Collaborate Disseminate
Across nations and industries, one technology has been sharing countless secrets for well over two decades. Yes, despite the rise of social media, messaging apps and project management tools, email remains the de facto number one online communication c… Continue reading Email Security: How Basic Frameworks Help WordPress Site Owners
Nearly two-thirds of all advanced email attacks used emails impersonating Microsoft or Amazon, according to new research by Agari. Microsoft was impersonated in 36 percent of all (brand) display name impersonation attacks in the third quarter. Amazon w… Continue reading Most impersonated brands in email attacks? Microsoft and Amazon
With a month left on a deadline for federal government domains to implement a key email security policy, cybersecurity company Proofpoint says agencies have made significant progress, but is doubtful that each one will actually make it in time. The Department of Homeland Security issued a binding operational directive (BOD) last year ordering all agencies to have the highest level of DMARC (Domain-based Message Authentication, Reporting and Conformance) within a year. DMARC protects domains from being spoofed via email. Without it, malicious actors can send messages that appear to be, for example, a .gov website. As part of the directive, agencies are required to have a DMARC policy of “reject” — the highest of three levels — by Oct. 16. In a report published Monday, Proofpoint notes 51.9 percent of agency domains are compliant at this point. However, that’s roughly the same assessment Agari, an email security company, put out […]
The post Proofpoint: One month out from deadline, half of agency domains are DMARC compliant appeared first on Cyberscoop.
Continue reading Proofpoint: One month out from deadline, half of agency domains are DMARC compliant
Most companies believe they’ve experienced serious data breaches driven by email impersonation in the past 12 months – but are not doing nearly enough to prevent future impersonation attacks, according to a new study conducted by the Ponemon Institute…. Continue reading Rise in email impersonation attacks makes companies re-assess their security efforts
Sen. Ron Wyden has asked the Department of Homeland Security how it is turning the implementation of an important email security protocol at federal civilian agencies into “actionable cyber intelligence” to guard against hackers. In a Aug. 2 letter, Wyden, D-Ore., asks the department how it is analyzing reports that civilian agencies are required to send DHS about attempts by hackers and spammers to spoof federal email accounts. The senator also wants to know if there are agencies that aren’t sending those reports. “[R]equiring agencies to transmit email impersonation threat data to DHS is only the first step,” states Wyden’s letter to Chris Krebs, DHS’s undersecretary of the National Protection and Programs Directorate. “DHS must then collate and analyze those reports in order to understand the scope of the threat and to determine how best to protect federal agencies from impersonation.” The anti-phishing email protocol, known as Domain-based Message, Authentication, Reporting […]
The post Senator asks DHS what it’s learning from key email-security measure appeared first on Cyberscoop.
Continue reading Senator asks DHS what it’s learning from key email-security measure
Despite a looming deadline, over a quarter of federal agencies are still not using basic email security tools. ` Continue reading DMARC Compliance Lacking in 28 Percent of .Gov Agencies
Most federal agency web domains are on track to meet a requirement that protects them from email spoofing, according to a report from email security company Agari. The requirement in question is Domain-based Message Authentication, Reporting and Conformance (DMARC), a policy that gives network administrators more visibility and control over how their domain is being used with regard to email. Without it, malicious actors can send emails that appear to be from a trusted source, such as a .gov website, to unsuspecting victims. The Department of Homeland Security issued a binding operational directive (BOD) in October 2017 that required all agencies to protect their domains with the highest level of DMARC within one year. With the deadline less than three months away, Agari reports that most domains are on track to meeting the requirements, and just over half have already done so. DMARC can be implemented on three levels of […]
The post Agari: Most agencies on track for DMARC deadline appeared first on Cyberscoop.
Continue reading Agari: Most agencies on track for DMARC deadline
There is a saying that “security is a process, not a destination.” It means organizations can’t fulfill their information security responsibilities with just a checklist. Instead enterprises must continuously adapt their defenses to t… Continue reading 25% of Federal Agencies Have Yet to Start Compulsory DMARC Compliance Journey, Researchers Find
Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that.
Now, if I send an email to a domain/server with DMARC set up, with policy=reject … Continue reading Is it bad to use DKIM DNS without signing mails?
Just one of the 50 biggest federal IT contractors have adopted an important email security measure to guard against phishing, according to a new study. The Global Cyber Alliance’s (GCA) survey of the who’s who of Beltway contractors, including Lockheed Martin, Booz Allen Hamilton, and AT&T, found that all but one – analytics firm Engility, failed to use the Domain-based Message, Authentication, Reporting and Conformance (DMARC) protocol to block phishing attempts. Only one other contractor, the engineering firm and consultancy Tetra Tech, was implementing the second-highest DMARC control, in which phishing emails are quarantined. Meanwhile, more than half the contractors had yet to implement any DMARC policy whatsoever, according to the study. Phishing is one of hackers’ favorite tools for breaching a network, and the federal government has been trying to defend against it for years. DMARC fights phishing by creating a public record for checking whether an email sender […]
The post Fed contractors aren’t using DMARC, new study finds appeared first on Cyberscoop.
Continue reading Fed contractors aren’t using DMARC, new study finds