Security Manager's Journal: Spam makes a comeback

How could spam be an issue for a security manager in 2013? It's been years now since we all started subscribing to services that do a phenomenal job of filtering out advertisements for prescription medications and exotic vacations and dumping them into spam folders, where they usually accumulate and never bother anyone.

Trouble Ticket

A change in the email system has let some dangerous spam show up in inboxes.Action plan: Stay alert for evidence that employees have fallen victim to phishing attacks.

Until this past week, I likely hadn't spent five minutes in 10 years thinking about spam -- a testament to the effectiveness of spam filters. After all, about 98% of our incoming email is spam. If we didn't have effective spam-filtering engines, every employee would receive an extra 40 to 50 emails per day. That would hit productivity.

Probably because real spam has long been out of sight and out of mind for our employees, our general counsel was dismayed when he recently started regularly receiving emails that he deemed to be spam. He forwarded some of them to me, wondering what was going on. The emails purport to be from organizations such as ADP, FedEx and eFax, and at first glance they look legitimate. Only an inspection of the email headers would tell you otherwise.

Some of the emails contain links to questionable sites in places like China and Russia. Some include attachments that are supposedly required certificates or e-fax documents but in reality are zip files containing an .exe file. In short, these are not ordinary spam -- which is annoying and clogs networks but is generally benign. No, these are phishing attacks.

Soon, others in the company began to complain about an increase in spam. Why, I wanted to know, weren't these phishing attacks being intercepted and shuttled away from employees' inboxes?

I was aware that we have been migrating users to a managed Microsoft email service and that there had been talk of saving money by dropping our current spam provider in favor of Microsoft's spam prevention system, which is bundled with the mail service. I figured that was likely the root of the problem, and sure enough, my suspicions were right.

We previously had not only inspected attachments, but also restricted the types of attachments authorized to be delivered. We also had what is called Sender Policy Framework checking enabled, which verifies that senders are really who they say they are. When the email team migrated our email, they neglected to enable these critical security functions. And thus spam has become an issue of concern for me in 2013. Now, employees potentially could click attachments or links and execute malicious programs.

Luckily our endpoint protection software prevented most of the attachments from causing harm, but there wasn't 100% detection. As a result, I'm having my security team analyze the suspicious email attachments and links that have been identified and build rules in our security incident and event management tool to look for evidence that employees have clicked on any of them or downloaded nefarious software.

We have also recently enabled a really cool feature within our Palo Alto Networks firewalls called Wildfire, which redirects executable files to a secured sandbox, where it evaluates the program to determine whether it is malicious. Unfortunately, since this is a new functionality, we're simply monitoring the events and haven't yet enabled blocking.

We've had to take action a couple of times, but we've been lucky so far. For example, one attachment that was executed by several employees proved upon evaluation to be programmed to reach out to a server in China to download additional software. Luckily, the server in China had been taken down.

Now, we have to continue to monitor for suspicious activity, and I need to ensure that our current email architecture is deployed in a secure manner.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at

Join in the discussions about security!

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags securityFedExMalware and Vulnerabilities

More about FedExMicrosoftPalo Alto NetworksTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Mathias Thurman

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts