# Email Security: Malicious Attachments, Fake Links, BEC and Corporate Email Fraud

**URL:** https://securesys.com.tr/en/learning/end-user-security/email-security-bec-and-malicious-attachments

![Email Security: Malicious Attachments, Fake Links, BEC and Corporate Email Fraud](/images/bilgi-merkezi/covers/cover-sonkullanici-05.webp)

In the corporate world e-mail is still one of the most critical communication channels.

An important part of purchase requests, payment notifications, contracts, invoices, project documents, human resources correspondence, customer communications and technical notifications is carried out over e-mail.

**For this reason for attackers e-mail is not only a communication tool but at the same time a powerful attack surface.**

For an attacker to harm a corporate system they do not always have to find a vulnerability on the firewall. Sometimes the only thing they need is for the user to open an e-mail they think is trustworthy, to click the link inside it or to accept the payment instruction as genuine.

**For this reason the modern Email Security approach does not consist only of filtering spam.**

Corporate e-mail security;

**Phishing Protection, Business Email Compromise, Malware Detection, Attachment Security, URL Protection, Sender Authentication, Account Takeover Detection, Data Loss Prevention, Identity Security and Incident Response**

requires these layers to work together.

Particularly with the spread of Microsoft 365, Google Workspace and other cloud e-mail platforms, e-mail security must now be handled not only at the mail gateway level but together with an identity and cloud security perspective.

The fundamental principle of modern e-mail security is this:

**An e-mail coming technically from a real account does not mean that its content is trustworthy.**

### What Is E-mail Security?

E-mail security is the technical and organizational security approach that provides protection for corporate e-mail systems against threats such as spam, phishing, malware, credential theft, Business Email Compromise, data leakage and account takeover.

Corporate Email Security does not only filter incoming messages.

At the same time:

outgoing e-mails,

user behaviours,

mailbox configuration changes,

authentication events,

data sharing activities

and account compromise indicators

it also covers monitoring these.

For this reason an effective corporate e-mail security model:

**Prevent + Detect + Protect + Monitor + Respond**

must be designed in this form.

### Why Is E-mail One of the Most Widespread Entry Points of Cyber Attacks?

E-mail is quite advantageous from the attacker's point of view.

Because it makes it possible to communicate directly with the user.

Through an e-mail the attacker;

to click a link,

to open a file,

to enter credentials,

to approve MFA,

to send money

or to share sensitive data

can persuade the user to do these.

Moreover, for this attack to succeed the use of sophisticated malware is not necessary.

Some of the most effective attacks can consist of only a few well-prepared sentences.

### Phishing and E-mail Security

Phishing is one of the first threats that comes to mind when e-mail security is mentioned.

However, phishing no longer consists only of badly written fake e-mails full of grammatical mistakes.

Modern phishing messages can imitate the company's corporate language, can use the real logo, can refer to real employee names and can even be prepared to fit the context of an ongoing project.

For this reason it is risky for the user to make a trust decision by looking only at the appearance of the message.

The real elements that need to be checked:

**Sender Identity + Domain + Request Type + Context + Expected Behavior**

must be these.

### How Are Fake Links Used?

A malicious URL can be used to direct the user to a phishing page, a malware distribution site or a fake login portal.

These links can contain a directly open malicious domain.

However, attackers sometimes:

a URL shortener,

a redirect chain,

a lookalike domain,

a compromised legitimate site

can use methods such as these.

Therefore the link looking trustworthy at first sight is not enough.

### What Is a Lookalike Domain?

A lookalike domain is the domain that closely resembles a real company or service domain but is controlled by the attacker.

For example by changing one letter, digit or similar character the user can be deceived.

This method can be used particularly in scenarios such as:

Microsoft 365 login,

a vendor portal,

a banking portal,

cloud file sharing

in scenarios such as these.

For this reason users need to pay attention not only to the text visible on the link but to the real destination domain.

### What Is Typosquatting?

Typosquatting is domain registrations that imitate spelling mistakes users might make being used for attack purposes.

For example by two letters in the company domain changing places or one character being written incorrectly a fake domain name can be created.

Typosquatting can be effective particularly in BEC and credential phishing attacks.

### Malicious E-mail Attachments

E-mail attachments have been one of the methods used for malware delivery for many years.

