3. Protect Your Security When Working with Emails

The focus of this chapter is on email and protecting your security and privacy while using this popular form of communication. Topics include:

Ways to protect yourself against data breaches

How to maintain a backup of your computer and its contents (including email-related content stored on your computer)

How to manage spam and unwanted emails

How human error greatly affects email privacy and security

How to avoid being victimized by phishing schemes

Many variables come into play when it comes to protecting your email communications, some of which involve what company hosts your email account and the technology it uses to do it.

This chapter discusses multiple options that are available for you to manage and protect your email accounts. Some of the options depend on the Internet provider and email account you use.

Email Options

As you’ll discover from this chapter, you can use many tools and strategies to enhance the privacy and security related to your incoming and outgoing emails that can help to thwart the most common security risks.

You can manage some email accounts entirely online using your web browser to connect to your email service. For example, if you have a Gmail account from Google, after launching your web browser, you would visit https://mail.google.com, log in to your account using your email address and password, and then manage your Inbox, read incoming emails, and compose outgoing emails entirely from your web browser. All content related to your account and all spam filters and email-related security tools are based entirely in the cloud (online).

Windows 10 and Mac computers, along with all smartphones and tablets, come bundled with the Mail app. You can configure it to manage one or more email accounts. Many optional email apps can also be purchased, downloaded, and installed onto your computer or mobile device. These all provide a more diverse set of tools for managing your email accounts.

Some of the customizable security and privacy tools and options are built in. You can use these in conjunction with the online-based tools provided by your email service provider.

Determining Where Email Vulnerabilities Can Happen

Sending and receiving email makes you vulnerable to unwanted data breaches, cybercriminals, and hackers. The following sections describe vulnerable areas and ways to keep you safe.

Preventing Unauthorized Physical Access to Your Computer or Mobile Device

It’s possible to gain access to your computer or mobile device if you have your user accounts set up so anyone can use it, or if someone discovers your password to access your computer’s user account. Someone can potentially access your email account(s) using the username and password that’s stored in your web browser, or simply launch the Mail app that’s running on your computer or mobile device. The Mail app stores your email account usernames and passwords, and often stores some or all your actual email content in your mobile device in addition to in the cloud. After someone gains access to your mobile device, the Mail app does not require any additional sign-in process to access your email accounts.

To prevent this, add user accounts to your computer so everyone (including yourself) who will be using the computer will need their own username and password to sign in, and unauthorized people will have a more difficult time gaining direct access to your computer.

On your mobile devices, you should turn on the passcode, fingerprint identification, or face scan identification feature to prevent unauthorized people from gaining access to your smartphone or tablet and being able to access the Mail app.

Protecting Your Computer Against Viruses and Malware

Email is the number one way computer users unwittingly download and install viruses and malware onto their equipment. This is often a result of clicking an email attachment that contains the virus or malware. The attachment might be from a hacker or cybercriminal, or it could be from someone you know whose computer is already infected, but they don’t know it, so when they share files via email, it spreads the virus or malware.

By installing and using antivirus and malware protection software on your computer, you add a line of defense against these potentially damaging programs. Adding a firewall to your home Internet service and taking a proactive role in avoiding phishing schemes will also help to protect your email accounts and equipment.

After you install antivirus and malware protection software, it continuously works in the background as you use your computer and only warns you if it detects a problem. Table 4.1 lists some popular antivirus and malware protection software you can purchase.

Table 4.1 Popular Antivirus and Malware Protection Software for PCs and Macs

Maintaining an Up-to-Date and Reliable Backup

Antivirus and malware protection software does not offer full protection against all virus and malware attacks. You must also back up your computers and mobile devices. Your backup files can be stored in the cloud or on some type of external storage that’s connected to your computer.

The Windows, MacOS, iOS, and Android operating systems all have built-in features for creating and maintaining backups. Optional third-party backup solutions are also available. If a virus or malware does erase important data, documents, files, and photos, you want to have a way to recover them.

Having a reliable backup also helps to protect your information against hardware malfunctions or human error that results in the accidental deletion of files. In most cases, email-related content that is sent to your computer or mobile device is also stored online on your email service provider’s servers. This automatically provides a backup of your email-related content. Before counting on this, however, contact your email service provider and make sure a user-accessible backup is maintained on their servers.

Create a Backup Using a Windows 10 PC

Sooner or later, you will need to recover important files from a backup. You need to create and maintain a reliable backup on an ongoing basis, so you can access it when you need it. To do this on a Windows PC, follow these steps:

Turn on your PC and allow Windows to automatically launch. (Not shown.)

