Menaces courantes pour la sécurité du courrier électronique
Voici quelques-unes des principales menaces qui pèsent sur la sécurité du courrier électronique :
Phishing
Les attaques par hameçonnage sont les menaces les plus connues et les plus courantes pour la sécurité du courrier électronique. Les attaques de phishing ont commencé par des attaques comme la fraude du prince nigérian, connues pour leur mauvaise grammaire et leurs prétextes invraisemblables. Au fil du temps, ces attaques sont devenues plus sophistiquées, les attaquants envoyant des courriels beaucoup plus élaborés avec des prétextes plus plausibles.
The modern phishing attack can be general or targeted. These targeted attacks, also called spear phishing attacks, are highly researched and designed to trick a particular person or group.
Business Email Compromise (BEC)
One example of a common spear phishing attack is business email compromise (BEC). In a BEC attack, the target is tricked into sending sensitive data — or more commonly money — to the attacker. BEC attacks have become one of the most significant and expensive phishing attacks that companies face. According to the Internet Crime Complaint Center (IC3), BEC attacks between the years 2013 and 2022 caused an estimated loss of $50 billion.
Logiciels malveillants
Email is an ideal delivery mechanism for malware. Malware can be attached directly to an email or embedded in documents that are shared as attachments or via cloud-based storage. And once installed on a computer, malware may steal sensitive information or encrypt a user’s files.
Perte de données
Les comptes de courrier électronique donnent accès à un grand nombre d'informations sensibles. Outre les données envoyées directement par courrier électronique, ces comptes sont également utilisés pour accéder à l'infrastructure basée sur le site cloudet à d'autres services en ligne.
An attacker with access to these email accounts can gain access to all of this sensitive information, making email account credentials a common target of attack. Additionally, this information can be leaked by employees who accidentally include an unauthorized party on an email chain or fall for a phishing attack.
Liens malveillants
Les liens malveillants sont l'un des moyens les plus courants utilisés par les cybercriminels pour exploiter le courrier électronique. Grâce à un lien intégré dans un courriel, un pirate peut diriger le destinataire vers une page web qu'il contrôle.
These phishing pages can be used for a variety of different purposes. Phishing pages can be designed to steal user credentials or deliver malware. Regardless, they can cause serious damage to an organization.
Account Takeover
In an account takeover (ATO) attack, a cybercriminal gains access to a user’s email or other online account. This is usually accomplished by stealing the user’s login credentials via phishing, credential stuffing, malware, or similar means.
Once an attacker has control over a user’s email account, they can abuse it in various ways. For example, the user’s email might be used in a spear phishing attack, to send out spam, or to gain access to other accounts by requesting password reset emails to be sent to the compromised account.
Spam
Spam is unwanted email sent out via mass mailers. Spam can be used for various purposes, ranging from marketing efforts by legitimate companies to attempts to infect the target computer with malware.
Quishing
Quishing is a form of phishing attack that uses QR codes. Emails will contain an image of a QR code, which, if scanned, will direct the user to a phishing site designed to harvest login credentials or infect their computer with malware.
Quishing attacks are designed to take advantage of the fact that a user is likely to scan the code presented in an email using the camera on their mobile device. Since personal smartphones are likely unmanaged by the company, this provides a means for the attacker to bypass the organization’s security controls.
Commentaires