitute a serious threat. This is becoming a serious problem for most organizations as users employ personally owned devices like their own smartphones, tablets and other traditionally consumer devices in a workplace setting.

Consumer file sync and share tools: Closely related to the point above is the widespread and growing use of consumer file sync and share tools like Dropbox, Microsoft OneDrive and Google Drive, among many others. These tools are commonly used by employees to make their files available on all of their desktop, laptop and mobile platforms for access when traveling, when they work from home, or when they are otherwise away from the office. While these tools are quite useful and generally work as they are intended, they represent an important incursion point for malware. For example, an employee who accesses his or her corporate files on a home computer, many of which do not have the latest anti-virus updates and whose use is not controlled by any sort of sophisticated security infrastructure, can inadvertently infect these files with malware. When the files are synced back to the employee’s desktop computer, malware can readily infect the network because it may have bypassed corporate email, Web gateway and other defenses. In an alternative infection scenario, an employee working from home can have files infected from their home computer and then send these files to a client or business partner without the files ever having passed through the corporate security infrastructure.

Watering holes: This is a type of social engineering attack in which cybercriminals will identify key Web sites that are frequented by individuals or groups they would like to infiltrate, such as mobile app developers. These targeted Web sites are then infected with malware, the goal of which is to infect members of the affinity group. An example of one such attack was an iOS mobile developers’ forum that hosted malware and was targeted against Apple and Facebook.

I will continue the list in my next blog post. We’re producing a white paper focused on addressing these issues – if you’d like a pre-publication copy of the paper, send us a request at and we’ll send it to you right away.

Archiving as a defensive tool is well-trod ground: it’s an important best practice for eDiscovery, litigation hold, regulatory compliance, storage management, and end-user access to content. Every organization should archive their employees’ data to ensure they can meet these defensive uses of archiving – what we call Archiving 1.0.

But what about Archiving 2.0, or a more proactive use of archived data? Here are some things you can do with your archives:

Investigations: The ability to extract intelligence from the content within email archives can significantly reduce the amount of time spent on investigations, such as early case assessments in advance of an anticipated legal action, an investigation about inappropriate employee activity, or an investigation about why a key customer account was lost.
Sales support: Communications with customers independent of a CRM system can be used to determine how sales, support and other staff members’ emails correlate with customer retention and follow-on sales. Similarly, the speed and quality of responses to customer inquiries can be correlated to sales in order to determine how best to respond to inquiries in the future.
Risk mitigation: Archived data can be used to mitigate risks from data breaches, employee fraud and related types of threats. Senior managers can look for employees who are more likely to commit fraud by looking for managers who are treating their employees badly, they can find employees who are communicating with an organization’s competitors, transferring sensitive files to a personal email address, or running a personal business on company time.
Customer service: Archived data can be useful in determining who in an organization is talking with specific customers, to whom in the customer organization they are speaking, the content of their conversations, and other relevant information.
Supply chain management: Another application is analyzing messaging and relationship intelligence to visualize employee communication with unauthorized parties.
Litigation management: Legal can use messaging and relationship intelligence to zero in on individuals or domains to understand communication trends and which individual(s) or domain(s) needs to be investigated further, enabling useful pre-trial or pre-litigation discovery information.
IT support: Help desks can become more proactive by conducting ongoing investigations into what employees are saying about particular applications, the goal of which is to address problems as early as possible.
Human capital management: An archive can be used to determine when employees are going to leave an organization and thereby minimize the impact of an employee departure.

We have written a white paper that focuses on Archiving 2.0 – please feel free to download it here.

Month: March 2015

What Can You Do With Archived Data?