Email security is considered the number one way hackers are getting into a business so it is absolutely critical enterprises have an understanding of the subject. Keith Bird, Vice President of Northern Europe, Middle East & Africa, Proofpoint, discusses how the company aims to help enterprises secure their infrastructure by educating employees first.
Proofpoint, one of the top five cybersecurity businesses in the marketplace, focuses on the importance of email security and considers this its heritage.
The tech vendor generally looks at cybersecurity through the eyes of individual staff members. According to Keith Bird, most companies concentrate on securing their infrastructure, but the hackers operate through people with the aim of attacking individuals. Proofpoint therefore protects a company’s biggest asset – their staff – via email security.
We spoke to Keith Bird to find out more about email security – he offers tips to notice alarming activity on a network and discusses the cybersecurity trends occurring throughout Europe.
How does Proofpoint aim to help customers?
About 94% of all vulnerabilities and hacks are done by somebody clicking on a link they shouldn’t have or opening a harmful attachment, and 96% of that 94% is through email. So, we protect companies’ email systems and their individuals. We also do something called email fraud defence which protects companies as well.
One of the biggest areas of growth for our company is security awareness training. The biggest thing we can help companies with is educating their employees first. If we can educate them on avoiding clicking on certain things, they’re not going to get into difficulties in the first place. Security awareness training is online training which our customers use in many different ways but one of the key elements of it is called phishing simulation – our customers can actually do an internal phish simulation inside the organisation and when employees click on things they shouldn’t have, it is done in a safe environment. This allows for bespoke internal trainings.
Can the approach to educating users on what to avoid be improved?
We must remember that for most employees in a company, understanding cybersecurity is not their core competency. In fact, it’s so far removed from their core competency that they’re really not to blame. The progressive companies are those that are looking at security awareness training to educate their customers and be proactive about it.
So, what most of our customers do is utilse our solutions upfront, which is part of the induction process, so when a new employee joins the company they go through a series of trainings to hopefully stop them from doing things they shouldn’t inadvertently.
However, it’s not enough to just do the training when somebody first joins because three years down the line, they will have forgotten what they did in those first few weeks. This is where the second element of the security awareness training solutions we offer comes into play. Our customers can use our solutions to carry out an internal phishing simulation attack and that way it’s in a safe environment, allowing the company to understand which employees know which attachments to avoid and who needs extra help. So instead of coming down really hard on people who’ve had induction training but haven’t had professional training since, it’s a really effective way to decipher between those who are in need of further cybersecurity training. So, we say make it part of the induction process but then have an ongoing programme where you can identify people that need to develop their cybersecurity awareness.
How would you describe the current cybersecurity landscape in Europe?
If you look at all of the solutions we provide, they’re addressing the biggest vulnerabilities which is currently email as well as social media. Everyone is using social media which is why we have solutions to protect companies but also their employees while they’re active on social media sites. Another example of this is people using their own email systems at work such as Hotmail. So, we have a system called Proofpoint Browser Isolation and this gives employees the chance to use their own email systems at work but in a protected, isolated environment.
Another example is the thousands of cloud applications which are increasing by amount, so we have a number of solutions that aim to protect companies. Email is where the biggest vulnerability derives from. The interesting statistic is that 94% of hacks are coming through people clicking attachments and links, 96% of that is through email but if you look at customers’ IT spending, particularly around security spending, the average is something like only 8% of most companies’ security budget is spent on these areas. Most companies are focused on securing infrastructure but that’s not where the threats are coming from.
Do you think there are any Europe-specific countries that need to be improving their cybersecurity approach?
It’s an issue across the board – the bad guys don’t discriminate. It doesn’t matter which market, country, or vertical sectors you look at, it’s the same everywhere. They are extremely targeted so if a hacker discovers a vulnerability, they will keep going until the vulnerability is stopped. We see it happening in all countries and markets, there aren’t any that really stand out. Typically, the regulated industries have very good processes around this but generally everyone is facing the same challenge, particularly as employees are using social media more regularly.
Are there any major cybersecurity trends that stand out across Europe?
We’re increasingly noticing that customers are placing more and more focus on email security because it is absolutely the number one way hackers are getting in and we’re seeing this change occur in large enterprises. The issue for some of the smaller organisations that don’t have the budgets or perhaps the resources or knowledge is that they are vulnerable. Bigger enterprises often understand the importance of having email security but many of them went to the market three or four years ago, chose an email security solution and then haven’t returned to see what else is now available.
We encourage potential customers to do a couple of things; first of all, we can help them identify what we call their Very Attack People. These are different to VIPs – Very Attack People are the people in an organisation being attacked and the targets are usually very surprising. It isn’t necessarily the CFO – although they are undoubtedly a high-level target – it’s often people you wouldn’t consider such as the customer services manager or an individual engineer as they have access to the information that the hacker is seeking. So, we say to people that we can help them identify those Very Attack People.
Secondly, if you haven’t been out to the market and looked at your email solution for a good three or four years, give us a chance to do a proof of concept for you. We find that when we do a proof of concept with customers, they’re often surprised at how much we’re catching that other competitors haven’t. So, I think it’s really important, given email security is the biggest vulnerability of all, that all companies including the small enterprises who might not even think about it, take another look at the market.
With so many security companies in the market today, how does Proofpoint stand out?
I would say there are two things; firstly, we’re a leader in the Gartner Magic Quadrant which is really important and gives customers that comfort factor. Secondly, the fact we look at security with a people-centric approach is so important because the technology and software should follow. What’s most important is who the people are that are being attacked and how we can protect them. We find people in the very highest part of an organisation still clicking on harmful links. So, even after trying to educate people, they still might click on these links, so you need to make sure you capture as much as possible. We see 600 million emails that we’re protecting each day where we identify attacks and stop them. This is a huge number and means we have the best intelligence network in the business and that’s what matters.
