How do you handle spam and unwanted email subscriptions?

User-by-user quarantine digests are useful. A good quality spam filter will have a good understanding of whether an email is likely to be spam or not. The quarantine digests contain a summary of all blocked emails and can be sent multiple times throughout the day, allowing users to request a release in the event of a false positive.

In any business setting, a 3rd party spam filter should be a “must have” and not a “nice to have” moving forward. There’s a wide range of products that satisfy small to large business settings. Email is vital to a corporation, securing your mailboxes should be a top priority.

Not everyone knows you can adjust spam filters in professional email accounts to cut down on junk mail. These filters are a standard feature. You just set rules in your email settings, and it's more than just keyword filtering - it's about using your email provider's specific options. For example, in Google Workspace, you can do this easily. Go to your Gmail settings, then Admin Panel > Apps > Google Workspace > Gmail. Here, adjust the filters under “Safety”, “End User Access”, and “Spam, Phishing, and Malware” to meet your needs.

From February 2024, Google mandates that all marketing emails include a one-click unsubscribe link. Ignoring this rule can negatively impact your email deliverability and damage your domain's reputation, causing your emails to land in spam or be blocked. An unsubscribe link is also required under the CAN-SPAM regulations enforced by the FTC. Non-compliance can be expensive, with fines reaching up to $51,020 USD for each non-compliant email, such as those missing an unsubscribe link.

For everyday internet users, the golden rule is to avoid clicking on suspicious links and downloading attachments. This caution applies not just to emails from unknown sources, but also from familiar contacts like team members, family, and friends. The reason is that without proper email server configuration, including a DMARC policy set to reject, trusted email addresses can be spoofed. Cybercriminals can send phishing emails that appear to come from these trusted contacts. Therefore, whenever possible, avoid downloading attachments or clicking on links in emails. If there's an opportunity to sidestep these actions, it's wise to take it for your online safety.

Never use your work email for account signups, subscriptions that are not immediately work related. You shouldn't blindly trust what organizations do with your email information, keeping your work email separated from non-work related email lists can help reduce the amount of spam and phishing attempts you get.

If you're an Apple user, you have the option to conceal your email address during sign-ups. This ensures that, even if there's a data breach on a platform you've registered with, your account remains secure. With this feature, no one can access your real email address, providing an extra layer of privacy.

Education is essential for every company, regardless of its size or area of operation. Monthly internal security training is a must for all employees, as management has the greatest interest in protecting their data from breaches. The leadership team can use software like KnowBe4 to test employees' awareness of basic email security risks and organize training sessions to enhance their knowledge. This proactive approach not only educates the team about potential threats but also equips them with the skills to identify and avoid security risks, thereby strengthening the company's overall data security.

If you find yourself in a situation where you must open an attachment or follow a suspicious link and have no alternative, it's highly recommended to use a VM for this purpose. Ensure that the VM has no connection to your local network, providing a fully isolated system. This approach not only protects your network from potential infection by malware contained in the link or attachment, but it also facilitates the investigation of the attack and its origin. Using a VM in such scenarios is a prudent measure to safeguard your digital environment while enabling you to analyze any potential threats.