Inside an e-mail the attacker can send:

an Office document,

a PDF,

a ZIP archive,

an HTML file,

an executable

or another file.

The aim is for the user to open the file and for the malicious code to run.

For this reason modern e-mail security solutions do not look only at the file extension.

The file's:

content type,

hash,

reputation,

behaviour

and embedded objects

can be examined.

### What Is a Malicious Attachment?

A malicious attachment is the e-mail attachment that contains malicious code, an exploit, a malicious script or deceptive content.

Some malicious files can be directly executable.

Others can require user interaction.

For example the user can be asked:

to enable a macro,

to open an embedded object,

to click a link

they can be asked these.

For this reason user awareness and technical attachment protection must work together.

### What Is Attachment Sandboxing?

Attachment sandboxing is the suspicious file being run in an isolated analysis environment before it reaches the user.

In the sandbox environment the file's:

whether it creates processes,

whether it opens network connections,

whether it makes changes on the file system,

whether it shows suspicious behaviour

can be examined.

This approach provides additional visibility particularly against unknown malware and zero-day-like threats.

### Does a Sandbox Detect Every Malicious File?

No.

Some malware types can detect the sandbox environment and not display behaviour.

Some can wait for particular user interaction or a time delay.

For this reason a sandbox is not sufficient on its own.

It must be supported with different layers such as file reputation, static analysis, EDR and user awareness.

### What Is Content Disarm and Reconstruction?

**CDR, that is Content Disarm and Reconstruction, is the security approach that aims to produce a safer copy by removing the active or potentially malicious content inside a document.**

For example if inside the document:

a macro,

an embedded object,

a script

active content such as this is present, it can be cleaned.

This approach can be a valuable defense layer for attachment security particularly in document-heavy organizations.

### What Is a Secure Email Gateway?

A Secure Email Gateway is the platform class that examines incoming and outgoing e-mail traffic from a security point of view.

SEG solutions;

spam,

phishing,

malware,

a malicious attachment,

a malicious URL,

sender reputation

can analyze risks such as these.

In modern cloud e-mail architectures the gateway approach can be used together with native cloud security and API-based e-mail security solutions.

### What Does an E-mail Gateway Check?

A Secure Email Gateway can evaluate the following signals:

Sender IP reputation

Domain reputation

Message headers

SPF/DKIM/DMARC results

Attachment reputation

URL reputation

Content patterns

These checks help to form a risk score rather than to make a definite decision one by one.

### What Is SPF?

**SPF, that is Sender Policy Framework, is the e-mail authentication mechanism that defines which mail servers are authorized to send e-mail on behalf of a domain.**

The receiving mail server can compare the IP address the message came from with the SPF record.

In this way direct domain spoofing over an unauthorized mail server can be made more difficult.

However, SPF on its own does not prevent phishing.

### What Is DKIM?

**DKIM, that is DomainKeys Identified Mail, is the mechanism that makes it possible for a cryptographic signature to be added to the e-mail.**

The receiver can verify the signature with the public key published on DNS.

In this way whether the message was signed by authorized sending infrastructure and whether it underwent certain changes in transit can be checked.

### What Is DMARC?

**DMARC, that is Domain-based Message Authentication, Reporting and Conformance, combines the SPF and DKIM results with policy.**

Thanks to DMARC the domain owner:

can determine what will be done when authentication fails,

can receive reporting about spoofing activity,

can reduce the domain abuse risk.

The DMARC policy levels can generally be applied as:

**none**

quarantine

**reject**

in this form.

### **Is DMARC = none Enough?**

DMARC p=none can generally be used at the starting stage for monitoring and visibility purposes.

However, this policy does not make messages that fail authentication be blocked directly.

After the organization's mail flow has been analyzed correctly, moving to quarantine or reject policies appropriately can reduce the domain spoofing risk more effectively.

### Do SPF, DKIM and DMARC Completely Prevent Phishing?

No.

These three controls are important but they solve only a certain part of the e-mail authentication problem.

The attacker:

a lookalike domain,

a compromised vendor account,

a compromised internal account,

a legitimate cloud mail service

can use these.

In this case the e-mail can pass the SPF, DKIM and DMARC checks successfully.

Therefore:

#### Authentication Passed is not equal to Message Trusted

this principle is important.

