How Does Abnormal Security Address Cloud Email Attacks?

This article is the fourth in a five-part series from Ed Amoroso at TAG Cyber. You can read part one here, part two here, and part three here.

Using innovative security platforms to reduce the risk of email threats is no longer optional. Rather, modern email security solutions are a mandatory component of all protection architectures. This is not to say that complementary options such as procedural controls and security awareness are ineffective, but the intensity and velocity of inbound email attacks have increased to the point where sophisticated technology solutions must be engaged.

In this article, we explain how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email. We explain the platform and provide an overview of salient aspects of the offering, including how behavioral AI and API integrations offer unique value for enterprise buyers.

The cybersecurity platform from Abnormal Security leverages artificial intelligence (AI) to detect the presence of fraud or other attacks in enterprise email systems. The platform works by collecting and analyzing data from identities and their email communications for the purpose of making decisions—as with any AI system—which in this case, focuses on whether a threat is present in the communications.

Abnormal analyzes key information including:

• Sender Identity – This has always been an important consideration in email security, but advanced AI can leverage more data and better algorithms to make determinations about the integrity of the sender.

• Message Contents – This has also been a critical aspect of email security systems for many years, but as malicious email content has become more complex and contextual, the AI in the Abnormal platform can make better determinations related to security. This is especially true for text-based emails that have no typical indicators of compromise, as is often the case with socially-engineered attacks.

• Attachments and Links – The attachments and links included in any email must be viewed as potentially dangerous, especially links to websites that could include malware or other threats to the recipient or recipient’s organization. Abnormal takes this a step further by understanding where second-stage links direct and the potential malicious nature of them.

The cloud-based platform can be natively integrated with the cloud email services in use at the enterprise—either Microsoft 365 or Google Workspace. The connection is done via Microsoft or Google APIs. This is different from a traditional SEG approach as it requires no email rerouting (changes to MX records), deploying quickly with no interruption to email flow.

The Abnormal solution triages, remediates, and builds a repository of email detections available to third-party solutions like SIEM, SOAR, and XDR platforms. This includes the results of analyses performed on user-reported phishing emails through Abuse Mailbox or potentially compromised email accounts identified by Account Takeover Protection.

This interoperability increases the visibility and fidelity of events identified across the security stack, helping security teams better understand potential threats—and reducing response times as well as time spent on the investigation.

Customers can leverage out-of-the-box integrations to platforms, such as Splunk, QRadar, Microsoft Sentinel, Cortex XSOAR, Okta, and many more. The Abnormal platform also offers REST APIs, allowing customers to build custom integrations with any third-party solution.

Abnormal's API integrations with cloud email platforms grant the solution complete visibility into both external and internal email flow within the organization. This enables a better understanding of internal email patterns and contextual signals, which is crucial for detecting and addressing modern attacks that frequently originate from within the organization.

Combining the insights provided by this API integration with the powerful AI outlined above allows Abnormal to help organizations simplify email security, streamline operations, and prevent email attacks with the highest efficacy.

In the final post in this series, we discuss the future of email security, including important trends to be aware of as you work on securing your cloud email environment.

See for yourself how Abnormal leverages behavioral AI to protect your organization from the full spectrum of email attacks. Schedule a demo today.