Why Email Still Works for Attackers

Hi, I'm Joan Goodchild with CSO and welcome to another episode of Cyber Sessions. This week we are at the CSO Cybersecurity Awards and Conference here in Nashville and I'm joined by Ryan Toscano.

He is the director of Data and email security with McDonald's and he'll be speaking in one of the sessions this week at the event. So welcome, Ryan. Thank you for joining us.

Thank you very much for having me.

So you're going to be talking about sort of, you know, the success that you saw with your team as part of a data security project that you guys undertook with McDonald's.

So let, so let's kind of like get into sort of the, some of the details around the issues around that. First of all, email has been, you know, a primary attack vector for years. We've been talking about this and it really still doesn't change.

Even though people communicate so many other different ways, why is it such a effective entry point for attackers despite all of the awareness and all of the security tooling that's sort of layered around this?

Yeah, because email is still widely used across every single business around the world. I don't see that going away anytime soon. So, you know, threat actors and attackers know that everyone's paying very close attention to their email. They want to respond right away.

They're privy to, okay, I might get a link. I need to respond. I can click on DocuSign, respond to. So I think until we get out of the world of using email every single day, all day, then it's going to be consistent threat venture. Yeah.

So going anywhere to not. In high volume consumer environments, security teams need to sometimes balance protection, usability, speed, customer trust, kind of all at once. So where do you think organizations are making the biggest mistakes when it comes to protecting sensitive data at scale?

Yeah, I believe it's operating on both ends of the spectrum. So what I mean by that is allowing everything to happen. You know, data can move or be stored or used in any way. Right.

You don't really have any guardrails in place, but you allow the business to move at speed, but there's no protection.

Or you go the other end where you prevent everything and you put so many protection and guardrails in place that they feel hamstrung and they can't do what they need to do to get their job done.

And so what we're trying to find is that right balance of securely enabling the business, especially with the use of AI now as well, so they feel protected. There's nothing Happening in the background. They can get their work done, they can do their job.

But we know that we're also protecting the data as best as possible.

Now security teams, as we know, are really inundated with alerts all the time. There's just so much noise out there, dashboards, telemetry that they have to deal with.

From your perspective, what do you think actually meaningfully reduces risk in a meaningful way versus what simply creates kind of operational noise and analyst fatigue in these kinds of environments?

Yeah, you know, this week at the conference, there's been a lot of discussion about context and understanding context around an activity or access to data and just understanding your business, like what are your key business processes, your key business assets that you need to focus on, protect, understand what data is stored in that asset or the data stored was access to your admin console.

And so just focusing on what matters most and then what's the context, how is it allowed to be used or not used and layering on your protections to align to that.

We know that criminals are constantly evolving their techniques and finding new ways to exploit. And they are really effective, of course, at exploiting human behavior, especially phishing impersonation. We're hearing the different ways AIs are now being used as an attack vector and of course, social engineering.

Do you think that organizations are still approaching email security too much as a technical problem and not enough as a behavioral one?

I think it's actually a little bit of. I believe there's more. Some go. And so with technology leveraging the email security vendors to help protect these behavioral threats. So, you know, a lot of times now with phishing emails, there's no link and the email is no attachment anymore.

And it looks like it's coming from a legitimate center. Sometimes it does. And so just understanding, okay, this is a little off, right? Or this individual has not received an email from this domain ever. Right.

Why are they being asked to respond with their phone number, their address and so on flip side though, so having the tech be able to better detect data for that through getting a mailbox or removing it very quickly.

But from a behavioral perspective, instead of just doing quarterly phishing campaigns or annual like required training that people are going to click through, I always talk about the conference as well, get more point in time, that run time, if you will, of the person, but being able to give them very targeted, quick trainings on real world scenarios that they can notice and be able to say, oh, you know what, that's free.

I respond to that. Or Click on it. And so improving both, really, especially in the world of AI now, I think it really cares now.

What worries you more kind of, you know, when you look into the future as a security professional, the sophistication of the attacks themselves and how those continue to evolve or the growing complexity of the environments that defenders are also trying to secure?

I definitely worry about the sophistication of the attacks, but I believe that it's more so the application of the environments, you know, especially even with McDonald's or hybrid cloud environment, SAS apps being used now with shadow AI being used.

And so just the vector that attackers can now go after, especially if they have, is going to continue to expand.

And so I'm more worried about understanding that question is of where is our most important data, where our most important systems cause access to them and being able to focus there and protect that. Because if you try to prioritize everything it's been, it's going to be wide open.

And so I'm more concerned about being close to the market going forward. Great.

Well, Ryan, thank you for joining us today.

Thank you so much for having me. Really appreciate the conversation.

Okay, thank you and thanks to you for watching. We'll be doing lots of other videos from here at the CSO Cybersecurity Conference and awards, so please be sure to check those out. For now, I'm Joan Goodchild with cso. We'll see you next time.