Oklahoma cuts phishing threats with cloud-based email gateway

A cloud-based secure email gateway has helped the Oklahoma Office of Management and Enterprise Services (OMES) decrease the threat from inbound ransomware messages and other malware.

Although state government offices now receive about half a million email messages per day, compared to 372,000 per day last July, they were getting more than three times as many malware messages last year.

“I think it’s because we didn’t have good email security in place,” the state’s Chief Information Security Officer Matt Singleton said. “As our posture has gotten better, what’s coming back to us has gotten better.”

One way Oklahoma improved its security posture is through an “IT unification” effort that brought 111 IT shops together into one: OMES. Previously, each agency had its own secure mail gateways and used various email platforms, including older ones such as Lotus Notes.

“It left a bunch of holes, to be completely candid,” Singleton said. “We found ourselves in a situation where any time we were trying to mitigate a specific threat, we had to manually go into 12 different platforms,” he said.  “So, we needed to get to something modern and centralize it.”

To do that, OMES migrated all state email systems to Microsoft Office 365 and then implemented Mimecast’s Email Security, DMARC Analyzer, Brand Protection and Security Awareness Training products, in addition to add-on features such as Secure Messaging and Large File Send.

“It seems weird to say, but one of the great things about the work-from-home push is that we finally pushed our Microsoft Office 365 migration over the goal line,” Singleton said. “At least I had everyone in one single platform for mail. Then I could put something in front of that to secure it. That made things a whole lot easier for us.”

A major change was Mimecast’s ability to rewrite URLs for state users, something IT staff did manually in the past.

“In fall 2019, we saw a number of pretty sophisticated phishing campaigns against the state, and our response to that, because we didn’t have this platform, was to go in and manually code so that any URL that came in, we broke the URLs basically,” Singleton said. “Any URL in your email, you had to copy and paste and delete some characters out of that for it to actually work, but it solved the phishing problem we were having.”

Now end users don’t see the URL rewriting. They can click the links, which have been tested for malicious content before users visit them. The system also sandboxes any email attachments that look questionable and strips out anything known to be malicious.

It’s yet not a full heuristic scan, Singleton said, but OMES is working to tie the platform into the cyber threat intelligence platform it launched last year using Anomali’s ThreatStream technology. With that integration, Mimecast can act immediately and automatically on intelligence OMES feeds it from multiple sources.

As OMES conducted security training for employees, it gained “visibility into which users need some more education” on cyber hygiene, Singleton said. “You can see folks that typically will click on a bad link, and we can actually come up with some of that training for them and do it just in time.”

That was especially important during the height of the pandemic, when many of the state’s 30,000 workers suddenly became remote.

“The pandemic itself presented some very unique threats and opportunities for bad actors to exploit, and this platform allowed us to flag those things and respond to them quicker,” Singleton said. For example, workers would get emails stating that contact tracing determined they had been in contact with someone who tested positive for COVID and inviting them to click a link to learn more. More recently, phishing attempts have taken the form of offering opportunities to get the COVID-19 vaccine.

“There’s a great sense of urgency built into those emails, so it would be really easy for folks to say, ‘I’m going to click it and I’m going to take the chance,’” Singleton said. “With this platform we were able to look at those sites before they got to the end user and ensure that they weren’t going someplace where [employees] were going to put in their credentials and have those things harvested.”

The just-in-time training is working. Last July, one in 500 workers clicked unsafe links, but last month, only one in 900 did.

OMES’ goal is to build a cybersecurity ecosystem in which all aspects can communicate and share data. This means the secure email gateway product integrates with the endpoint-detection and response product, which works with next-generation firewalls, and all of those talk to the security and event management platform, which the cyber threat intelligence platform informs. That lays the foundation for better security in the future, Singleton said.

“You start putting different tools in place with capabilities around artificial intelligence and machine learning, all of a sudden now I can have my humans starting to focus on those really difficult attacks that require a human to dissect,” he said, adding that OMES is likely several months away from having those integrations in place.