Click the Windows icon in the lower-left corner of your screen.

Click the Settings option.

In the Windows Settings window, click the Update & Security option.

On the left side of the screen, click the Backup option.

Connect your computer to an external hard drive that contains enough available storage space to back up your computer’s contents. (Not shown.)

Under the Backup Using File History option, click the + Add a Drive option.

Select the external drive you just connected to your computer.

Make sure the Automatically Back Up My Files virtual switch is turned on.

To determine when the computer will create and then maintain the backup, click More Options.

Click the Backup Now button to create an immediate backup, or from the Back Up My Files dropdown menu, select how often you want the backup to be updated.

From the Keep My Backups dropdown menu, select how long you want to retain the backup files. The default option is Forever.

Scroll down the Backup Options menu to customize other settings pertaining to which files and folders you want to include or exclude from the backup.

Exit out of Settings by closing the application window and continue using your computer as you normally would. Your computer will now create and maintain a backup based on how you adjusted options offered by the Backup Options menu. (Not shown.)

Create a Backup Using MacOS’s Time Machine Feature

When you use any type of computer, things can go wrong and important email content, data, documents, files, and photos can be lost. This can be a result of a virus or malware, human error, or a hardware malfunction.

To maintain a backup of your Mac, you can use the Time Machine application that comes bundled with the MacOS operating system. Follow these steps to set up and use Time Machine:

Launch the MacOS operating system by turning on your Mac. (Not shown.)

From the top of the Desktop screen, click the Time Machine icon, and then select the Open Time Machine Preferences option.

Connect your computer to an external hard drive that contains enough available storage space to back up your computer’s contents. (Not shown.)

Click the Select Disk button and choose the external hard drive.

Click the Back Up Automatically option checkbox.

Click the Options button to customize which folders, directories, and files will be backed up.

From the Time Machine Options window, select specific files you want to exclude from the backup. In general, leave all these options at their default settings to maintain a backup of everything.

After you set up your backup preferences, exit out of Time Machine by closing the application window. Your computer will now use Time Machine to maintain a backup automatically. (Not shown.)

Choosing Additional Online Backup Solutions

In addition to using File History on your Windows 10 PC or Time Machine on your Mac, both of which create backups and store the related files on an external hard drive, many third-party backup applications are available for purchase and use with your computer. Some allow you to store backups locally on an external hard drive, whereas others work in conjunction with a cloud-based service to create and maintain a remote (online-based) backup of your computer.

For both PCs and Macs, some of the third-party companies that offer cloud-based backup solutions include:

• Backblaze: Pricing starts at $5.00 per month. www.backblaze.com/cloud-backup.html

• Carbonite: Pricing starts at $6.00 per month. www.carbonite.com

• iDrive: Price ranges from free to $74.62 per year, based on the amount of online storage space needed. One subscription can be used with all your computers. www.idrive.com

• InterServer.net: Pricing starts at $5.00 per month, plus $2.00 per month, per computer or mobile device. www.interserver.net/backups

• Zoolz: A one-time payment of $39.99 is charged for up to 1TB of online storage. One account works with all your computers and up to two users. https://home.zoolz.com/500gb500gb-lifetime

Protecting Email Content as It’s Moving

You compose email messages on your computer or mobile device. If your computer is connected to the Internet via Wi-Fi, a vulnerability exists when your computer wirelessly sends information through your home Internet router or modem, or through a public Wi-Fi hotspot.

A savvy hacker can potentially infiltrate this connection and gain access to your email content (and other information as you surf the web). This is more of an issue if you’re accessing the Internet from a public Wi-Fi hotspot. To prevent this, consider installing a virtual private network (VPN) that’ll work in conjunction with your web browser to encrypt all information as it leaves your computer or mobile device.

The firewall you installed on your home computer network will also help to protect against data breaches. However, after your information is traveling around the Internet, the security is handled by your email service provider, not your own equipment.

Avoiding Phishing Schemes and Spam

One of the biggest problems you’ll encounter when using email is that your account will literally be bombarded by unsolicited spam messages, some of which will be part of complex phishing schemes.

A spam message is an unsolicited junk email message that shows up in your Inbox and was often sent to many recipients simultaneously. Some spam is harmless, but annoying. It might contain a sales or marketing message from a company trying to sell you something.