### What Is Business Email Compromise?

**Business Email Compromise or BEC is the fraud attack carried out through the abuse of corporate e-mail accounts, business relationships or business processes.**

In a BEC attack the presence of malware is not necessary.

The attacker, the target's;

organization structure,

vendor relationships,

payment processes,

management hierarchy

can research these.

Then they send a realistic message that fits the context.

For this reason BEC is as much a business process security problem as it is a technical attack.

### What Is CEO Fraud?

CEO Fraud is the attacker asking employees for a payment, sensitive information or a quick operation by behaving like the company CEO or a senior executive.

In the messages there are frequently:

urgency,

confidentiality,

authority

elements.

For example the employee:

"This operation is confidential, it will be presented to the board, it must be completed today."

can receive a message such as this.

The aim here is to make the user bypass the normal approval process.

### What Is Invoice Fraud?

Invoice fraud is the payment being directed to an attacker-controlled account through fake or altered invoice information.

The attacker can imitate the real vendor's:

logo,

invoice format,

contact person

information.

In a more advanced scenario the real vendor e-mail account may have been compromised.

In this case the message technically comes from the real vendor mailbox.

### What Is Vendor Email Compromise?

Vendor Email Compromise is the e-mail account belonging to one of the organization's real suppliers being taken over by the attacker and the existing trust relationship being abused.

This attack is extremely dangerous in terms of BEC.

Because:

the sender address is real,

the domain is real,

the old correspondence is real,

the mail authentication is successful.

The attacker only enters into the conversation.

For this reason the user:

"The e-mail came from the real address."

saying this is not enough.

### How Is Vendor Email Compromise Noticed?

Some important signals are these:

an unexpected bank account change,

the payment country changing,

urgency being created,

going outside the normal payment process,

small changes in the communication style.

However, no sign is definite on its own.

**For this reason out-of-band verification must be applied for critical payment changes.**

### What Is Thread Hijacking?

Thread hijacking is the attacker carrying out an attack using the messages inside an existing real e-mail conversation.

The attacker who reaches the compromised mailbox can first examine the past correspondence.

Then they send a reply to an ongoing real conversation.

In this case the victim:

the subject,

the sender,

the previous messages,

the context

because these are completely normal, can accept the message as trusted more easily.

### Why Is Thread Hijacking So Effective?

Because the attacker does not create a story from scratch.

They use a ready-made trust relationship.

Particularly:

invoice,

contract,

project,

delivery

long business conversations on these subjects can create a strong opportunity for the attacker.

### What Is Mailbox Rule Abuse?

After an account takeover the attacker can create a rule inside the mailbox.

For example certain security notifications:

archived,

deleted,

forwarded

can be these.

In this way the attacker can make it difficult for the activity to be seen by the user.

### Why Is a Suspicious Inbox Rule Important?

Normal users can also use e-mail rules.

However, the following situations can be a risk signal:

unknown external forwarding,

security mail deletion,

financial keywords filtering,

unexpected mailbox rule creation.

These events must be monitored centrally.

### What Is External Mail Forwarding?

External forwarding is the messages coming to a corporate mailbox being sent automatically to another e-mail address outside the organization.

This feature can be used for a legitimate business requirement.

However, on a compromised account the attacker can create external forwarding for persistence and data collection purposes.

For this reason uncontrolled forwarding:

#### Data Leakage + Account Compromise

carries this risk.

### What Is E-mail Account Takeover?

E-mail Account Takeover is the attacker obtaining unauthorized access over a legitimate mailbox.

This access can arise from methods such as phishing, credential stuffing, an infostealer, MFA manipulation or session theft.

As a result of a mailbox compromise the attacker does not only read e-mail.

At the same time they obtain trust inside the organization.

### What Can Be Done With a Compromised Mailbox?

The attacker:

can send internal phishing,

can correspond with vendors,

can read sensitive documents,

can catch password reset e-mails,

can manipulate the payment process,

can create mailbox rules.

For this reason a corporate e-mail account compromise must be evaluated as a high-priority security incident.

### What Is Internal Phishing?

Internal phishing is other employees being targeted using a legitimate account inside the organization.

It can be more dangerous than external phishing.

Because the message:

comes from an internal domain,

comes from a person the user knows,

does not contain an external sender warning.

For this reason internal mail must not automatically be accepted as trusted.

