1. Implement strong password policies and multi-factor authentication (MFA):

• Enforce strong passwords with a minimum length, character variance, and regular changes.
• Make use of Multi Factor Authentication (MFA) to add an extra layer of security beyond just passwords.
• Consider password managers for your users create and manage strong, unique passwords for all their accounts.

2. Educate your employees on phishing scams:

• Teach employees to look out for phishing tactics such as suspicious sender addresses, urgency, generic greetings, and grammatical errors.
• Show them on how to handle suspicious emails, e.g. not clicking on links or attachments and reporting them to IT security teams.
• Run regular phishing simulations to test user awareness and drive best practices behaviours.

3. Use secure email gateways (SEGs) and email filtering:

• SEGs can scan incoming and outgoing emails for malware, spam, and phishing attempts.
• Configure email filtering to block emails with suspicious attachments, URLs, or sender addresses/domains.
• Regularly review and update your email filtering rules to stay ahead of changing threats.

4. Encrypt sensitive data in transit and at rest:

• Use encryption protocols such as S/MIME or TLS to encrypt business emails during transmission.
• Encrypt data at rest on email servers and user devices to add an extra layer of protection in case of breaches.

5. Restrict data sharing over email and use secure file sharing platforms:

• Limit the types of data that can be sent via email, especially sensitive information.
• Consider the use of secure file sharing platforms with access controls and encryption features for sharing files or confidential information.

6. Stay on top of software updated and patch management:

• Regularly update email clients, operating systems, and web browsers with the latest security patches to protect against vulnerabilities that could be exploited by attackers.
• Automate patch management processes whenever possible to ensure timely updates and reduce security gaps.

7. Enable user activity monitoring and logging:

• Monitor user activity related to emails, including access attempts, sent/received messages, and suspicious behaviour.
• Hold email logs to aid investigations should a security incident occur.

8. Use email spoofing protection:

• Implement email authentication protocols like SPF, DKIM, and DMARC to prevent attackers from spoofing your email domain and impersonating your organisation in phishing attempts.

9. Back up email data regularly:

• Maintain regular backups of email data in a secure, and ideally offsite location to ease data recovery in case of ransomware attacks or other incidents.
• Test your data backups regularly to ensure they are operating correctly and readily recoverable.

10. Conduct regular security assessments and penetration testing:

• Schedule regular security assessments and pen tests to identify any vulnerabilities.

Bonus. Log out:

• Encourage and remind users to log out of their email when they’ve finished for the day to reduce the chance of data loss by unauthorised people on laptops and mobile devices.