Some spam messages contain viruses or malware as email attachments that are disguised as other types of documents or files. As soon as you open that email attachment, the virus or malware gets downloaded and installed on your computer. Windows PCs are more susceptible to viruses and malware than Macs, but they pose a threat to all computer and mobile device users.

A spam or junk mail message might not contain potentially harmful attachments, but it might still be an important component of a phishing scheme, which can be just as problematic to email users. Clicking a hyperlink that’s embedded in the email can transfer you to a fake website designed to look like a legitimate website for a company you know and do business with. The fake website will request your username and password (for the real website), which after you provide, gives the cybercriminal full access to your real account.

Most email service providers have a built-in anti-spam tool that works behind the scenes to capture incoming spam messages before they reach your Inbox. These messages are typically placed in a separate mailbox, often called Junk, instead of your account’s main Inbox. If you’re using a software or mobile-app email client such as Mail to manage your email account, additional tools are available to automatically help you detect and manage spam emails.

Adjusting the Security and Privacy Features When Using Mail

All email apps allow you to set up and adjust a variety of privacy and security-related features that can help you decrease and manage the spam you receive.

Although they perform the same function, the Mail software that comes bundled with Windows 10 for PCs is vastly different from the Mail application that comes bundled with the MacOS operating system for the Mac. The same is true for the Mail app that’s part of the iOS operating system for the iPhone and iPad versus the Mail app that comes bundled with all Android-based mobile devices.

Use the Email Security Features Built in to Mail for Windows 10 PCs

The Mail app that comes bundled with Windows 10 can be set up so you can manage one or more email accounts simultaneously. If you opt to use this application, you should take a few minutes to customize the software’s built-in Email Security features by following these steps:

Launch the Mail app on your Windows 10 PC. One way to do this is to click the Windows icon (displayed in the bottom-left corner of the screen) and then scroll down the applications list. Click the Mail app’s listing. (Not shown.)

Click the gear-shaped Settings icon.

From the Settings menu, click the Email Security option.

Not all email accounts are compatible with this functionality. If your email account does not support these features, you can adjust the security features online by signing in to your email account using your web browser.

Use the Junk Mail Settings in Mail for the Mac

If you opt to use the Mail application to manage one or more of your email accounts, take a few minutes to customize the software’s built-in Junk Mail settings by following these steps:

Launch the Mail app on your Mac. One way to do this is to click the Mail app icon that’s displayed on the Dock, or open the Applications folder and click the Mail app icon. (Not shown.)

Click the Mail dropdown menu.

Select the Preferences option.

Click the Junk Mail tab.

To have the Mail app help to filter junk mail, click the Enable Junk Mail Filtering option checkbox.

Adjust the additional junk email-related options displayed in the Junk Mail submenu, based on your personal preferences.

Use the Email Security Settings for Gmail

If you choose to manage your free Gmail email account via your favorite web browser, follow these steps:

Launch your favorite web browser. Google Chrome on a PC is used for this example.

Visit www.google.com/mail.

Click the Sign In option.

Type in your Gmail email address using the format [your username]@gmail.com, and then click Next.

Type in your Gmail account’s password, and then click Next.

To access your Spam mailbox (where junk emails are automatically placed if Gmail identifies them as spam), scroll down along the menu displayed below the + Compose button, and click the Spam mailbox option.

View a listing of individual spam (junk) emails. You can review them one at a time, open and read them, or delete them individually. Click the Delete All Spam Messages Now option (near the upper center of the screen) to erase all spam messages manually, although this is automatically done for you every 30 days.

After you’re logged in and viewing any mailbox (spam is shown here), click the gear-shaped Settings icon.

Click the Settings option.

To create a list of email addresses (senders) that you want to block manually, click the Filters and Blocked Addresses tab, and then click the Create a New Filter option.

Fill in the online form that’ll allow the online-based Gmail application to filter your incoming emails and block those that contain a specific sender, subject, specific words or phrases, that have a file size larger than a size you pre-determine, or that have attachments. One at a time, you can manually create as many separate filters as you desire, and each will remain functioning until you edit or delete it.

Back in the Settings dialog, click the Labels tab.

Click the Show or Hide option for the Spam option, based on whether you want messages identified as spam to appear in your Inbox.

Because Gmail is a free service, you’ll often need to view ads when you manage your email account. To determine the types of ads you’ll see, click the General tab in the Settings dialog box, and then click the Here option for the Importance Signals for Ads option.