### What Is Lateral Phishing?

Lateral phishing is other users or business contacts inside the organization being targeted over a compromised user account.

The aim is for the attacker to reach new accounts or data using the existing trust relationship.

This attack can turn a mailbox compromise event into a broader breach.

### What Is URL Rewriting?

URL rewriting is the links inside an e-mail being changed in a way that allows them to be analyzed through a security service.

When the user clicks the link the security service checks the destination.

This approach can prevent the attacker's malicious URL from reaching the user directly.

### What Is Time-of-Click Protection?

Time-of-click protection is the link being analyzed again not only at the moment the e-mail arrives but at the moment the user clicks it.

This is important because the attacker can leave the domain benign at the moment the e-mail is sent and activate the malicious content later.

This technique:

#### Delayed Activation

provides stronger protection against attack methods such as this.

### What Is URL Reputation?

URL reputation is the reputation information that evaluates whether a particular link or domain has been associated with malware, phishing or malicious activity in the past.

Reputation is useful but newly registered domains may not yet have a bad reputation.

For this reason reputation is not sufficient on its own.

### Why Can a Newly Registered Domain Be a Risk Indicator?

In phishing campaigns the attacker can register new domains and use them for a short time.

These domains may not have a reputation history.

Therefore domain age can be used as an additional risk signal.

However, a new domain being used is not proof of malicious activity on its own.

### What Is External Sender Tagging?

External sender tagging is a visual warning being shown to the user on e-mails coming from outside the organization.

In this way an e-mail that looks as if it comes from the CEO but comes from an external mailbox can be noticed more easily.

However, the user can over time start to ignore these warnings.

This situation:

#### Alert Fatigue

can create this risk.

Therefore the warning design must be done carefully.

### What Is Banner Fatigue?

If the same large warning is added to every external e-mail the user can over time start to ignore the banner.

For this reason a risk-based warning can be more effective.

For example in high-risk impersonation or first-time sender situations a more prominent alert can be used.

### What Is Impersonation Protection?

Impersonation protection is the e-mail system trying to detect imitations of the CEO, an executive, a critical user or a trusted domain.

Detection:

display name,

sender domain,

communication pattern,

lookalike similarity

can be performed over signals such as these.

It is valuable particularly in executive impersonation and BEC risks.

### What Is First Contact Safety?

It is an e-mail coming from a sender with whom the user has not communicated before being evaluated with a different risk context.

A sender seen for the first time, particularly if it requests:

a payment,

credentials,

an attachment

additional caution may be needed.

### What Is E-mail DLP?

E-mail DLP is the Data Loss Prevention control that aims to prevent sensitive data from being shared in an unauthorized way over e-mail.

The system, inside the e-mail body or attachments:

personal data,

financial data,

confidential documents,

classified information

can detect these.

According to the policy:

warn,

block,

encrypt,

approval request

can be applied.

### The Risk of Sending an E-mail to the Wrong Recipient

An important part of e-mail data breach events can arise not from a malicious attack but from human error.

The user can select the wrong person with autocomplete.

They can add the wrong attachment.

They can send to all customers without using BCC instead of CC.

For this reason e-mail security must manage not only external threats but also accidental data leakage risks.

### What Is Autocomplete Risk?

The mail client can automatically suggest addresses that have been communicated with before.

The user can select the wrong one of two people with similar names.

For this reason recipient verification is important when sending sensitive e-mail.

Some DLP solutions can show an additional warning for an external or unusual recipient.

### What Is E-mail Encryption?

E-mail encryption is the mechanism aimed at ensuring that the message or attachment content is read only by the authorized recipient.

When sensitive data is being sent, encryption can provide an additional control in terms of data confidentiality.

However, if encryption access is given to the wrong person it does not solve human error on its own.

Recipient verification is still necessary.

### What Is Cloud E-mail Security?

With cloud e-mail systems such as Microsoft 365 and Google Workspace the e-mail security model has changed significantly.

In the past many organizations used inbound mail gateway focused security.

Today the attacker's target is not only incoming e-mail.

At the same time:

cloud identity,

an OAuth application,

a mailbox rule,

a session token,

cloud file sharing

can be targeted.

For this reason modern Cloud Email Security must be handled together with identity and SaaS security.

### What Should Microsoft 365 E-mail Security Contain?

In organizations using Microsoft 365, when e-mail security is evaluated only spam filtering must not be checked.

