2021 has been quite an eventful year when it comes to email security and authentication. From major ransomware attacks that ended up costing businesses billions of dollars to COVID-19 vaccination phishing lures in the form of fake emails, security professionals had a lot to deal with.

Today we are looking back at the major email security attacks of 2021, talking about what the future holds, and sharing some handy tips on tackling threats in 2022.

Major email security attacks in 2021

1. Direct-domain spoofing

Spoofing attacks continue to rise as we progress into 2022, with attackers impersonating brands including but not limited to well-known industry names like DHL, Microsoft, and Amazon.

2. Phishing attacks

The FBI’s Internet Crime Complaint Center received the most complaints against phishing attacks in 2021.

3. Ransomware

Using phishing as the most common attack vector, several systems were affected by malware and ransomware files this year.

4. Man-in-the-middle attacks

SMTP email security loopholes are easily exploited by Man-in-the-middle attackers to intercept and eavesdrop on email communications.

How to build cyber resilience against these attacks?

Deploying SPF, DKIM, and DMARC

DMARC can help you minimize phishing and spoofing attacks. It also acts as the first line of defense against ransomware. Other benefits of DMARC include improved email deliverability, reduced spam complaints, and boosts your domain’s reputation.

BIMI

If your client’s ESP supports BIMI, it is a good idea to deploy it today. BIMI helps your customers visually identify you in their inbox even before they get around to opening the message.

MTA-STS

MTA-STS is an effective solution against MITM attacks, helping secure your emails in transit and overcome SMTP security issues.

What to expect in 2022?

With various organized internet crime groups resurfacing in recent times with upgraded tactics, it wouldn’t be a surprise to anyone if the intensity and frequency of email-based attacks increase even further in 2022.
Brand impersonations and ransomware attacks will continue to surge as cybercriminals exploit remote working environments. To make situations worse, the cost associated with these attacks is predicted to also rise in the following year.

Final Thoughts

Security experts recommend that organizations take email security more seriously in the years to come, due to the alarming increase in cyberattacks. A popular myth that security professionals are now debunking is that only MNCs and enterprise-level companies need DMARC. This, of course, is not true as in the past year almost 50% of the organizations that were hit by internet attacks were in fact startups and small businesses.

Another important thing to consider while implementing security standards is that a relaxed policy for your protocols will provide your domain with very little to zero protection.

While social engineering attacks continue to evolve and get more and more complex and undetectable, companies should evolve with them. Email authentication protocols, while there is no silver bullet, definitely reduce the chances of falling prey to email-based attacks and strengthen the overall email security posture at your organization. It also provides deeper insight into attacks and vulnerabilities, reducing the incident response time.