If you think DMARC – Domain Message Authentication Reporting & Conformance – is the solution to defend against email spoofing, impersonation or business email compromise attacks, you would be only partially correct. It helps but doesn’t by itself solve the entire problem.
Overall these social engineering heavy, impersonation type of email attacks have become a key go-to method for cybercriminals, helping them reap by some estimates billions of dollars of ill-gotten gains every year. Why are attackers so focused on these types of attacks? It is simple: The returns are good, the cost of entry is low, technical innovations aren’t needed, and the risk of getting caught is negligible.
DMARC, when used in conjunction with other DNS authentication capabilities such as DKIM and SPF, can help stop attackers from spoofing or hijacking the email domains of trusted senders, thus effectively taking away one method attackers use to fool their intended victims. Unfortunately, many organizations don’t support these security standards with the deployments of their email systems. The FTC recently released a study which confirmed this. However, using these email security standards alone will not sufficiently defend your organization from the full variety of malware-less impersonation attacks. Why not?
Unfortunately, attackers are creative. One way around DMARC/DKIM/SPF-oriented security controls is to register and use valid domains which are similar to, but not exactly the same as, your domain or the domain of one your trusted partners or customers. For example, using Mirnecast.com instead of the proper Mimecast.com as the sending domain for an attack against Mimecast or someone expecting an email from Mimecast. Notice the difference - rn .vs. m?
Mirnecast.com is a perfectly valid domain, the fact that it is quite similar to Mimecast.com is not an issue for email routing on the Internet, but is a big problem for a person who applies only a cursory glance to the sending domain and has no automated email security controls.
And, of course, there is nothing DMARC can do to stop attackers using free mail accounts to launch their attacks. Most organizations can’t broadly block emails from Gmail, Yahoo, or Hotmail because they are the source of many legitimate emails.
The best solution for protecting your organization from an email impersonation attack is to combine the use of DMARC, DKIM and SPF with Mimecast’s Targeted Threat Protection – Impersonation Protect, so inbound messages can be analyzed to determine their validity before being delivered to the users’ inbox. Inspecting the content of the email for keywords (wire transfer, W-2, credit card etc.) in combination with the validity and newness of the sending domain, the accuracy of the display and reply-to name, in conjunction with using DMARC and family of email security standards, can provide a strong defense against malware-less, email-borne impersonation attacks.
Unfortunately, most organizations have not adopted these types of sophisticated email security controls whether at the domain registry or individual mail inspection level. However, as more businesses adopt email security technologies such as DMARC/DKIM/SPF, the level of protection will increase for everyone on the Internet. Adding DMARC to Mimecast’s security portfolio helps our customers better protect their email domains as well as filter and flag any unauthenticated senders, which leads to improved security for all Mimecast customers.
February 28, 2017Our promise to the industry was to engage, educate and provide valuable insight into major cybersecurity issues facing organizations around the world.
Here is a small recap of what happened at RSA Conference, so you can feel like you were able to attend:
Moment 1: ‘Cyber Resilience Think Tank’ at the San Francisco NASDAQ Center
The Mimecast team hosted a great event at the San Francisco NASDAQ Center for an early morning ‘Think Tank’ lead by Mimecast’s CTO, Neil Murray, and moderated by Venable’s CEO, Ari Schwartz. Security thought leaders from various industries joined in one room to network and share the challenges organizations face today with cyber resilience. As organizations work to become adopt a more cyber resilient strategy there was consensus among the peers in the room that the diversity of the attack must equal the diversity of the defense.
Moment 2: Dark Reading Interview with Bob Adams
Lights, camera, action! What a moment for our very own senior cybersecurity strategist, Bob Adams, who was in front of the camera for an interview with Dark Reading. Bob highlighted the latest security gaps with internal email and the proposed solution, which Mimecast launched at the start of the show. He also discussed how to gain valuable insight into the attacks being missed by many incumbent email security solutions. Interested in watching? Click on the image to watch the full interview below
Moment 3: Live Hacks at the Mimecast Booth
Full house, no problem. Security experts Bob Adams, Julian Martin, and Matthew Gardiner demonstrated onsite ‘LIVE HACKS.’ The gist of the hacks incorporated social engineering attacks, phishing attacks and the ease at which a hacker can use email as a primary hacking mechanism to own the target’s system, gain bank information and take over someone’s video camera without them knowing. You can view the live Periscope video below if you would like to take a look for yourself.
Moment 4: Insights into the latest Cyber Threat Plaguing email
Who doesn’t like working on solving problems with clients? At the event, we got to meet with many customers and new prospects. Thank you, to everyone who stopped by the booth. We were able to share the latest email security threats we see organizations face daily. This included 421 unknown malware threats, all of which were missed by a number of incumbent email security solutions. Check out a summary of these threats in our latest Email Security Risk Assessment infographic we had posted in the booth here.
