Tag: Email spoofing

Reports have emerged that suggest U.S. government agencies operating .gov domains are adopting the DMARC (Domain-based Message Authentication, Reporting and Conformance) email security protocol ahead of the Department of Homeland Security’s (DHS) directive deadline of January 15. While the heightened attention to cybersecurity practices is to be applauded, and any additional layer of security is welcome, the implementation of DMARC should not be seen as a silver bullet to preventing phishing and other email spoofing.

After all, it’s less than a month since Mailsploit was discovered – a serious vulnerability that allows hackers to easily spoof and impersonate emails that can bypass DMARC protocols, compromising the integrity and authenticity of the sender as a means to trick recipients into taking a compromising action.

Mailsploit isn’t the only issue as DMARC has been proven to have several other pitfalls, including its ability to break mail flow if SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are not setup, unintentionally causing a backlog in email messages. Similarly, DMARC does not protect against malicious messages that share the same host.

With the overwhelming majority of cyber warfare, cyber espionage and cybercrime originating with an email phishing attack, it is imperative that government departments and organisations look beyond DMARC for a holistic approach to detect, prevent and respond to malicious email messages. This includes augmenting the representation of senders inside the email client to learn true sender indicators and score sender reputation through visual cues and metadata associated with every email, empowering end users to make better and quicker decisions. This should also be integrated with automatic smart real-time email scanning into multi anti-virus, and sandbox solutions so forensics can be performed on any suspicious emails either detected or reported.

DMARC can be helpful but don’t be lulled into a false sense of security. For those threat actors that are truly motivated to cause damage or destruction, the protocol will prove an ineffective line of defence.

The author is CEO & Founder of IRONSCALES. Views are personal.

Related:

• Mailings from our servers and containing some text blocked
• Sumitomo Mitsui Financial Group Joins the Open Invention Network Community
• Is this still a valid approach with later versions of ICN, Sync, NMO,…?
• Building an MS-DFS environment containing NSS4AD volumes and making it available through Filr
• SOLVE PROBLEMS BEFORE YOU HAVE TO SEARCH FOR THE SOLUTIONS