At the same time:

MFA,

Conditional Access,

mailbox auditing,

external forwarding,

OAuth permissions,

anti-phishing policies,

URL controls similar to Safe Links,

attachment controls similar to Safe Attachments,

admin role security

areas such as these must be examined together.

What is important is not a particular product feature but:

**Identity + Mail + Data + Monitoring**

the whole of these layers.

### The OAuth App Risk

A compromised or malicious OAuth application can obtain permission on the user mailbox.

In this case the attacker can obtain e-mail access without using the password directly.

For example if the user gives a malicious app mail read permission the application can reach the mailbox data over the token.

For this reason third-party application consent governance is a part of e-mail security.

### The Relationship Between E-mail Security and Identity Security

A corporate e-mail account is in fact an identity asset.

Access to the mailbox:

the password,

MFA,

the session,

the device

takes place over these.

For this reason after phishing the e-mail security team and identity security must not work separately from each other.

### An Example Attack Chain

Phishing Mail

↓

Credential Theft

↓

MFA Manipulation

↓

Mailbox Access

↓

Inbox Rule Creation

↓

Internal Phishing

↓

BEC Fraud

This chain shows why modern e-mail attacks cannot be stopped only at the gateway level.

### How Is EDR Used in E-mail Security?

If the user opens a malicious attachment the attack passes from the e-mail layer to the endpoint layer.

EDR:

process execution,

script activity,

a suspicious child process,

a network connection

can detect the compromise over behaviours such as these.

For this reason telemetry correlation between e-mail security and endpoint security is important.

### How Does DNS Security Reduce E-mail Attacks?

Even if the phishing e-mail passes the gateway and the user clicks the link, DNS filtering can block the malicious domain.

This situation is an example of the Defense in Depth approach.

Even if a single e-mail control fails a different security layer can prevent the attack from progressing.

### Secure Web Gateway and E-mail Security

When the user clicks the URL inside the e-mail the Secure Web Gateway can analyze the web request.

Access can be blocked through domain reputation, content category and malware detection.

For this reason it is important that the e-mail and web security controls work in an integrated way.

### What Does the SIEM Do in E-mail Security?

The SIEM can correlate the security events coming from the e-mail platform with other systems.

For example:

a phishing report,

a new login,

a new MFA registration,

inbox rule creation,

a large file download

can be associated with the same user.

On its own each event can be low severity.

Together, on the other hand, they can form a high-confidence compromise indicator.

### The Role of the SOC in E-mail Security

The SOC carries out investigation over reported suspicious e-mails and automated detections.

The SOC analyst generally analyzes information such as:

the sender,

the headers,

the authentication results,

the URL,

the attachment,

the recipient list,

the user interaction

this information.

If a compromise is detected the incident containment process is started.

### Why Is User Reporting Critical?

Security tools cannot catch all phishing messages.

The suspicious e-mail the user sees can sometimes be the SOC's first detection source.

For this reason an easily reachable:

#### Report Phishing

feature inside the mail client can be an important control.

### What Should Happen When the User Reports Phishing?

A user report must not only be forwarded to a mailbox and left waiting.

In the ideal process:

the message is ingested,

the sender is analyzed,

URL/hash reputation is checked,

the other recipients are searched for,

a SOC case is created.

This process can be partly automated with SOAR.

### What Is Search and Purge?

Search and purge is confirmed malicious e-mail being found and removed centrally from the other mailboxes inside the organization.

For example if the phishing mail went to 500 users, deleting it only from the mailbox of the first user who reported it is not enough.

The other recipients must also be found.

### How Is SOAR Used in E-mail Incident Response?

SOAR can automate the repetitive tasks in the phishing response process.

For example:

User Report

↓

Extract URL

↓

Check Reputation

↓

Check Attachment Hash

↓

Search Other Mailboxes

↓

Create Incident

In this way the SOC analyst can perform triage faster.

### What Is E-mail Header Analysis?

The e-mail header contains the routing and authentication information of the message.

During investigation:

From,

Reply-To,

Return-Path,

Received,

Authentication-Results,

Message-ID

fields such as these can be examined.

However, header analysis requires expertise.

A verdict must not be given by looking at a single field.

### What Is Reply-To Manipulation?

While the From field looks real or trustworthy the Reply-To can be a different attacker-controlled address.

