Email is a critical business process.
Phishing, mailbox compromise, and executive or vendor impersonation can lead to credential theft, malware spread, data exfiltration, and fraudulent payments. To reduce the risk, it is necessary to combine technical configurations, monitoring and verification procedures.
Technical checks
- analysis of SPF, DKIM and DMARC and related adoption path;
- checking anti-spam, anti-phishing and attachment protection filters;
- MFA and conditional access on the most exposed accounts;
- control of forwarding rules, authorized applications and legacy protocols;
- access logging, alerts on anomalous behavior and retention;
- Protection of similar domains and management of impersonation attempts.
People and processes
The training sessions and simulations are adapted to the roles: administration, purchasing, sales and management are exposed to different scenarios. Email-independent procedures are defined to confirm IBAN changes, urgent requests, password resets or sending confidential documents.
Deliveries
- analysis of configurations and main gaps;
- remediation plan with priority;
- aggregate results of simulations, without punitive approach;
- training material and internal reporting procedure;
- indicators to measure reports, response times and improvements.