Everything you need to know about securing communications across email, messaging, file-sharing and other cloud office applications.
Introduction
We live in a world dominated by remote work, cloud adoption, and digital workflows. This evolution in the way we live and work has resulted in improved organizational agility and a happier (not to mention more efficient) workforce. We send important communications over email, collaborate on Slack, store files in Box, and are able to complete business-critical processes much faster than ever before. However, chinks in this cloud-first armor have begun to appear.
While security technologies have focused on protecting every imaginable layer within cloud security, the most targeted layer is also the most overlooked – the human layer. Humans sit at the center of this collaboration sprawl, talking and writing and performing critical actions that keep businesses running. While all of this context lies unanalyzed, targeted attacks and data loss rear their heads.
Email attacks today are laser focused and evade traditional detection by targeting human nature. Moving beyond mass-phishing and malicious payloads, attackers are now researching their targets before sending socially engineered emails. Attackers impersonate trusted parties or take over legitimate email accounts to induce actions that cause financial and data loss. Over $26 billion has been lost to business email compromise (BEC) attacks over the last three years according to the FBI.
Even after deploying a bevy of DLP tools, both direct and lateral data loss are prevalent across organizations today. The desire for speed and productivity usually comes at the expense of data privacy and compliance. Whether inadvertently or maliciously, employees share Personally Identifiable Information (PII), Payment Card Information (PCI), passwords, and confidential data – either with outside parties or laterally across email, messaging, and file-sharing services.
“Over $26 billion has been lost to business email compromise (BEC) attacks over the last three years according to the FBI.”
A new layer of security controls has emerged to protect the human layer across office applications. Enough stage-setting: Let’s introduce cloud office security.
What is Cloud Office Security?
Let’s start off simple:
Cloud office security refers to processes and technologies that protect people and data across any channel used for communication and collaboration. These channels include but are not limited to email, messaging, file-sharing, and video communications.
If we study this definition closely, three terms stand out:
Process and technologies
Cybersecurity often tends to revert to a silver bullet mentality, but this should tell you that there’s no all-healing panacea for cloud office security. Similar to DevSecOps or Zero Trust, adopting cloud office security requires more than just implementing the relevant technology. It requires strategizing and deploying organizational practices that protect your business workers from losing money or data to socially engineered attacks.
It requires embracing API-first implementation of security controls that are best suited to safeguarding a distributed workforce using distributed cloud apps. It requires democratizing threat triage across employees, enabling workers to mark threats as safe or suspicious to increase alert relevance and reduce alert fatigue for your security team. It also requires empowering end users to classify confidential data and institute universal security controls that recognize the confidentiality of that data across channels.
Simply put, cloud office security is a journey requiring organizational flexibility and organizational discipline in equal measure.
Protect people and data
Traditionally, security products that detect and respond to inbound threats (like phishing and BEC attacks) lie separate from security products that prevent outbound data loss. But if we put people at the center of this security equation, it’s necessary for security controls to tackle both the inbound and outbound halves of this coin.
On the inbound front, cloud office security technologies protect against the entire spectrum of targeted attacks including BEC, account takeover, and impersonation. Cloud office security solutions are built to augment the traditional security controls that your email provider might already have such as Advanced Malware Protection
On the outbound front, cloud office security technologies prevent the loss of sensitive and confidential data both within and across cloud application channels. Cloud office security solutions are built to augment and improve upon traditional Data Loss Prevention (DLP) rules through contextual understanding of data and the people sharing that data.
Across any channel
We’ve left the most pertinent point for last. Cloud office security technologies are purpose-built to work across channels including email, messaging, file-sharing, and other cloud application channels.
“Cloud office security refers to processes and technologies that protect people and data across any channel used for communication and collaboration. These channels include but are not limited to email, messaging, file-sharing, and video communications.”
The cross-channel nature of cloud office security is necessary because the elements they’re protecting – people and data – don’t reside on any one channel today. Analyzing signals across channels lends cloud office security technologies universal context of enterprise communications. This context is vital in addressing concerns where siloed security solutions fall short (e.g., an employee downloading a sensitive document from Slack and sharing it with an outside contractor over email).
Cloud Office Security vs. Cloud Security: What’s the difference?
Now that we’ve defined cloud office security, you’re probably wondering how it all fits in with other layers of cloud security. Protecting cloud environments is certainly not a new development, so how is cloud office security different?
Cloud security constitutes many layers, each with its own set of technologies and controls that protect the integrity of virtualized IP, data, applications, and infrastructure. Cloud office security protects the human (or contextual) layer that sits atop all other cloud security layers.
