This module focuses on email and email security. Email doesn’t need an introduction as you probably use it every day. You may also be familiar with threats like phishing and maybe even Business Email Compromise (BEC) fraud. You probably also know that email accounts sometimes get hacked. Let's explore why—and how—email is vulnerable to cyber attacks.
Email is older than you might think
Email as a protocol is much older than other messaging tools such as WhatsApp, Signal, Telegram or iMessage. As such, it differs in a number of crucial ways.
For example, there is no single entity (such as Meta, in the case of WhatsApp, or Apple, in the case of iMessage) running email and there are no central servers. As a consequence of this decentralized nature, there isn’t a single app for using email, but there are many different email apps (or “email clients”) which may run on mobile devices, on desktops, or in browsers.
Modern email has some protections built in to safeguard against many kinds of wiretapping and spoofing, but email still isn’t suitable for sensitive conversations. For those conversations, you should use end-to-end encrypted messengers such as Signal or WhatsApp.
How email works: mail clients and mail servers
An email app is often referred to as a ‘mail client’, whereas servers handling email are referred to as ‘mail servers.' When Maria sends Ahmed an email, her mail client connects to her mail server (i.e. the one of her email provider), which makes a connection to Ahmed’s mail server, which then makes the email available to Ahmed’s mail client. This is shown in the diagram below.
Maria’s mail client (e.g. Thunderbird) → Maria’s mail server (e.g. Gmail) → Ahmed’s mail server (e.g. Yahoo) → Ahmed’s mail client (e.g. Yahoo Mail in his browser)
In practice, email takes more complex routes from sender to client and moves through various servers within the infrastructure of an email provider. These servers perform tasks such as blocking spam and malicious emails or creating backups.
An organization that sets up email for its staff can decide to run its own mail servers or use a third-party email provider such as Google, Microsoft or Protonmail.
Should NGOs run their own mail server? Usually, no
In the early stages of an NGO, staff often use their own personal email accounts for internal and external communication. While this is understandable, this set-up has a number of important disadvantages: there is no way for the organization to enforce policies (such as multi-factor authentication), there is no control of where sensitive data is being held, and the use of personal emails for work appears very unprofessional. We strongly recommend organizations set up their own domain for email, no matter their size.
In some cases, organizations may decide to run their own mail server, which has the advantage of giving them full control over their email accounts and no reliance on large tech companies, which for some organizations might be more in line with their values.
A major downside, however, is that running a mail server requires someone to be available 24/7/365 to fix minor issues to ensure emails are delivered correctly and the mail server is being kept secure. We do not recommend organizations run their own mail server unless they have very strong reasons to do so and have enough staff to support running it securely.
The option that most NGOs prefer is using a third-party provider to run email. This requires little technical expertise and makes it easy for an organization to enforce settings and policies. Many such providers also integrate email with other office software, such as calendar, word processing software, and collaboration tools.
Moreover, these providers typically have large teams of lawyers who protect the data they hold against requests from governments and other powerful actors, making the organization possibly better off than if they were to run their own mail server.
Examples of third-party email providers are Google Workspace, Microsoft 365, Protonmail and Zoho.
Email security
Given the crucial role that email plays in every organization and the amount of data that is shared through it, email security is crucial. Email is at risk for two reasons: first because a malicious actor may get unauthorized access to one or more email accounts, and second because email may be used as the delivery method for threats such as phishing and malware. We’ll examine both risks in more detail below.
How—and why—to inspect email headers
An email consists of a number of headers and a body. The body contains the content of the email, as well as possible attachments, while the headers contain metadata, such as the subject and the name and email address of the sender and recipient(s). Studying the headers of an email can help you determine whether the sender is who they claim they are.
However, it is worth noting that studying an email won’t be able to tell you whether it was sent from an account that was compromised. Even if you verify that the email comes from a trusted person or organization, its contents may still be deceiving or malicious. Before concluding a suspicious email is legitimate, contact the sender through different means (for example Signal or WhatsApp) and confirm that they really did send the email.
Malicious emails are also often sent from accounts on popular services, such as Gmail or Yahoo Mail. The headers won’t show anything suspicious in this case either.
If you do want to inspect email headers, Google has a helpful page that explains how to find headers (and sometimes the body too) in various email accounts. Google also provides a tool that can give you more information on headers. If you’ve never done this before, look at some emails in your email account, find the headers, and familiarize yourself with them. While email forensics can be a very subtle art, becoming familiar with what ‘normal’ headers look like could help you spot unusual headers.
Handling malicious emails
There are three main types of malicious emails. The first has an attachment that is malicious. It is rare these days for an attachment to be a malicious executable that would run on a device (such as an .exe file for Windows), as such emails probably won’t be delivered. Instead, malicious attachments are typically files that require you to click on one or more things to run. For example, the attachment might be a Word document that only shows a blurred image and you are asked to enable macros ‘for security reasons’ to see the image. Enabling macros won’t show you the image but will instead run some code that installs actual malware.
