Email Impersonation Protection Now Available

Products•Product News

We’re excited to announce the ability to detect and block phishing attacks impersonating well-known brands and VIPs with Sophos Email Advanced.

Jan 16 2020 By

Phishing emails impersonating well-known brands and VIPs within an organization are a big problem for security teams to deal with. So we’re excited to announce the ability to now detect and block these impersonation attacks with Sophos Email Advanced.

 

The threat from email impersonation phishing attacks

The latest study from Sophos revealed that five out of 10 organizations see malicious emails as their top security concern, with 53% experiencing a phishing attack in the past twelve months. Impersonation attacks are some of the hardest to combat, often with no malicious payload to detect. In these attacks, criminals often try to deceive employees, using the name of a trusted sender to encourage victims to reply, click a link, open an attachment, and so on.

Relying on users who scan email sender addresses, these attacks use simple display name forgery, to change the visible part of the email address that we see in many common email clients. Changing the display name to use that of trusted brands, or senior executive within the organization – it’s highly effective for attackers.

These attacks reign down from free email accounts, and in more targeted attacks, are known to use lookalike domain names, like that of the corporate domain.

 

Release highlights

This latest enhancement for Sophos Email Advanced offers crucial protection against these impersonation phishing attacks and offers several great advancements:

  • Compares the display name of inbound emails to the display name of commonly abused cloud service brand names, and to VIPs within the customers organization to check for matches. These could be the CEO, CFO, and HR director, etc.
  • Provides a simple wizard to identify and add VIPs within the organization to your policy for analysis with all inbound messages.
  • Compares header information, analyzing the display name in relation to the full email address and domain name used, to identify free email domains, lookalike domains of popular cloud services such as Microsoft, Amazon, and VIP name impersonation attempts.

 

Sophos Email Impersonation - Policy

 

Identifying VIPs

VIPs are employees in the organization who are most likely to be impersonated by phishing attackers. While all users will receive the same protection, the system will look for external senders impersonating your VIPs and customers may add up to 200 VIPs.

Creating a VIP list in Sophos Central couldn’t be simpler. Either choose to “Add VIPs” by searching your user list for known individuals. Alternatively, if active directory synchronization has been enabled, select “Help me find VIPs” and Sophos Email will look for users with titles that are in line with job roles most likely to be impersonated. Examples of titles and roles include:

  • CEO
  • President
  • Chief financial officer
  • CFO
  • Finance director
  • Human resources director
  • HR director

 

Sophos Email Impersonation - VIPs

Acting on the threat

This new service allows email administrators to act on potential threats with policy controls to quarantine suspicious messages, tag the subject line, delete, or warn users – with a banner added to inbound emails.

The enhanced “At Risk Users” report provides a deeper level of visibility into these phishing threats, providing a breakdown of phishing impersonation attempts received, as well as users either warned or blocked from visiting URLs with malicious content. Drill-down levels provide further insight, including:

  • Number of impersonation emails received by the user allows you to easily see those most targeted
  • Impersonation type: VIP or brand impersonation
  • Summary information for each phishing email, including display name and email address used and whether the recipient replied
  • Full visibility of email header, message content, and attachment types

 

Sophos Email Impersonation - Report

 

Superior phishing protection with Sophos Email Advanced

The level of phishing protection added to Sophos email in this latest release offers incredible value, with simple controls that helping ensure protection is in place quickly.

Social engineering
Suspicious messages can be blocked, quarantined, tagged with a subject line, or have a warning banner added.

Sophos scans all inbound email in real time, searching for key phishing indicators with SPF, DKIM, and DMARC authentication techniques, and email header anomaly analysis, as well as impersonation protection using display name. Lookalike domain analysis identifies impersonation attempts of a brand or VIP of the organization.

 

Malicious URLs and attachments
Real-time malicious URL detection and AI-powered sandboxing.

For phishing protection against malicious URLs or attachments that may contain malware, Sophos provides real-time URL scanning and Time of Click URL rewriting to analyze any URL before it clicked. Then Sophos Sandstorm, our AI-powered cloud sandbox, detonates suspicious files to ensure malware never reaches the inbox.

 

User education

Intelligent cybersecurity awareness training.

Sophos Synchronized Security connects Sophos Email to Phish Threat, the Sophos phishing simulation and training platform, identifying users who have been warned or blocked from visiting a website due to its risk profile or replying to a spear phishing email. It enables seamlessly enrolling them into targeted phishing simulations and training to improve awareness. Phish Threat license required.

 

Sales materials

A range of updated sales assets are now in place to help you promote these new features:

  • Sophos Email datasheet
  • What’s New guide
  • Sophos Email license guide
  • Sales presentation

 

Remarks

  • Impersonation protection is available to Sophos Email Advanced license customers only.
  • These features have been automatically added in Sophos Central, and will be ‘on’ by default; however, customers are required to define their own VIP list.
  • The default policy action will be to ‘add banner’ to warn users to inbound messages where impersonation is detected. This message can be customized by the Sophos Email Administrator.

About the Author

Sophos is a global leader and innovator of advanced security solutions that defeat cyberattacks, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies. As one of the largest pure-play cybersecurity providers, Sophos defends more than 600,000 organizations and more than 100 million users worldwide from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through the Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully managed security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.