Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave MailMarshal PageML Scanner Detects 30% More Phishing Attempts

Trustwave’s MailMarshal received a major update this month with the addition of PageML to the Blended Threat Module. The BTM enables the email security solution to conduct in-depth, real-time scans when a URL in an email is clicked to determine if the URL is malicious. PageML boosts the BTM’s ability to detect malicious URLs by one-third by applying machine learning techniques to page content in real time.

The new scanning feature is named PageML, short for Page Machine Learning. It is a real-time scanning module that inspects HTML content, extracts features, and applies an ML-based classifier to determine if the page is likely phishing or other suspicious content. MailMarshal rolled out PageML to all MailMarshal clients in early March.

PageML is a Trustwave-developed, SpiderLabs-managed URL classifier that is running live in the Trustwave section of VirusTotal and analyzing millions of URLs daily. Testing has shown PageML detects a significant amount of live phishing pages missed by other validators, so it is a welcome addition in the fight against phishing.

Including  PageML within MailMarshal, which was done automatically to all MailMarshal clients, will result in end users and admins finding more phishing sites blocked and warnings displayed. Early estimates show at least 30% more phishing URLs will be detected. It’s important to note that no action is necessary by clients, PageML is autonomous.

The PageML validator has two modes of action: block and warn. Higher confidence scores are blocked, and the user cannot click through. PageML classes lower scores as only "suspicious" and will show the end user a warning page. 

If a suspicious URL is discovered, the end user will see this message:

DOC_19738_picture1

Top Email Security Recommendations

Email remains the most likely attack vector a cybercriminal will use so it is imperative that an organization not only have a power email security solution, but builds defense in depth to protect this vulnerable area:

  • Enable Multi-Factor Authentication MFA/2FA on accounts wherever possible to invalidate credential account attacks. Microsoft found that 99% of compromised Microsoft accounts they observed did not have MFA.
  • Have a second form of verification and validation before changing bank details or sending payments over email.
  • Provide annual security refreshers for the whole organization. Covering phishing and overall security awareness will teach employees what attacks they may individually face and give them a plan of action.
  • Use a Secure Email Gateway (SEG), optimized for your organization.
  • Set a policy on how the organization will handle different file types that are sent over email.

The Right Tool for the Job

A proper SEG is critical to your email security success. An SEG helps ensure malicious emails and spam don’t make your way into your network by quarantining and flagging problematic emails and email attachments. But every SEG is different--the right one must be flexible enough to work with the policy you set in place and have comprehensive visibility into your incoming email to get ahead of hackers trying to evade detection.

It’s also important for an SEG to be able to unpack or discover items that may be hidden in other files or attachments. For example, an SEG may block emails with certain .exes but may not see that those same files are embedded in an excel document, or zipped in an archive file format such as a .zip or .rar. An SEG also must be able to find and extract potentially malicious files in complicated office document formats, such as a macro within a Word document.

The Power of Trustwave MailMarshal: Battle-Tested Email Security Defender

Trustwave MailMarshal offers a sophisticated multi-layered approach to email security to reduce false positives and protect against spam, gateway attacks, viruses, phishing attempts, and malicious URLs embedded in an email. In addition, it provides complete email protection against phishing and business email compromise (BEC).

Trustwave MailMarshal contains a specialized BEC Engine to protect against advanced BEC attacks.

These capabilities are reflected in the fact that MailMarshal:

  • Is utilized by thousands of businesses ranging in size from SME to large Fortune 500 firms.
  • Protects more than 3 million users in the public and private sectors via our on-premises edition, cloud, service provider partners, and Trustwave Managed Security Services
  • Enjoys an average client loyalty of 15 years.

DOC_19739_capture

 

Latest Trustwave Blogs

Understanding Your Network's Security Posture: Vulnerability Scans, Penetration Tests, and Beyond

Organizations of all sizes need to be proactive in identifying and mitigating vulnerabilities in their networks. To help organizations better understand the value and process of a vulnerability scan,...

Read More

Email Security Must Remain a Priority in the Wake of the LabHost Takedown and BEC Operator’s Conviction

Two positive steps were taken last month to limit the damage caused by phishing and Business Email Compromise (BEC) attacks when a joint action by UK and EU law enforcement agencies compromised the...

Read More

Defining the Threat Created by the Convergence of IT and OT in Critical Infrastructure

Critical infrastructure facilities operated by the private and public sectors face a complex and continuously growing web of security threats that are compounded by the increasing convergence of...

Read More