Topics

• Threats
• Why a policy matters
• Policy
• Demo
• Next steps

Cyber attacks using email

• Spoofing - attacker pretends to be someone else.
• Phishing - use spoofing to steal information
• Hijacking - gain control of your system
• Ransomware - gain control of your system until a ransom is paid

• Document acceptable and best practices that all employees have access to.
• Limit the number of systems/software/configurations that we have to maintain. This is important to reduce our risk and minimize our costs.
• Required by all security guidelines and standards.
• Required by most cyber-insurance policies, which we often are required to have.

Parts managed by IT

• Implement core Internet security protocols - DKIM, SPF, DMARC, MTA-STS.
• SPAM and virus detection and quarantining - Google Workspace.
• Authentication - strong passwords, MFA, OAuth2
• Application email must use SMTP Relay.
• Email archiving and retention - to do.