Secure Email Gateway: A Firewall for Your Inbox

Email is the most popular form of communication for businesses. An estimated 4 billion people use email every day, and nobody is more aware of that fact than cyber criminals.

That’s because email is also the most popular place to initiate a cyber attack. Viruses, phishing, ransomware — it can all be traced back to email. And these cyber attacks are only becoming more targeted and more sophisticated by the day. 

What is a secure email gateway?

A secure email gateway (SEG) is a type of software that protects against email-based attacks. It prevents emails that contain malicious content from reaching the intended recipient and can protect your business from falling prey to a cyber attack.

How does a secure email gateway work?

A secure email gateway is like a firewall for your email. It scans incoming and outgoing emails to determine if any malicious content is hidden inside.

If the email is safe, it passes through and arrives in your inbox as it normally would. But if the email is deemed a threat, the SEG filters the email and prevents it from reaching you and causing damage.

Why are secure email gateways important?

Secure email gateways are especially important for businesses. Whether your business has 3 employees or 300, each person is a potential target for a cyber attack — and even one incident can cause irreparable damage.

More than 50% of At-Bay’s cyber insurance claims in 2020 were the result of phishing attacks — incidents that are often preventable with a secure email gateway. What’s more, 67% of those phishing attacks were experienced by businesses that did not have SEG in place.

A comprehensive secure email gateway is able to strike a balance between protecting inboxes from malicious content and ensuring all legitimate email still gets delivered. The SEG needs to be able to detect what’s good and what’s bad with high precision — the consequences being as extreme as a ransomware attack and as painful as a missed opportunity due to an undelivered mail from an important customer.

Additionally, secure email gateways are constantly evolving to keep up with cyber criminals, which is why it’s crucial that all of these protections stay up-to-date. Whether it’s a new malware, malicious domain, or pattern out in the wild, the SEG software needs to update itself ASAP to keep you and your business protected.

Who needs a secure email gateway?

Businesses of all sizes, and in all industries, can benefit from a secure email gateway. A report by Sophos indicated that, as ransomware attacks continue to increase in both frequency and severity, it’s more important than ever to improve your business’ security and protect against cyber attacks.

In particular, At-Bay has identified 6 industries within our portfolio that are especially vulnerable to ransomware:

• Construction
• Engineering firms
• Law firms
• Manufacturing
• Public administration
• Wholesale trade

In fact, these 6 high-risk industries are experiencing ransomware attacks 2X as often as other industries. 

Only 33% of these high-risk businesses had a secure email gateway in place on at least one domain at the time of quoting, according to At-Bay security data, and just 22% had implemented SEG on all domains.

What does a secure email gateway provide?

Most secure email gateways offer the following key features:

• Phishing protection
• Spam filtering
• Virus and malware blocking

Let’s look at how each feature can help protect your business.

Phishing protection

Phishing attacks can put your entire business at risk in a single click, which makes this the single-most important feature of a secure email gateway. Here’s an example of how it works:

A cyber attacker creates fake landing pages in an attempt to steal credentials for remote access systems and email inboxes. They use a similar-looking domain name and send phishing emails to some of the employees at a business, telling them to click on a link. If an employee clicks on the link, they’re prompted to “log in” with their credentials on the fake landing page. And once that happens, the cyber attacker can harvest their username and password for future malicious use. 

The SEG is able to stop this type of credential harvesting in its tracks. By using URL reputation checks and active analysis, an SEG prevents the emails containing a link to the maliciously created landing page from ever making it to the inbox.

Spam filtering

The secure email gateway uses a filtering technology that either blocks or quarantines emails sent by known spammers. The SEG can detect patterns and tactics that are commonly used in spam emails, such as malicious links and keywords. SEGs also provide controls that let you manually block and report suspicious emails that make it into your inbox, as well as senders.

Virus and malware blocking

A secure email gateway can prevent hidden viruses and malware from sneaking into your inbox and infecting your entire business network. Similar to spam filtering, the SEG uses antivirus technology to identify and quarantine emails that contain malicious attachments and links.

How can At-Bay help with secure email gateways?

We conduct a sophisticated security scan of every business we quote to ensure a secure email gateway is in place. If SEG is not yet implemented, we recommend looking for these capabilities when selecting SEG software:

• Anti-malware
• Anti-spoofing
• Data loss protection (DLP)
• Sandboxing
• Secure encryption
• Threat intelligence and protection

Unless a business’ main email provider is Gmail, At-Bay recommends implementing a secure email gateway. Gmail includes stronger default security controls that help to identify phishing attacks.

Other popular software, like Microsoft’s Office 365, comes with low default security controls that are often unable to detect phishing attacks. For businesses using Office365, we recommend implementing Microsoft Defender with Advanced Threat Protection or one of the following email security vendors:

• Mimecast
• Sophos
• Appriver
• Proofpoint
• Intermedia
• Barracuda

For all other email providers, a secure email gateway can be implemented with a security vendor. 

Calculate your cyber risk with our Cost Calculators

About At-Bay

At-Bay is the InsurSec provider for the digital age. By combining world-class technology with industry-leading insurance and security expertise, At-Bay was designed from the ground up to empower businesses of every size to meet cyber risk head on. Our InsurSec approach provides end-to-end protection for modern businesses. It’s a force multiplier that includes security, threat intelligence, and human experts to close the SMB cybersecurity gap — all as part of their insurance policy.