South African organisations are growing wary of criminals exploiting their brands to target their customers, partners or the general public. According to the latest Mimecast State of Email Security Report, 84% of South African organisations are concerned about a Web domain, brand exploitation or site spoofing attack.
“Cybercriminals are acutely aware of the ease with which they can register lookalike domains and launch sophisticated attacks impersonating trusted brands that are nearly indistinguishable from the real thing. It’s become common for malicious actors to use our favourite retailers or other loved brands and services to trick people into handing over money or sensitive information. And it’s becoming harder for these brands to continue to avoid responsibility,” says Mikey Molfessis, cybersecurity expert at Mimecast.
He says local concerns outweigh global averages, with 47% of local organisations admitting they are very concerned about an attack that directly spoofs their e-mail domain, compared to a global average of 40%.
“It’s critical that organisations look beyond the perimeter to determine how threat actors are damaging their brands online. As a start, they need to adopt Domain-based Message Authentication, Reporting & Conformance (DMARC),” says Molfessis. DMARC is an e-mail validation system designed to uncover anyone using a brand’s domain without authorisation. This means brands can monitor who is sending mails on their behalf and instruct receiving servers to reject unauthorised e-mails. This helps protect receivers from falling victim to fraudulent mails. “In South Africa, 96% of respondents were aware of DMARC, but only 30% were using it — perhaps an indication that the importance of using such a solution to protect brand reputation has not yet been realised for many organisations.”
C suite
And while brand protection is certainly on the radar for IT and security decision makers, has its importance reached the rest of the C suite? The report found that CIOs and chief information security officers (CISOs) are most likely to control the budget for securing the organisation’s corporate brand from Web or e-mail spoofing or other forms of exploitation and impersonation. “There is an argument to be made for the chief marketing officer to take ownership of this budget since they are typically responsible for their brand’s reputation, but our research revealed this is the case at only 10% of South African organisations,” says Molfessis. No matter who manages the budget — whether it’s the CFO, CMO or CIO — what’s critical is having budget set aside for this important element of cybersecurity. And the budget owner also needs to work closely with the organisation’s security leader to make the right purchasing decisions.
“Considering nearly four in 10 South African organisations expect the volume of Web or e-mail spoofing attacks to increase in the next 12 months, it makes sense to have a dedicated senior resource looking after the organisation’s online brand integrity. Worryingly, 16% of organisations we surveyed didn’t even know if a Web or e-mail spoofing attack had used their domains or lookalike domains. This could have devastating effects on the organisation’s brand and reputation if left unchecked. If organisations don’t have the tools to actively look for exploits, or unless someone takes the time to report them, they’re difficult to find which leaves brands none the wiser.”
Standard Web and e-mail security strategies are no longer enough. Organisations need to protect their brands online and ultimately protect their customers and supply chains by preventing fraudulent senders using their domains or lookalike domains.
Detailed information is now available in the global Mimecast State of Email Security 2020 Report and South African infographic.
- This promoted content was paid for by the party concerned
