Malicious files evading email security products

guest · Jan 21, 2020

Malicious files evading email security products
New study reveals massive gaps in detection time of unknown threats
January 21, 2020
https://www.techradar.com/news/malicious-files-evading-email-security-products

Enterprises could be even more vulnerable to email-based attacks according to a new study from BitDam which shows that malicious files regularly bypass all of today's top email security solutions.
The firm's study titled “The Blind Spots of Email Security” measured the ability of email security products to detect unknown threats at first encounter.
Detecting unknown threats
According to the study's findings, the miss rate over seven weeks at the end of 2019 was about 23 percent for Office ATP while the TTD average was about 48 hours. However, close to 20 percent of missed unknown threats took four or more days to be detected and Office 365 ATP was 'blind' to selected unknown threats it did not detect at first encounter.

These large detection gaps provide proof of how enterprises are often unprotected against unknown threats and this can lead to successful email-based attacks such as ransomware, phishing and malware.
Click to expand...

BitDam: The Blind Spots of Email Security

Malicious files and links regularly bypass all the leading email security products, leaving enterprises vulnerable to email-based attacks including Ransomware, Phishing and data breaches (and more specifically, Emotet, Dridex, Maze, Lokibot, Wannacry and more).

We also know that increased use of automation allows attackers to create many ‘mutations’ for each malware or malicious file, potentially inundating email security products with new unknown threats. Could this explain the shortcoming of email security products? To answer this question we conducted an empirical study to measure their ability to detect Unknown Threats at First Encounter.

The study entails retrieving very fresh samples of malicious files from various feeds and sources, qualifying them as Unknown Threats, and then sending them to mailboxes protected by Office365 ATP, G-Suite Enterprise or ProofPoint. We measure miss rate at first encounter and Time To Detect (TTD) for these Unknown Threats – see the adjacent charts.
Click to expand...

Log in or Sign up

Malicious files evading email security products

guest Guest

Log in or Sign up

Malicious files evading email security products

guest Guest

Useful Searches