Managed Email Security

The SOC team continually monitors user accounts for indicators of compromise, analyse reported phishing emails, ensures that systems work correctly, and adheres to security best practices.

All platform change requests are conducted with ITIL change management, ensuring that changes and completed with the proper authority and implemented securely with sign off by a technical specialist.

Emails reported as suspicious are analysed by our threat hunting team to determine factors such as the level of sophistication in techniques used and the determination of the threat actor. In a Targeted or Advanced Persistent Threat event, the phishIQ threat hunting team will produce a report and offer recommendations to limit user vulnerability.

If a suspected compromise is discovered, an Incident Responder will perform an initial triage of the incident to determine a timeline of events and provide recommendations on a response strategy.

*All user accounts must be protected with Multi-Factor authentication to be eligible for Incident Response Triage.

Monthly reports are provided detailing training progress, individual staff risk scores, a summary of events and security recommendations identified from phishIQ Insight.

All consultancy and managed services come with access to our Risk Management Portal. All risk types including technical, human, residual and inherent, are allocated a score, allowing for a strategic approach to risk reduction.

Every email is checked for threat metrics, including:

• If the sender has previously messaged the user before
• If the sender's name is often associated with another address
• If the sender's name is similar to someone in your organisation
• If the sending address is similar to your own organisation
• If the sender's FROM address matches the reply address
• If suspicious links were found in the email
• If the sending organisation is missing security measures and can be impersonated
• If non-english characters were found in the message
• If non-english (similar looking) characters were used in the sending address
• If the sending address is imitating a well-known website
• If the sender is using phrases commonly used in phishing attacks
• If the sending email domain has recently been registered

When a new user starts in your organisation, we will ensure that they are set up with phishIQ and receive their initial training.

With phishIQ, you will have access to our Cyber Intelligence services, including monitoring for email health, credential leaks and chatter relating to your users on the Dark Web.

We provide tailored training to increase technical and general awareness of cyber threats such as phishing, ransomware and social engineering. All training is aligned with business goals and designed to be time effective, and we only train staff on what they need to know.

Train users to spot the latest phishing attacks using benign samples that track users who read, reply, click links, open attachments, and supply credentials. Our adaptive training tracks users via a risk score, those who are susceptible to phishing receive additional tailored training.

Use our Platform to distribute company policies to employees and contractors, track acknowledgement and the time spent reading them.

We continuously monitor the company's SPF, DMARC and DKIM records to ensure your organisation is always protected from impersonation attacks while processing the DMARC reports providing Insight on attackers attempting to impersonate staff to attack your customers.

With phishIQ + Platform, CSIQ's SOC team will manage each security feature and ensure the Platform is operating smoothly.

Using a combination of Reputation-based email filtering, whitelisting, blacklisting and Bayesian content analysis, we filter the majority of all spam. If a spam email does get through, users report it to the SOC team to ensure it is blocked for everyone.

All attachments are run within a sandbox environment to ensure they are safe to run before being delivered to the user. Malicious content will be quarantined, and the user will be informed. Users can contact our SOC team for further advice.

In the event that Microsoft 365, G-Suite or on-premise Exchange technical issues, emails will be queued and accessible within the emergency inbox allowing the business to continue operating with minimal disruption. Once services are restored, all emails are replicated back to the mailbox.

Ensure sensitive information cannot be read by anyone but the recipient by encrypting the email with end-to-end encryption. The recipient will be notified of the encrypted email waiting for them and invite them to login to the Platform to access it. Encrypted emails can be automatically purged after a defined period.

All URL's are rewritten in the email message body and logged centrally, links to websites and files are scanned to protect users from accessing malicious content.

Email digests are sent to the users periodically, summarising all emails identified as spam, allowing users to release and manage personal white / blacklists.

Filter inbound and outbound emails based on conditions, including sender and recipient address, email size, source country, subject, email headers, message types and keywords.

Prevent accidental or malicious data loss. Emails containing key phrases such as UK National Insurance and patient numbers, Taxpayer references, driving license numbers, health and financial identifiers can be quarantined and marked for review to ensure that sensitive information does not leave the organisation through email.