Sometimes such a document will run malicious code without the user having to click on anything. But with the exception of really targeted attacks that use ‘zero-day vulnerabilities’— which are really expensive for an adversary—this kind of malware only works if software isn’t up-to-date. That’s why it is important to always keep your operating system, office software (such as Word and Excel) and PDF viewers up-to-date and install security patches as soon as they become available.
Reducing your risk when viewing attachments
Aside from keeping office software and PDF viewers up-to-date, it is also good practice to view such attachments in a web-based email client or, if you’re using a desktop mail client, to upload the file to Google Drive or One Drive and view it there. This greatly reduces the risk of getting infected, though, of course, you should think twice before uploading a very sensitive file to a cloud service. If the file shows a message that suggests you need to view it in a standalone program, this could be a sign it is malicious. In such a case, check with the sender before opening it.
Organizations that handle a lot of sensitive documents and are at risk of receiving malware may want to consider setting up an instance of DangerZone. This tool can input various kinds of documents and turn them into guaranteed safe PDF files.
Make your organization less vulnerable to phishing by using 2FA
A second kind of malicious email doesn’t have an attachment but instead uses a link to a malicious website. This link often sends users to a phishing site where they are tricked into entering credentials. In other cases, the link may download a malicious document as described above. In other cases, the email comes with an attachment that contains the link.
Because even the most experienced individual can be tricked by a sophisticated enough phishing email, it is never sufficient to rely on detection of these emails alone. For important accounts, you should always use two-factor authentication, if possible using a security key such as a YubiKey.
Watch out for fraud and harassment via email
Finally, a third kind of malicious email doesn’t have any malicious content but simply aims to trick the recipient. This is commonly used in financial fraud, for example, in the business email compromise (also sometimes known as ‘CEO fraud’), in which an organization that regularly sends large sums of money is tricked into sending funds to a different account.
Harassment also falls into this category. Harassing emails aren’t malicious in the traditional computer security sense but can be really intimidating for a targeted individual, especially if they already face higher risks because of their work.
Spam is often seen as a kind of malicious email, but most spam is harmless, other than taking away your attention and filling your inbox with emails that you don’t want.
Emails that pretend to be something else: spoofing and spear phishing
Other email-based cyber attacks include spoofing and spear phishing.
Spoofing is the act of sending an email pretending to be someone else, often by creating a lookalike email address. Because email doesn’t have built-in authentication, it is sometimes even possible for someone to send an email pretending to be someone else using that person’s actual email address. This is something to be aware of, even if in practice it is not very common. Email security protocols such as DKIM and DMARC make spoofing with the same address as another person a lot harder.
Finally, sometimes the term ‘spear phishing’ is used to describe malicious emails (or phishing) that are very targeted to the recipient. In practice, spear phishing is just one of several kinds of malicious emails to which you should remain vigilant.
Targeting email accounts and mail servers
Aside from being a vector for many kinds of threats, your email account itself is also a target of digital attacks. Sometimes these attacks are carried out by an actor who wants to gain access to your organization’s email accounts, perhaps to learn more about your organization’s activities.
Email accounts are also targeted as a stepping stone to other accounts within your team. For example, an HR person may not have access to sensitive information about an organization’s programs, but with their account hacked, the actors could send a malicious email to the head of programs. This person might be more vigilant about digital threats but may deem an email from the HR person trustworthy enough to open the attachments.
These days, email accounts are often integrated with other kinds of productivity software, such as Google Docs or Microsoft Teams. An actor who has obtained access to an email account typically also has access to these services. If the account is an ‘admin’ user, they may also have access to other people’s accounts, making a potential hack even more damaging. Security of all email accounts throughout the organization should therefore be a top priority.
If an organization runs its own mail server, this could also be the target of a hack, which would then impact the rest of the organization’s infrastructure as well. Vulnerable mail servers are a common infection vector for ransomware and other malicious activity.
Why should you always have strong passwords and two-factor authentication
For important accounts—including any email account within an organization—a password is not enough. No matter how strong it is, a password can be inadvertently leaked or stolen, sometimes through phishing. And while an organization can set password policies, there is no way it can prevent users from using the same password elsewhere.
It is thus vital for organizations to require two-factor authentication (2FA) for all email accounts. This means that when someone tries to login, they would need to present another authentication factor that cannot, or not as easily, be stolen.
2FA is also called multi-factor authentication (MFA). The idea is that there are three kinds of authentication types: something you know, such as a password; something you have, such as a phone or a token; and something you are, such as your fingerprint. MFA means that more than one type is required to login.
The four types of 2FA
There are four types of 2FA:
-
You receive a code on your phone via SMS and are required to enter this code.
-
You have an app installed on their phone, which presents you with a code that regularly changes; you are required to enter this code.
-
You have an app installed on the phone that requires you to approve a login on another device.
-
You have a physical token you insert into the device (or, sometimes, another device you are already logged into) when logging in.
