Email is the primary conduit hackers use to unleash ransomware, phishing attacks, business email compromise (BEC), and other sophisticated threats against an enterprise. That’s why secure gateways (SEGs) scan incoming and outgoing emails for malware, quarantine risky attachments, and prevent sensitive information from leaving the network.
They also categorize web traffic based on application and data, which allows policy enforcement per regulatory requirements.
Spam Prevention
Emails are one of the simplest ways hackers attack organizations. By intercepting emails and their attachments before reaching users, they can infiltrate networks, compromise devices or steal sensitive information. Fortunately, secure gateway solutions work as pathways and security walls, blocking harmful content before it can reach end-user devices or network resources.
Most SEGs feature advanced spam filtering capabilities to stop inbound and outgoing messages containing malicious elements. This includes content filters, DMARC authentication, and SUBRL checks (point-of-click verification).
When an incoming message is detected as spam, it goes through a series of tests to ensure it hasn’t been weaponized or used to send malware or phishing threats. These checks can also include heuristic analysis to determine whether a message is likely a BEC scam, as criminals often camouflage themselves in corporate branding or co-workers’ names to trick employees into opening or following their instructions.
SEGs can be deployed as either on-premises appliances, software, or a cloud service. The choice will depend on a company’s preference for data and services to be hosted within their infrastructure or whether they prefer to utilize a hybrid solution with both on-premises and cloud options. Companies deploying on-premises hardware will be responsible for the purchase, maintenance, and ongoing upgrades of their SEG. Those choosing to deploy as a cloud-based service will have these tasks handled by their security vendor.
Malware Detection
Email is the primary means of communication for organizations, but it’s also one of threat actors’ most common attack vectors. Attackers use email to deliver malware in 94% of all reported cyberattacks. Because of this, it’s crucial to have a solution that prevents the email channel from being exploited. That’s where an email gateway (SEG) comes in.
An SEG is a software, hardware, or cloud-based system that monitors all incoming and outgoing emails. It spots unwanted traffic, such as spam, phishing expeditions, and malware, before they can reach the intended recipients. SEGs can be deployed as an on-premise appliance or in the cloud based on a company’s comfort level with data and services outside its network.
Most email gateway architecture solutions provide robust malware detection features utilizing anti-virus technologies to scan for and detect malicious URLs or attachments. Heuristics and behavioral analysis are often applied if a file signature is not found, and suspicious files can be quarantined for further inspection. Many systems also incorporate authentication checks (SPF, DKIM, DMARC) to prevent domain and sender spoofing.
SEGs protect against social engineering attacks such as phishing and business email compromise (BEC) by intercepting and blocking messages and, in some cases, redacting sensitive information from outgoing emails. Many SEGs also include email archiving capabilities and continuity functionality to protect against loss of business productivity and a range of reporting and management dashboards to improve overall security visibility.
URL Filtering
Unfettered web access can make employees more productive and expose an organization to various security risks. Malware, spyware, adware, and phishing attacks can be downloaded to employee devices and transmitted throughout an organization’s network. With a robust URL filtering solution, organizations can prevent users from visiting sites unrelated to work or containing inappropriate content and protect the device, data, and bandwidth used to operate a business.
A good URL filtering solution allows organizations to tailor policies based on the time of day or individual user locations. This enables employees to use cloud storage to transfer files for clients but still blocks them from logging in to their company’s accounting software after hours. This customization is critical for impeding malware propagation, preventing phishing attacks, and limiting employee vulnerability to ransomware and whaling threats.
The most effective URL filtering solutions provide real-time classification of more than 500 million websites and report categories in a single dashboard. These category placements result from local lookups on the appliance and queries to a master cloud-based reputation database. In addition, many secure web gateways leverage SSL inspection to perform additional security tasks on incoming and outgoing connections. This includes performing blocklist checks, URIBL/SUBRL filters, and categorizing the most malicious URLs in messages.
Authentication
Email authentication protects against phishing attacks that spoof your company’s domain(s). The protocols (DMARC, STARTTLS, and SPF) ensure incoming emails come from a legitimate source.
To authenticate a message, the email gateway sends a challenge to the mail user agent, that must answer correctly before sending the message. The reply is verified on the mail server before it is accepted. This method protects organizations from spoofing by impersonating their email servers.
The email gateway can also verify the identity of recipients using a chain query. A chain query consists of multiple LDAP queries re-run sequentially for each rewritten email address until the LDAP server returns a positive response or times out.
A security gateway can be deployed on-premises, in the cloud, or as a virtual appliance. The choice may depend on your comfort level with services and data existing outside the boundaries of your network and the types of threats you are concerned about. It is also a matter of the complexity of essential and additional security functions and ease of management. A security gateway can be a complex beast, so choosing one that suits your needs is critical.