When the user replies the message goes to the attacker.

This method can be used particularly in impersonation and fraud attacks.

### What Is Message-ID?

Message-ID is the identifier generally created by the sending system for an e-mail message.

During incident investigation it can help to associate messages belonging to the same campaign.

However, on its own it is not proof of trustworthiness.

### How Should E-mail Security Incident Response Be?

E-mail incident response does not consist only of deleting the message.

First of all the user's interaction level must be determined.

Did the user:

only see the mail?

click the link?

enter credentials?

open the attachment?

approve MFA?

carry out a payment?

Each of these requires a different response.

#### If the User Only Received the E-mail

If the message is malicious the other recipients must be found and the mail must be removed.

The sender/domain can be blocked as necessary.

The campaign indicators can be added to the threat intelligence systems.

#### If the User Clicked the Link

The nature of the destination site must be investigated.

The endpoint telemetry must be checked and whether the user entered credentials must be determined.

The assumption "they clicked the link but nothing happened" must not be made.

#### If the User Entered Credentials

An identity response must be applied.

Generally:

a password reset,

active session revocation,

an MFA review,

a login audit,

a mailbox audit

may be needed.

If there is a possibility of an infostealer or other malware on the endpoint an EDR investigation must be carried out.

#### If the User Opened the Attachment

Through the EDR telemetry:

the process tree,

file activity,

network connections,

persistence behaviour

must be examined.

If necessary the endpoint can be isolated.

#### If the User Approved MFA

The authentication logs must be examined immediately.

The attacker may have created a successful session.

A password reset being performed may not be sufficient on its own.

The active sessions and tokens must also be evaluated.

#### If a Payment Was Made

The e-mail security incident has now turned into a cyber fraud incident.

Alongside the security team:

Finance,

Legal,

Management,

the relevant bank

stakeholders such as these must be brought in quickly.

For this reason a BEC incident playbook must be prepared in advance.

### What Should BEC Incident Response Contain?

In the BEC response process:

detection of the compromised mailbox,

session revoke,

password reset,

mailbox rule review,

payment verification,

bank communication,

related mail search,

affected vendor communication

steps such as these can be evaluated.

In addition it must be attempted to determine how long the attacker has had access to the mailbox.

### Mailbox Audit After an Account Compromise

When a compromised e-mail account is being cleaned, changing only the password is not enough.

Among the areas that need to be checked:

new inbox rules,

external forwarding,

new delegates,

OAuth permissions,

sent messages,

deleted items,

authentication methods

can be found.

The aim is to determine whether the attacker has left a persistence mechanism.

### What Is Delegate Access?

A mailbox delegate allows another user to perform certain operations on the mailbox.

If the attacker adds unauthorized delegation, even if the account password changes access can continue over another identity.

For this reason suspicious delegate changes must be monitored.

### What Is Mailbox Auditing?

Mailbox auditing is the logging of the important operations carried out on an e-mail account.

For example:

mail read,

mail send,

rule create,

delegate change,

folder access

activities such as these can be valuable in terms of investigation.

On cloud e-mail platforms audit retention and log availability are particularly important.

### E-mail Threat Intelligence

Threat intelligence, associated with phishing campaigns:

domains,

URLs,

IPs,

file hashes,

sender infrastructure

can provide context about these.

However, IOC-based detection is not sufficient on its own.

Attackers can change their infrastructure rapidly.

For this reason behavioural detection and content analysis are also necessary.

### The Limit of IOC-Based E-mail Detection

A known malicious domain can be blocked.

However, the attacker can use a new domain in the next campaign.

For this reason if the organization relies only on a blacklisting approach it can miss zero-history threats.

Modern detection:

**Reputation + Behavior + Content + Identity Context**

must use this combination.

### AI-Assisted E-mail Security

AI and machine learning can be used in e-mail security products in areas such as sender behaviour, content anomaly, language pattern and impersonation detection.

For example a high-value transfer request suddenly coming from a sender that normally never sends payment requests can form an additional risk signal.

However, AI-based detection can produce false positives or false negatives.

For this reason critical decisions must be supported with multiple signals.

### Is Generative AI Increasing the Phishing Risk?

Generative AI can make it easier for attackers to prepare more fluent, grammatically correct and personalized phishing messages.