- Cloud Infrastructure Security: Products that detect anomalies, stop vulnerabilities and ensure continuous security on the cloud infrastructure layer.
- Hypervisor/Container Security: Products that detect anomalies, stop vulnerabilities and ensure continuous security on the hypervisor/container layers.
- Cloud Application Security: Products that detect anomalies, enforce compliance and prevent the loss of structured sensitive data on cloud applications.
- Cloud Office Security: Products that protect people and data through a shared understanding of organizational context across cloud office applications.
Let’s take an example of a security attack to broadly define the roles of different cloud security layers. Adversaries get hold of an employee’s Box login credentials through a zero-day credential phishing email. Upon infiltrating the employee’s Box account, the adversaries host the same zero-day URL on a Box file and share it with other employees and customers for follow-on compromise. The adversaries also find a sensitive Box file that lists the AWS account credentials of a few engineering team members. After gaining access to AWS, the attackers set up a cryptojacking environment by diverting some EC2 processing power.
Every cloud security layer does its part while detecting and responding to this multi-part attack, but the entire attack was possible because adversaries were able to phish an employee’s credentials and move laterally to their Box account. Cloud office security solutions are built to detect and respond to the attack entry point in this example.
While all the other cloud security layers undoubtedly have their merits, it’s usually a human being targeted (or making a mistake) that acts as the entry point for all the other security layers being negatively affected. Improving your cloud office security posture can lead to better ROI for the entire cloud security stack.
“Cloud security constitutes many layers, each with its own set of technologies and controls that protect the integrity of virtualized IP, data, applications, and infrastructure. Cloud office security protects the human (or contextual) layer that sits atop all other cloud security layers.”
Why is Cloud Office Security needed?
So you’re clear on what cloud office security means and where it falls within the cloud security umbrella. The obvious next question is – so what? Why is cloud office security needed?
In some ways, decades-long technological trends have led us to this point where cloud office security should be a key part of every organization’s security stack.
Rapid (and unsecure) cloud adoption
Most business applications have moved to the cloud, and the ones that haven’t are in the process of being moved. The worldwide public cloud services market is forecast to grow 21.7% to total $597.3 billion in 2023, up from $491 billion in 2022, according to the latest forecast from Gartner, Inc. This is unquestionably a positive trend – cloud adoption improves organizational agility, minimizes the burden of capex investments, and results in a more efficient outlay of resources across the board. However, privileging speed of adoption often comes at the expense of securing these cloud environments and apps.
Communication sprawl
Over the course of reading this guide, you will probably get five different-sounding notifications from your phone informing you of a Slack message, some emails, an upcoming Zoom meeting, and a Box file someone shared with you.
This is the double-edged sword most organizations have to deal with. Employees access a sprawling ecosystem of third-party apps, resulting in productivity gains and efficient business processes. But this same sprawl has created a large threat surface where any cloud application – and the humans using the application – are potential entry points for targeted attacks as well as potential sources of data leakage.
Distributed workforce
If you’re reading this guide in 2020, you’re probably reading it from home. But even if we keep force majeure events aside, the nature of work has become increasingly distributed over the years. Upwork estimates that 22% of the workforce (36.2 million Americans) will work remotely by 2025.
This rise in remote work will lead to happier, more productive employees. But it also means the security threat surface just exploded. Organizations that could earlier apply stringent perimeter security measures and protect workplace assets now have to deal with people and data spread across the globe.
Socially engineered attacks
While all the aforementioned trends – cloud adoption, cross-channel communication, and telecommuting – have gathered pace, security adversaries have unfortunately not been standing still. Spray-and-pray phishing attacks have given way to the surgical precision of social engineering.
Email attacks today are laser focused and evade traditional detection by targeting human nature. Moving beyond mass-phishing and malicious payloads, attackers are now researching their targets before sending emails that trigger authority, urgency, or fear in the targets’ minds. Attackers impersonate trusted parties or take over legitimate email accounts to induce actions that cause financial and data loss.
BEC attacks are not just a singular entity either. Multiple attack types exist within the BEC umbrella, each utilizing a different combination of techniques to get past traditional defenses. Some attack types include:
- Payroll Diversion Fraud: Targeted emails that fraudulently request a change in direct deposit information to steal from an employee.
- Email Account Compromise: Attackers take over a legitimate email account through credential phishing. Attackers then use that account for further compromising customers, third-party vendors and internal employees.
- Vendor Email Compromise: A ‘long con’ business email compromise attack that exploits legitimate third-party email accounts to further compromise the vendor’s clients.
