Cybersecurity Awareness Month is the ideal time to investigate and address the risk
This year’s Cybersecurity Awareness Month theme is “Don’t Make It Easy for Them.” When it comes to email security, much of the discussion and publicly available advice focuses on helping individuals and organizations recognize suspicious messages and protect the systems receiving them.
Those measures are essential, of course. But for platforms such as mailbox and hosting providers, telcos, and ISPs that receive high volumes of emails, protecting user inboxes is only half the story. Cybersecurity Awareness Month offers a timely prompt to review the other side and, where needed, update safeguards. This will help prevent harmful messages, such as phishing emails or messages carrying malware, from being forwarded through their email infrastructure.
Cybersecurity-related responsibilities for sending and receiving emails can sometimes seem separate, with accountability resting with different teams, each using different tools and working to different priorities. Yet in reality, a platform that receives emails often forwards them onwards, too. That blurs many of the receiver-and-sender platform boundaries and requires, if not a shift in thinking, then certainly recognition.
This is where Cybersecurity Awareness Month can again provide a useful prompt. Like catching a cold, receiving something harmful can also mean passing it on unintentionally, and no one wants to be a superspreader. Automatic forwarding is one way this can happen; another is when an attacker uses a compromised account to send harmful messages.
How does a receiving platform become a source of harmful emails?
Consider an individual user who automatically forwards incoming email to an account at another provider. For example, it could be emails from their Gmail account to their Outlook address. If a phishing email or a message carrying malware gets through Gmail’s checks, it may be forwarded too. Gmail did not create the threat, but its email infrastructure is now carrying it onwards.
A compromised email account takes a different route with similar, serious consequences. If a bad actor gains access to a user’s mailbox, they can use it to send new phishing messages, spam, or malware. Again, the provider’s email infrastructure becomes the unwitting conduit through which harmful email reaches other people.
In both cases, the risk extends beyond the people receiving harmful messages. Destination providers assess how trustworthy the infrastructure delivering email to them is. If the provider repeatedly sends harmful traffic, its reputation can suffer, even when it did not originate the attack.
When multiple customers send email through the same email infrastructure or IP addresses, harmful traffic from one customer can damage the reputation of the sending route they all use. Other providers may then become more suspicious of legitimate messages arriving through that route, including email from customers who have done nothing wrong. Their messages may consequently be sent to spam, delayed, or rejected.
That’s when users can really lose out. Forwarded messages may not reach inboxes, and emails sent through the affected infrastructure may not reach their intended recipients. For the receiving provider, this makes outbound safeguards part of protecting its own services and those of others. This, in turn, helps uphold its reputation and the service reliability that its customers depend on.
As such, the warning, “Don’t Make It Easy for Them”, applies here too. Attackers benefit when a service forwards harmful messages or allows them to keep sending from a compromised account. Detecting those threats and containing the traffic helps deny them that route to further recipients.
Intelligence needs to work alongside control
Accurately identifying harmful incoming email and unusual sending behavior helps reduce this risk. Still, detection is only part of the response. Providers should decide how best to use that intelligence and contain the threat.
A shared email platform may handle customer submissions, automatic forwards, password resets, security alerts, and administrative notifications. These streams serve different purposes and carry different risks, so treating them as one undifferentiated flow can allow a problem in one stream to affect legitimate communications in another. A customer-configured forward, for example, should not automatically be treated in the same way as a platform-generated password reset.
Providers should consider distinguishing those streams, applying appropriate policies, and stopping harmful messages before they leave the infrastructure. When an account is compromised, the response also needs to cover messages that are already accepted and waiting in a queue. If the provider only blocks new submissions, harmful messages already in the queue may still be sent.
Sending and receiving: two actions, one security conversation
Cybersecurity Awareness Month is a good time to review that connection. Which messages does your platform forward? What checks happen before they leave? Does forwarded traffic share sending infrastructure or reputation with essential notifications?
These questions bring receiving and sending into the same security conversation. They help illustrate the importance of inbox protection and of understanding where a message travels after it arrives. They also highlight the potential risk and reputational damage to senders and receivers, as well as the potential impact on customer service standards.
For receivers, making life harder for attackers means reducing opportunities for harmful email to pass through a trusted service. If this year’s Cybersecurity Awareness Month helps organizations raise and address this issue, it will play a major role in protecting emails and reputations.
To explore other operational shifts, take a look at Halon’s new guide:
Nine shifts changing email operations for receivers