The 2FA types are listed from weak to strong above, though don’t forget that ‘weak’ here makes it still many times more secure than not using 2FA at all.
Why are SMS and push notifications considered weaker forms of 2FA? Messages sent via SMS can sometimes be intercepted by advanced actors. There are also real-time phishing sites that ask for both a password and a code and use that to login to the account right away.
As for push notifications, actors have started to use a technique called ‘MFA fatigue’ where a user is getting so many requests to approve a login, they end up approving it just to get rid of the notifications.
If possible, require a strong 2FA type for all email accounts. However, before making this decision, you should also consider the possibility of staff members being locked out of their accounts, for example by losing their phone or their hardware token.
In considering this, do keep in mind that malicious actors sometimes use this scenario to trick an administrator to grant them access to an email account: they claim to be logged out of their account and to require urgent access.
Although passwords on their own aren’t strong enough, you will still want to set a password policy to ensure strong passwords. You may also want to require passwords to change regularly, though doing so once a year is probably good enough.
Finally, if you’re using Google Workspace, consider enrolling your users into Google's Advanced Protection Program, which offers extra security protections, including requiring token-based 2FA. The program is also available for personal Google accounts. For high-risk organizations, it is worth considering recommending this for staff members’ personal accounts: sometimes a weakly secured personal account allows malicious actors access to an organization’s data.
Checking account security
No organization, no matter how strong its security, is immune to data breaches, including those of email accounts. Regularly checking the security of important accounts, or having account owners do so, is important.
Thankfully, third-party providers like Google and Microsoft make it easy for someone to check recent logins to their account, as well as the devices the account is logged in on. Anything unusual should always be investigated further, even if in many cases there is a benign reason behind the action.
Why your organization needs a data retention policy
The only way to prevent an email from being stolen is to not have it at all. This may sound like a funny witticism, but is actually helpful to keep in mind when setting a data retention policy for your email.
A data retention policy describes how long your organization stores emails before they are permanently deleted. Aside from being a good security measure that limits the impact of a data breach, data retention policies are often a requirement for complying with data regulations such as the EU’s GDPR, which will affect you if you process personal data. (Your organization almost certainly does.)
A quick note: These regulations typically don’t prescribe how long personal data should be stored, but require you to set a reasonable time limit. In case there is a data breach, however, the regulator will not look too kindly upon you if you had decided to keep all data for a hundred years for convenience reasons.
Implementing a data retention policy can take time
Data retention policies are often relatively easy to implement when using a third-party provider such as Google or Microsoft. This means you don’t have to rely on staff members to follow the policy.
However, setting a data retention policy for the first time may not be welcomed by everyone on staff, who may be used to using their emails as a searchable archive. Therefore, communicate clearly about the policy and announce it well in advance. Having a good culture of security certainly helps you get a data retention policy accepted. Also, implementing a data retention policy as early in your NGO’s life as possible also makes it easier to adopt and enforce moving forward.
A strict data retention policy certainly improves security and, after a while, staff will get used to storing important information outside of their email accounts. Do keep in mind that there may be a legal requirement to store data for a certain amount of time, for example for tax purposes. Don’t forget this when setting and implementing a policy!
Email isn't encrypted by default, but here are options
Although, as discussed above, email isn’t encrypted and ideally wouldn’t be used for very sensitive things, sometimes you want to send something more sensitive than usual but still use email. This is where PGP can be helpful.
PGP is short for Pretty Good Privacy. Confusingly, there is also GNU Privacy Guard, or GPG, which is a popular free-software program used for using PGP. The names are sometimes used interchangeably.
PGP signs and encrypts the body of an email using public key cryptography. In public key cryptography, there is a private key that is kept hidden and a public key that others need to send you an encrypted message, or to verify a message you have signed.
Mail clients typically do not natively support PGP, so you’ll need a third party extension such as Mailvelope, Virtru or FlowCrypt. These extensions can help you set up your PGP keys and find keys belonging to your correspondents, though if there is even a slight risk of impersonation, you should find another, more trusted channel to verify the PGP key.
Setting up a PGP key (or using alternatives)
When setting up a PGP key, you will need to choose a password. This protects your private key and in practice protects encrypted emails as they are stored in your email account. Make sure this is a strong password, unrelated to your email password, so that an adversary with access to your mailbox doesn’t have access to your encrypted emails.
It is important to note that PGP doesn’t encrypt email headers, so someone with access to your mailbox will still be able to see who you have been corresponding with. PGP also suffers from some usability issues. For example, it is often easy to accidentally send an unencrypted email, and you typically can’t search among your emails. Therefore, if you can avoid email, you’d be better off using something like Signal with disappearing messages for sensitive communications.
Third-party providers for encrypted email
A number of secure email providers, such as ProtonMail and Tutanota, have built PGP into their systems. If your organization uses PGP a lot, you may want to consider using one of these providers for your email. However, do remember that metadata isn’t encrypted here either, at least not for external emails.