- Advanced Credential Phishing: Attackers send emails with malicious zero-day URLs, often masking the final credential phishing site behind multiple redirects and lookalike pages.
“Moving beyond mass-phishing and malicious payloads, attackers are now researching their targets before sending emails that trigger authority, urgency, or fear in the targets’ minds. Attackers impersonate trusted parties or take over legitimate email accounts to induce actions that cause financial and data loss.”
Compliance concerns
We live in a post GDPR and CCPA world where organizations are liable for mishandling of private or sensitive user information – and that’s undoubtedly a good thing. However, even unintentional data violations can result in fines if it’s determined that the offending organization did not provide reasonable data security measures to protect its customers’ personal information.
Keeping in mind the challenges already discussed above – the communication sprawl, a distributed workforce, and cloud apps galore – it becomes very difficult for organizations to avoid accidental data loss. With no one person or application really ‘knowing’ where all the sensitive and confidential information resides, data loss concerns are probably not a surprise.
Why current security measures are not enough
You’ve been introduced to cloud office security and agree that it’s needed today. Before we move onto cloud office security capabilities, however, there’s one important question to address – why are current security measures not enough?
Cybersecurity has overengineered complex solutions to simple problems in the past, so it’s worth highlighting the gaps in current security controls to truly underscore why cloud office security applications are purpose-built to solve the human layer challenge.
Metadata-based detection is limited
Since BEC attacks are more sniper than sledgehammer in their technique, metadata and binary rules are not enough to flag these emails. Heavy-handed protection techniques that are solely based on identity or metadata either lead to a flood of false positives or let finely crafted BEC attacks escape their grasp.
Email authentication checks are limited
Email authentication checks like SPF, DKIM, and DMARC definitely have their uses. In fact, they often provide important signals for email attack analysis. But authentication checks like DMARC require widespread adoption to be truly effective. Moreover, if email attacks are sent from reputed domains like Gmail or Yahoo, they seamlessly pass all authentication checks and the burden of detection is placed on busy end users instead.
Cumbersome (and duplicative) email security stack
Native email security controls such as Exchange Online Protection and Advanced Threat Protection have taken great strides in protecting users against spam, known malware, and mass phishing campaigns. Unfortunately, enterprises now end up double-paying for many of these capabilities while investing in a Secure Email Gateway (SEG).
A SEG sitting in front of native cloud email security not only duplicates protection capabilities, but it also reduces the effectiveness of native connection filtering and detection features. Some SEG vendors actually recommend disabling EOP features to realize full value from their solutions.
Siloed data loss prevention solutions
Protecting unauthorized access to sensitive data in the cloud is not a new thing. Data Loss Prevention (DLP) solutions have introduced and iterated on granular rules that govern access to data and applications. However, these controls are usually restricted to specific environments and don’t protect against lateral movement of sensitive data across applications. For instance, Box Shield might prevent data loss on Box, but it won’t stop someone from downloading a confidential Box file and sending it to external parties over email.
It’s also important to note that investing in integrated DLP solutions for every cloud application will strain even the most healthy security budget. This is especially true in a SaaS-first world where a few dollars per user per month can quickly add up across applications and result in an unwieldy security spend.
The precision-recall conundrum with confidential content protection
There are two major approaches that DLP tools take to protect confidential information today: a keyword-based approach or a signature-based approach. Both approaches have their own struggles. Here’s an example that studies the merits and fallbacks of both approaches. Let’s say some members of your organization are working on a skunkworks project called ‘Operation Schrute Farms’ and have compiled all the confidential information about the project in a collection of documents and spreadsheets.
In a keyword-based protection approach, you will enter ‘Operation Schrute Farms’ as a keyword in your DLP products. Anytime an email, document, or spreadsheet goes out with the keyword ‘Operation Schrute Farms’, a DLP violation will be triggered. This approach has good recall (i.e. it will catch any instance of confidential data about ‘Operation Schrute Farms’ being sent out to unauthorized recipients). On the flipside, a keyword-based approach has poor precision (i.e. it will also generate a lot of noise by flagging innocuous mentions of the keyword. If you send an email to a colleague about an upcoming meeting about ‘Operation Schrute Farms’, that email will be flagged as well). A keyword-based approach results in security teams getting buried under a mountain of false positives, lacking the time or energy to properly investigate and remediate genuine DLP violations that get flagged.
In a signature-based protection approach, you take signatures (hashes) of every confidential document and spreadsheet about ‘Operation Schrute Farms’ and enter them into your DLP products. This approach has good precision (i.e. you can be sure that whenever a confidential document or spreadsheet about ‘Operation Schrute Farms’ is shared with unauthorized recipients, it will get flagged as a violation). On the other hand, a signature-based approach has poor recall (i.e. if you open a confidential document, change a few sentences, and save it again, the hash changes and this protection approach is rendered moot).
