Email Security: 11 Ideas to Help Secure My Business Email

Safeguarding email communication is vital for every business. Cybercriminals are increasingly sophisticated, and email remains one of the most common attack vectors. To mitigate risks, companies need to adopt a multi-layered approach to secure their email systems, especially if they are using Microsoft 365. Here are key strategies employers should consider implementing:

1. Enable Multi-Factor Authentication (MFA)

MFA has been a security standard for years, yet many businesses still haven’t enabled it across all email accounts. Without MFA, a hacker only needs a valid email address and password to breach your system. Enabling MFA provides an additional layer of protection, making it significantly harder for attackers to gain unauthorized access.

However, hackers are now targeting session tokens to bypass MFA. Therefore, even with MFA enabled, continuous vigilance is necessary.

2. Regular Employee Training

Training employees on email security best practices is critical. Regular sessions should cover topics such as:

• Identifying phishing attempts and suspicious attachments.
• Verifying the authenticity of emails, especially those involving sensitive financial transactions like wire transfers.
• Reporting unusual or suspicious activities to the IT team.

Teaching staff to double-check unusual requests, such as using a phone call or a verified secondary communication method, can prevent many common fraud tactics.

3. Implement External Email Warnings

An external email warning message can help employees spot potential phishing attempts. If an email claims to be from a co-worker but includes an external warning, the recipient should immediately verify the legitimacy of the message through another channel before engaging with it.

4. Register Typo-Squatting and Doppelganger Domains

Criminals often exploit look-alike domains to trick users into believing emails are from trusted sources. For example, “4Bls.com” might resemble “4BIs.com” in certain fonts (capital L’s and lowercase i’s are identical in the Outlook font). Companies can register similar domains to protect against these attacks, ensuring that bad actors can’t use them for phishing or business email compromise. Contact 4BIS to run an audit for potential doppelganger or typo-squatting domains.

5. Advanced Spam Filtering

While spam filters can stop many malicious emails, they aren’t foolproof. Some legitimate email gets blocked while dangerous email can make it through. Regularly review what gets trapped in spam folders and ensure employees know how to check them for important messages that may be mistakenly flagged. Fine-tuning these filters can reduce false positives while enhancing security.

6. Establish Policies and Procedures for Financial Transactions

Wire transfers, invoice payments, and other sensitive transactions are prime targets for cybercriminals. Establish strict policies requiring verification through phone calls or other means before executing any large financial requests. Define thresholds for when a second-level verification is necessary, especially for unusual orders or payment changes.

7. Limit Data Stored in Emails

Many businesses unknowingly store sensitive information like passwords, Social Security numbers, and bank details in email archives. If accessed, this data can be exploited by hackers. Regular audits should be performed to clean out old, unnecessary data from email systems, minimizing the risk of exposure.

8. Harden Microsoft 365 Settings

There are several steps businesses can take to secure their Microsoft 365 environment, including:

• Turn on audit logging: Audit logging isn’t enabled by default but is crucial for tracking and identifying suspicious activities.
• Use separate administrator accounts: Admin accounts should be distinct from daily-use email accounts, reducing the risk of an admin breach.
• Set conditional access policies: Limit logins from countries outside your business’s operational area to reduce the chances of unauthorized access.
• Reduce web session timeouts: Limit inactive sessions to one hour or less, so if a hacker steals a session token, they won’t have prolonged access.
• Consider blocking browser sign-ins: If your users never need to access Microsoft 365 through the web browser then consider blocking access to it. This limits the ability of hackers to steal authenticated session tokens.

9. Microsoft Defender for Office 365 (Formerly Advanced Threat Protection: ATP)

A Microsoft email protection package designed to help lock down threats to Office 365. A great feature is safe-links and safe-attachments. Microsoft opens links and attachments to verify their legitimacy. This is not perfect and some malicious content still gets past the net but it does greatly reduce the obvious attacks.

10. Utilize Managed Detection and Response (MDR)

MDR solutions continuously monitor email systems for indicators of compromise (IoCs) such as unusual logins, email forwarding rules, and other suspicious activities. By proactively detecting threats, MDR can often mitigate attacks before users even realize they’ve been compromised.

11. Backup and Recovery

Ensure that all critical emails and data are backed up. In the event of a compromise, having a reliable backup system in place will allow you to recover deleted or corrupted emails, minimizing the damage caused by the attack.

Conclusion

Cybersecurity is a process, not a one-time fix. Implementing these strategies across your organization will help you stay ahead of cybercriminals and protect your business from email-related threats. Regular training, combined with advanced tools like MFA, MDR, and spam filtering, create a robust defense. If you need assistance securing your Microsoft 365 environment or implementing these best practices, reach out to 4BIS. We are cyber security experts located in Greater Cincinnati who can help you build a comprehensive strategy tailored to your business needs.

By staying proactive and continuously improving your email security, you can significantly reduce the risk of becoming the next victim of cybercrime.