Follow the on-screen prompts to manage the advertising-related preference options available to you. If you turn off the Ad Personalization option, you will still see ads, but the ads you see won’t be targeted specifically to you based on your online activities. You’ll also lose the ability to turn off ads from specific advertisers, since all the ads you see will be more general in scope.

To download and install optional add-ons that’ll make managing your Gmail account from your web browser easier, click the gear-shaped Settings icon again, but this time click the Get Add-Ons option.

Scroll through the G Suite Marketplace to find add-ons that will provide the additional features and functions you want. Many of these add-ons are free. Some will have a small one-time cost associated with them, while others will require a monthly or annual subscription to fully utilize.

Use the Email Security Settings for Yahoo! Mail

After you have an established Yahoo! Mail account, follow these steps to customize the security and spam settings for it:

Launch your favorite web browser (not shown). (Edge on a Windows PC is used in this example.)

Visit www.mail.yahoo.com.

When prompted, type in your existing Yahoo! email address using the format your username@yahoo.com. Click Next.

Type in your Yahoo! Mail account password, and then click Sign In.

To view the spam (junk) emails in your Spam mailbox, click the Spam option on the left side of the window.

From the listing you’re able to manage one message at a time, read it, delete it, or mark it as “Not Spam.” You’re also able to use the Select All option, and then delete all the listed spam messages at the same time.

To customize options related to your Yahoo! Mail account, click the gear-shaped menu icon, and then click the Settings option.

To create or manage a list of email addresses you want to block in the future, click the Blocked Addresses option in the Settings menu, and in the Add Address field, type in the email address you no longer want to receive emails from. Click the Save button to save your list. (Not shown.)

To create a new filter that’ll allow you to sort email messages based on a broader range of criteria and then decide where to place those messages automatically (such as the Spam folder), from the Settings menu, click the Filters option.

Click Add to create a new filter.

Create a Filter Name and then complete the online form to create a custom filter.

Click Save to save your new filter(s).

Identifying and Avoiding Phishing Schemes

Before you skip over this section because you think you couldn’t be a victim of a phishing scheme, think again! Research shows that even smart, well-educated, and savvy people become targets—and victims—of scammers.

A typical phishing scheme email appears in your Inbox as an important, time-sensitive message that seems to come from a well-established company or organization that you already do business with—such as a major bank or financial institution, an airline, Amazon.com, eBay.com, Netflix, Microsoft, Apple, a government agency, or a court. Or it could come from a member of the royal family in a country you’ve barely heard of, someone posing as a distant relative, or the commissioner of a lottery.

In many cases, the incoming email will showcase a company logo that you will recognize, and the email’s subject line will contain a statement designed to capture your attention and create a sense of urgency, such as “There’s a problem with your account,” “Your account has been locked,” or “Congratulations, you’ve won $2 million dollars.”

The goal of the incoming email is to generate an immediate response from you, without giving you time to stop and think about what you’re doing. The cybercriminal might want you to:

• Click an email attachment that will cause a harmful virus or malware to be downloaded to your computer or mobile device.

• Click a hyperlink that’s embedded in the email that will launch your web browser and transfer you to a fake website designed to look like a legitimate website for a company you know and do business with. That fake website will request your username and password (for the real website), which after you provide, gives the cybercriminal full access to your real account.

  

• Provide personal or private information by filling out an online form that requests your account username and password, your Social Security number, your bank account number, or your credit card number, for example.

• Call a phone number and speak with a cybercriminal who will pose as someone else in an attempt to gather information from you or solicit money.

• Pay a ransom after the cybercriminal has hijacked and locked your computer or mobile device, because you accidently clicked a link in the email that locks up your computer. This type of malware is specifically called ransomware.

• Wire or transfer money to the cybercriminal who is posing as someone you know. In some cases, the cybercriminal might pose as a distant relative who is traveling abroad, claims to have had their wallet and passport stolen, and is now in desperate need of money to get home.

• Donate to a charity you know is real, but the person you’re communicating with is really a cybercriminal impersonating a representative from that charity.

• Try to redeem money or prizes you are led to believe you’ve won, or that you’ve inherited.

Dealing with a Phishing Scheme Email

The stories that are conveyed in phishing scheme emails are often believable, time sensitive, and designed to scare you into doing whatever is requested. Chances are you receive at least a handful of these emails every week.

The best approach is to delete each of these messages without even opening and reading them, or to send the messages directly to your email account’s Spam folder (without first opening and reading them).