For this reason the approach used in the past:

"If there is a spelling mistake it can be phishing."

this approach is now a far weaker security signal.

Users need to focus less on the language of the message than on:

the sender,

the domain,

the context,

the request,

the urgency

on these elements.

### How Should Security Awareness Be in E-mail Security?

User training must not show only generic phishing examples.

To the finance employee:

Invoice Fraud,

BEC,

Payment Diversion

these scenarios must be explained.

To the executive user:

Whaling,

Impersonation,

Sensitive Data Requests

these must be explained.

To the HR employee:

a Fake CV,

a Payroll Change,

a Personal Data Request

these scenarios can be shown.

This approach is called Role-Based Security Awareness.

### How Does Phishing Simulation Support E-mail Security?

Phishing simulation measures the user's behaviour in controlled scenarios similar to a real attack.

However, measuring only the click rate is not enough.

Valuable KPIs:

Reporting Rate

Credential Submission Rate

Mean Time to Report

Repeat Susceptibility

can be these.

The real aim is not to show the employee as unsuccessful but to reduce the organization's human risk level.

### The Most Frequently Made Mistakes in E-mail Security

The mistakes frequently seen in corporate e-mail security are these:

- Relying only on the spam filter
- Using SPF and neglecting DKIM/DMARC
- Leaving DMARC continuously in monitoring mode
- Not monitoring the lookalike domain risk
- Not using executive impersonation protection
- Not controlling external forwarding
- Not monitoring mailbox rules
- Ignoring OAuth application permissions
- Making the user reporting process difficult
- Not having search-and-purge capability
- Seeing BEC only as a phishing problem
- Not performing independent verification for vendor bank account changes
- Only performing a password reset after an account compromise
- Not revoking the active sessions
- Not performing a mailbox audit
- Not sending the e-mail logs to the SIEM
- Not correlating the e-mail telemetry with EDR
- Not applying role-based security awareness
- Looking only at the click rate in the phishing simulation results

### Corporate E-mail Security Checklist

Organizations can regularly evaluate the following items:

- Has SPF been configured correctly?
- Is DKIM active?
- Is DMARC being applied?
- Is DMARC reporting being followed?
- Is there a Secure Email Gateway or equivalent cloud security controls?
- Is URL reputation checking being performed?
- Is there time-of-click protection?
- Is attachment sandboxing being applied?
- Has the need for CDR been evaluated?
- Is there executive impersonation protection?
- Is lookalike domain monitoring being performed?
- Is external sender tagging being applied?
- Is external forwarding under control?
- Are suspicious mailbox rules being monitored?
- Are OAuth app permissions being managed?
- Is MFA mandatory for all e-mail accounts?
- Do privileged accounts use stronger authentication?
- Is Conditional Access being used?
- Is mailbox audit logging active?
- Is e-mail DLP being applied?
- Is there a Report Phishing feature for the user?
- Is the SOC actively analyzing the phishing reports?
- Is search-and-purge capability available?
- Do the e-mail events go to the SIEM?
- Has a BEC incident response playbook been prepared?
- Is there a finance payment change verification policy?
- Are vendor bank account changes verified out-of-band?
- Is phishing simulation being applied regularly?

### E-mail Security Maturity Model

#### Level 1 - Basic Spam and Antivirus

The organization uses basic spam filtering and antivirus.

Phishing and BEC visibility is limited.

#### Level 2 - Domain and Content Protection

SPF, DKIM, DMARC, URL filtering and attachment protection are applied.

A basic anti-phishing policy has been created.

#### Level 3 - Identity-Aware Email Security

MFA, Conditional Access, mailbox auditing, forwarding control and OAuth governance are integrated with e-mail security.

Account takeover detection has developed.

#### Level 4 - Integrated SOC Detection

Email, identity, EDR, DNS, DLP and SIEM telemetry are correlated together.

Phishing response is accelerated with SOAR playbooks.

#### Level 5 - Adaptive Email Threat Defense

Sender behaviour, identity risk, user risk, threat intelligence and real-time content analysis are used together.

Adaptive controls are applied for BEC, account takeover and targeted phishing.

### Frequently Asked Questions

#### What is e-mail security?

E-mail security is the security approach that provides protection for corporate e-mail systems against threats such as phishing, malware, BEC, credential theft, account takeover and data leakage.