“When organizations have to choose between a keyword-based DLP approach that has high recall but poor precision, or a signature-based DLP approach that has high precision but poor recall, the choice ends up hinging on minimizing the downsides rather than leveraging the upsides of each approach.”
No unified context and learning
Since security products (both inbound threat protection and outbound DLP) are largely application-specific today, organizations lack a universal layer of context. This context might include what constitutes sensitive/confidential data, user behavior including login and access patterns, and the nature of external/internal interactions.
At the outset of this guide, we mentioned that people are at the center of the most attacked and least protected security layer. Since people communicate across email, messaging, and file-sharing applications, it’s vital for security controls to capture behavioral baselines that span these environments as well as learn from them.
The components of Cloud Office Security: A capability checklist
Implementing cloud office security within an organization is usually not a simple “I don’t have it” to “Okay, now I have it” process. When evaluating cloud office security technologies, organizations need to evaluate the breadth and depth of capabilities, method of deployment, and flexibility to fit into (and improve) existing security controls. In this section, let’s take a look at all the moving parts within cloud office security to (hopefully) make wise technology choices.
Inbound email protection
Inbound email protection is the proverbial bread and butter of cloud office security technologies. Your chosen solution should protect against the entire spectrum of socially engineered email attacks while not heavily duplicating existing features present in your cloud email provider or SEG (if you use a SEG).
Here is a feature checklist for inbound email protection:
Outbound email protection
Stopping advanced threats from reaching inboxes goes hand in hand with preventing sensitive data from leaving inboxes. Your chosen cloud office security technology should prevent sensitive data (PII, PCI, passwords) as well as user-marked confidential data from being accessed by noncompliant recipients.
Here is a feature checklist for outbound email protection:
Messaging and file-sharing protection
A core facet of cloud office security technologies is the ability to protect communications across cloud channels. Your chosen solution should protect against malicious URLs, direct data loss, and lateral data loss across messaging and file-sharing services in addition to email.
Here is a feature checklist for messaging and file-sharing protection:
Detection capabilities
Due to the socially engineered nature of today’s attacks as well as the contextual nature of data traveling across cloud apps, cloud office security technologies should possess a breadth and depth of detection capabilities. Importantly, your chosen solution should not focus too heavily on any one technique, since such binary techniques can be bypassed by motivated attackers or edge cases of data loss.
Here is a feature checklist for cloud office security detection capabilities:
Remediation capabilities
Even best-in-class detection won’t be of much use if your security team is drowning in a flood of alerts without any remediation measures in place. Your chosen cloud office security solution should automatically remediate all known threats, give security teams visibility into threat analysis, and enable admins to configure customizable remediation whenever required.
Here is a feature checklist for cloud office security remediation capabilities:
Deployment
However powerful a product looks during a demo, the real proof is in the pudding of deployment and ongoing operations. Your chosen cloud office security solution should be an API-based cloud-native offering that is still flexible enough to support a variety of infrastructural environments.
Here is a feature checklist for cloud office security deployment capabilities:
Enterprise grade capabilities
Given that cloud office security solutions are meant for enterprise security teams, a few basic prerequisites must be met. Enterprise grade capabilities should enable organizations to stay compliant, have complete visibility into user activity, and prevent compromise of the cloud office security solution itself.
Here is a feature checklist for cloud office security enterprise grade capabilities:
Granular attack categories
While all the buzz around BEC is definitely warranted, it can lead to an oversimplification of the many attack categories that constitute BEC. Secure Email Threat Defense leverages unique Artificial Intelligence and machine learning models, including Natural Language Processing, to identify malicious techniques used in attacks targeting your organization, derive unparalleled context for specific business risks, provide searchable threat telemetry, and categorize threats to understand which parts of your organization are most vulnerable to attack.
Automated (but flexible) remediation
Remediating email attacks is tricky, with security teams needing to walk the tightrope between safety and productivity. Security teams shouldn’t have to manually remediate the vast majority of their email alerts, but they should still have the option of defining custom remediation actions when required. Secure Email Threat Defense provides remediation options for every attack category, enabling security teams to respond to email alerts with minimal manual effort while upholding organizational productivity.
Take a self-guided tour of Secure Email Threat Defense to see these threat detection features in action.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!
Cisco Security Social Channels
Instagram
Facebook
Twitter
LinkedIn
CONNECT WITH US