If you do open an email that’s actually a phishing scheme, do not, under any circumstances, click the link in the email, click the file attachment attached to the email, download or open the file attachment, respond to the email, or call the phone number listed in the email, no matter how believable the message in the email might be.

Calling a Legitimate Phone Number for a Bank or Credit Card Issuer

Suppose you receive an email stating there is a problem with your credit card account, and that the account has been locked. In the email message, you’re instructed to “click here” to fix the situation, or to call the phone number listed in the email. What should you do?

The answer is to do none of these options! Instead, if you think the email might contain a legitimate message from your credit card issuer, look on the back of your actual credit card or check your latest monthly statement for the legitimate phone number for that credit card issuer, and call the company directly. Again, don’t call the phone number listed in the email.

If you’re led to believe your account has been locked, for example, instead of clicking the link in the email, open your web browser and manually type in the website URL for the credit card issuer that you know is legitimate, such as www.BankofAmerica.com, www.CapitalOne.com, or www.AmericanExpress.com, and sign into the legitimate website using your username and password. Chances are, you’ll discover there is nothing wrong with your account.

Identifying Phishing Scheme Email Messages

As you read over an email message that’s trying to perpetuate some type of scam, there are often several things you can spot that will confirm your suspicions. These include:

• The logo used in the email is similar to a real company’s actual logo, but not exact. The color scheme, font, or something about its appearance will be wrong.

• The email will contain spelling and grammatical errors.

• The email might be personalized, but your name will be wrong or spelled incorrectly, or the message will simply be addressed to “Dear Customer.”

• When you look at the From field of the email, the address of the sender will not be a legitimate business address. If the email appears to come from Bank of America, for example, you would expect the sender to have an email address such as [name]@bankofamerica.com, as opposed to an @gmail.com, @yahoo.com, or email address that has nothing to do with who the sender is supposed to represent.

• Anything having to do with your inheriting money from a foreign government official, an overseas bank (or a member of royalty from a foreign country), someone needing your help to transfer money out of their country, or your winning a lottery you’ve never heard of are all scams.

• An email posing as a “Summons to Appear” in court is also part of a phishing scheme. Any legitimate court-related summons or requests would show up via U.S. registered mail or be served to you in person by a government or law enforcement official, for example.

• The email refers to an account you know does not exist. For example, it appears to come from Wells Fargo Bank, and you only have an account with Bank of America.

• The email references the confirmation receipt for a major purchase that you never made, such as an expensive airline ticket.

• The email is selling or promoting a weight loss plan, prescription medication, an appliance extended warranty plan, a beauty product, or a cure for a common medical issue (such as headaches, sleep loss, erectile dysfunction, or back pain) from a company or organization you’ve never heard of or never requested information from.

• The email is offering an “exclusive,” “once-in-a-lifetime” investment opportunity for something you’ve never heard of or have any interest in.

Avoiding Email Security Problems Related to Human Error

Anytime you’re sending and receiving emails, you have the possibility of human error. For example, as you’re filling in the To field while composing an email message, the email client you use will often use an “autofill” feature to anticipate the name or email address you’re typing in (based on your history) and then auto-insert what it believes is the correct email address.

This feature is designed to save you time and keep you from having to look up someone’s email address. It attempts to match a stored email address with the name you type in. A problem can occur, however, if you’re not paying careful attention.

For example, your intent is to compose and send an email to [email protected]. However, you begin typing in Jon’s name, but the computer identifies several Jons in your contacts database or whom you have corresponded with in the past. The email address for [email protected] is inserted into the To field by accident, and you don’t catch the error. You wind up sending an email to the wrong person. He now has information—potentially sensitive information—about you that you didn’t intend to convey to him.

Another common human error-related mistake involves adding incorrect attachments to your outgoing emails. As you’re selecting files, documents, or photos to include in an outgoing email, make sure you’re including the correct files.

Also, if you use the Cut and Paste feature to transfer information from another application into the body of an outgoing email, make sure you insert the correct content into the email. Proofread your outgoing message before clicking Send.

When managing incoming emails, if you make a mistake and accidentally delete a message, you can always recover it from the Trash folder or directly from your email account service provider’s server.

If you have antivirus and malware protection software running on your computer, have a firewall in place as part of your home network, take advantage of a VPN when using public Wi-Fi to access the Internet, and know the signs of scam email, you’re taking a proactive role in protecting yourself, your data, and your identity, including when using email. Double-check your outgoing emails for accuracy before sending them, and you can eliminate human error-related problems, as well.