There are two MAJOR problems at my company (as in several others also I presume).
- Users clicking on links in phishing emails.
- Users opening (and running) malware-infected attachments.
Yes, I should block attachments and I do. Everything but PDF, excel, word and ppt which I simply can't unless we want to go out of business. Everything else is blocked on server level.
Yes, I know that the users should be educated. They are. But they still click links and open attachments. More education? Sure, but I will never reach 100%. Not even 75%. So what is the solution? We run both IDS and IPS with 24/7 monitoring via a SOC. All emails are monitored and all attachments run in a sandbox before being delivered to end users. URLs in emails are also checked (via third party solution against a cloud-based blacklist). And on top of this, all clients run a multi-layered endpoint antivirus. End users are STILL being infected since attachments contain new strains of malware or 0-days and URLs have not yet been blacklisted. I believe that certain easy solutions are overlooked in general regarding phishing. Do you agree? (See below.)
We use Outlook as an email client and the questions I ask myself every single day is why Outlook doesn't have better phishing protection. For example:
Why doesn't Outlook check if the link text contains a URL that is different from the
<a href-URL>. Why should the user have to hoover every URL and make their own decision?
Why doesn't Outlook check if the FROM field differs from the envelope email header? The oldest trick in the phishing handbook. Why should I let the users try to notice this themselves?
Why can't I ask Outlook to scan all emails for certain "dangerous phishing words" like e.g. FedEx, Visa, Mastercard, password, bank account, reset password, confirm account etc etc. Yes, I know about DLP but now I am talking about a client-side solution for incoming emails.
Why on earth is it not possible to turn off ALL links in ALL emails in Outlook? As far as I know it is only possible for plain text emails. This will not make it 100% secure, but at least it will prevent people from clicking links without thinking (i.e. copy-pasting).
Why can't Outlook notify a user that the email they just received is from an unknown sender (i.e. not in their address book) and has an attachment? All in all, this is often highly suspicious.
The above is just very simple things that could be implemented within the email program on the client side and make life easier for end users and for sysadmins.
What is it that I am missing in this line of reasoning? It must be something since this is not implemented in any email software. Or is it? Any thoughts about this are greatly appreciated.