#### What is a Secure Email Gateway?

A Secure Email Gateway is the security platform that analyzes incoming and outgoing e-mail traffic in terms of spam, malware, malicious URLs, malicious attachments and sender risks.

#### What is BEC?

Business Email Compromise is the corporate e-mail identity or business process being manipulated and used for the purpose of fraud, payment diversion or sensitive information theft.

#### What is CEO Fraud?

It is the attacker asking employees for a payment or confidential information by behaving like a senior executive.

#### What is Vendor Email Compromise?

It is the e-mail account of a real supplier being taken over and the existing trust relationship being used in the attack.

#### Is an e-mail safe if it comes from the real address?

No. The real mailbox may have been compromised. Payment or sensitive change requests in particular must be verified independently.

#### What is SPF?

Sender Policy Framework defines which mail servers can send e-mail on behalf of a domain.

#### What is DKIM?

DomainKeys Identified Mail helps with domain authentication and message integrity checking by adding a cryptographic signature to e-mail messages.

#### What is DMARC?

DMARC is the e-mail authentication standard that combines the SPF and DKIM results with a policy and reporting mechanism.

#### Do SPF, DKIM and DMARC completely prevent phishing?

No. Attacks such as a lookalike domain, a compromised internal account or a vendor compromise can pass these controls.

#### What is a malicious e-mail attachment?

It is an e-mail attachment that contains malware, an exploit, a malicious script or deceptive content.

#### What is Attachment Sandboxing?

It is suspicious e-mail attachments being run in an isolated environment and their behaviours being analyzed.

#### What is Time-of-Click Protection?

It is the URL inside the e-mail being analyzed again according to the current risk state at the moment the user clicks it.

#### What is Mailbox Rule Abuse?

It is the attacker creating a rule in a compromised mailbox in order to hide, delete or forward e-mails to another address.

#### What is E-mail Account Takeover?

It is the attacker obtaining unauthorized control over a legitimate user's mailbox.

#### If an e-mail account is taken over is changing only the password enough?

Not always. Active sessions, MFA methods, mailbox rules, forwarding, OAuth permissions and authentication logs must also be checked.

#### What is E-mail DLP?

It is the Data Loss Prevention control that detects or blocks sensitive data being sent outside in an unauthorized way over e-mail.

#### How should a phishing mail be reported?

It must be reported to the SOC/IT team in the shortest possible time over the Report Phishing or security incident channel the organization has defined.

### Conclusion: Corporate E-mail Security Is No Longer Only a Spam Filter

For many years e-mail security was handled with the:

spam,

virus,

malicious attachment

triangle.

Today, on the other hand, the threat landscape is far broader.

The modern attacker may not only send malware over e-mail.

They can take over the user's identity.

They can use the vendor relationship.

They can send a fake payment request over a real mailbox.

They can steal a session token.

They can obtain an OAuth application permission.

They can provide persistence for a long time by creating a mailbox forwarding rule.

For this reason a modern e-mail security architecture cannot be built only on the gateway.

The real structure:

#### Domain Security

↓

#### Email Authentication

↓

#### Content Security

↓

#### URL & Attachment Protection

↓

#### Identity Security

↓

#### Mailbox Monitoring

↓

#### Data Protection

↓

#### SIEM / SOC

↓

#### Incident Response

must be handled in this form.

In corporate e-mail security perhaps the most critical change is this:

In the past telling the user:

**"Look at the sender address."**

could largely be enough.

Today it is not.

Because the attacker may have taken over the real vendor account.

They can send internal phishing from a real employee's mailbox.

They can share a malicious document over a real cloud service.

Therefore the new security principle:

#### Who sent it?

alongside this question

#### What do they want?

is to ask this question too.

Particularly:

a bank account change,

an urgent payment,

a credential request,

an MFA approval,

a sensitive data transfer

operations such as these must not take place outside the normal business process.

In this way, no matter how well the attacker imitates the e-mail, the process control can come into play at the last stage of the attack.

The fundamental formula of modern corporate e-mail security:

**SPF + DKIM + DMARC + Secure Email Protection + Identity Security + DLP + User Awareness + SIEM/SOC + Incident Response**

can be thought of in this form.

However, at the centre of this formula there is an important principle:

**E-mail security must determine not whether the message is trustworthy but whether the risk the message creates can be managed securely.**