Few U.S. hospitals secure their email against phishing, Global Cyber Alliance says

Fewer than one-third of the largest 98 public and private hospitals in the United States secure their email against phishing and spamming, according to data released Thursday. The Global Cyber Alliance said that of the 50 largest public hospitals, only six employed Domain-based Message Authentication, Reporting and Conformance, or DMARC — an email authentication policy and reporting protocol developed a decade ago, originally by PayPal. Of the 48 biggest for-profit hospitals, only 22 used DMARC. The figures led GCA to describe U.S. health care providers’ email security as being in “critical condition.” The alliance also notes that, according to the latest Verizon Data Breach Investigative Report, 66 percent of malware installed on healthcare providers’ IT networks was delivered via email attachment — something normally done using a spoofed email address. DMARC helps prevent phishing and other email spoofing attacks, when an email is made to look as if it comes from a company, […]

The post Few U.S. hospitals secure their email against phishing, Global Cyber Alliance says appeared first on Cyberscoop.

Continue reading Few U.S. hospitals secure their email against phishing, Global Cyber Alliance says

How do I investigate where personal information in a fraudulent email was leaked from?

I have seen an email which is obvious from the content that it’s a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about investigating how and where this personal da… Continue reading How do I investigate where personal information in a fraudulent email was leaked from?

simple question about smtp server ( msa to mta ) security design?

Not sure if this is due to security; hence the reason i am asking here.
I have 2 SMTP server and a couple of unix servers

  1. the actual mailserver running on window. client connect to it and download mail.
  2. a postfix SMTP server running in one of the unix box use for relaying mail to 1).

We call my mailserver MTA1 and the POSTFIX server MTA2

I am a novice in mail and i realize these following different flows when some of the different unix servers are sending mail to the public

They can either

  1. unix server (mailx) –> (localhost-sendmail) —> MTA2(postfix) –>
    MTA1 (actual mailserver) –> external MTA

  2. unix server (mailx) –> MTA2(postfix) –> MTA1 (actual mailserver) –> external MTA

  3. unix server (mailx) –> MTA2(postfix) –> external recipient MTA

  4. unix server (mailx) –> MTA1 –> external recipient MTA

  5. unix server (mailx) —> (localhost-sendmail) –> external recipient MTA directly ?

q1) Is all the above paths valid ? If so, what should be the correct way ?

q1) Notice 1), not sure why there is a sendmail listening on localhost when the MUA can go directly to MTA2 or MTA1 (like path2)

q2) Notice 2) not sure why the need for MTA2 to relay to MTA1 when they can go the 3) path

q3) Notice 3) not sure why the need to go to MTA2 when they can go to MTA1 also

q4) Notice 5) i have a strong feeling i can send to the sendmail on localhost and have it send to the external MTA directly.

So which is the right path ?

Continue reading simple question about smtp server ( msa to mta ) security design?