February 22, 2017Crippling financial penalties and strict new privacy rules have grabbed most of the EU General Data Protection Act (GDPR) headlines so far. This is no surprise, given the sweeping nature of the act, but ahead of the May 2018 implementation date, it’s important to look at some of the more detailed compliance requirements, especially for email.
A key tenet of the GDPR – that organizations must respond in a timely manner to Subject Access Requests (SARs), inquiries from EU residents about the location and processing of their personal data, as well as to requests that it be erased – will likely force a sea-change in how organizations manage all data, personal or otherwise.
In the meantime, little’s been said about the challenges of overhauling privacy in the current era of phishing and ransomware. The two developments – growing regulatory burdens and the increasingly volatile threat landscape – put organizations in a double bind. The GDPR emerged in part as a response to the growing cybercrime threat, yet its directives to retool organizational policies, processes and structures stand to compound the burdens of well-intentioned organizations.
To manage the dual risks of GDPR compliance and cybercrime, you need to focus on email security and governance. Here are some guidelines for formulating such a strategy:
Review your email infrastructure
Over 90 percent of phishing cybercrime exploits begin with email, making it the single biggest threat vector to organizations and the data they manage. Furthermore, not only are emails a common vehicle to share and exchange personal data, email servers are prime repositories for such data as names, email addresses and associated contact information.
Managing GDPR risk starts with securing your data and infrastructure against the litany of email threats mentioned above.
Implement strong search and e-discovery
To suit GDPR mandates for reporting on and deleting personal data upon request, your email infrastructure needs to streamline search and e-discovery. A robust complement of case management tools – early case assessment, search and saved search, legal hold application, retention adjustments, and export, to name a few – will also expedite your ability to respond effectively to requests.
Educate and inform your mailbox holders
One careless click can undermine even the most capable security or governance infrastructure. This makes social engineering exploits such as phishing and impersonation attacks so devastatingly effective. A well-informed workforce is an essential component of an effective GDPR compliance strategy. Every user in your domain must be vigilant against the onslaught of email-based attacks, and play a vital role in notifying your Data Protection Officer (DPO) of any suspected privacy breaches.
Bear in mind that the guidance above addresses compliance issues related specifically to email. To manage GDPR, you’ll need to transform your privacy and governance operations wherever personal data is stored or processed: customer records, databases, CRM systems, and ERP platforms, etc. But chances are good you’ve already considered these repositories; it’s email that’s often overlooked in the compliance conversation. In reality, nearly all email servers and archives contain personal data.
No matter where your organization is based, if you manage or process personal data associated with EU residents, you will be impacted by the GDPR. Managing against GDPR penalties involves securing and tightly controlling your email servers and archives. The countdown to prepare has begun.
To help inform your journey to GDPR compliance, download the Osterman Research White Paper, GDPR Compliance and its Impact on Security and Data Protection Programs.
February 14, 2017
Would it surprise you to learn that in recent testing Mimecast has seen a 13.2% false negative rate for incumbent email security systems? Does your current email security system let through an inordinate amount of spam, malware, malicious URLs, or impersonation emails?
How would you find out if it did? Is your primary source for detecting false negatives your users? Do you wonder how your email security performance compares with your peers?
The fact is, until now, there hasn’t been much data comparing or benchmarking the performance of email security systems. They all claim the ability to defend against spam, malware, spear-phishing, malicious links and other email attack techniques. But how good are they really? How do they compare in their ability to block opportunistic email-borne attacks as well as more targeted attacks?
In working with our more than 25,000 customers, Mimecast has seen firsthand that email security systems do not perform equally well. To address this lack of data head-on, Mimecast launched its Email Security Risk Assessment (ESRA).
The Mimecast ESRA has three goals:
- To test the Mimecast cloud security service against an individual organization’s incumbent email security system. To help the organization see in one report the number, type, and severity of email-borne threats that are currently getting into their organization.
- To inform the security industry with hard data on the effectiveness of various commonly-deployed, email security systems.
- To inform the security industry with hard data regarding the number, type, and severity of email-borne threats that are actively being used in attacks.
In an ESRA, Mimecast uses its cloud-based Advanced Security service to assess the effectiveness of other email security systems. The ESRA test passively inspects emails that have been inspected by the organization’s incumbent email security system and received by their email management system. In an ESRA, the Mimecast service re-inspects the emails deemed safe by the incumbent email security system and thus looks for false negatives, such as spam, malicious files, and impersonation emails.
The results we’ve uncovered so far are concerning: Email attacks ranging from opportunistic spams to highly-targeted impersonation attacks are getting through incumbent email security systems both in large number and in various types.
To learn more and to see the results of the ESRA tests completed to date, please check out this paper.