How to Protect Cybercrime
Citizens
from
On October 16, 2017, the U.S. Department of Homeland Security issued Binding Operational Directive (BOD) 18-01 that mandates the implementation of specific security standards to strengthen email and website security among government agencies. Citizens rely on their email for everything from paying bills to receiving medical records, so protecting email from cybercriminals is critical. In 2015, the Department of Homeland Security (DHS) mandated that all federal agencies that operate .gov email domains implement a DMARC “monitor” policy within 90 days and a DMARC enforcement policy of “reject” within 1 year. With that mandate approaching, and after engagements with Federal agencies, DHS has decided that the private sector can play a more active role to protect citizens and will partner with industry organizations to improve email protection overall.
Federal agencies that don't use online security practices like DMARC enable cyber criminals to access sensitive personal data and put citizens at risk. Jeanette manfra, DHS Assistant Secretary of Cybersecurity and Communications, recently asked federal agencies to adopt technologies like DMARC in order to protect citizens and maintain their trust. “It’s really up to agencies and the federal government to say, ‘I care that you are going to trust emails from the federal government…’” Email is easy to use and inexpensive, but it’s vulnerable. That’s because anyone can send email using someone else’s identity. And unlike essential communications infrastructure like telephones, there are minimal accreditation requirements for using the global email network. This lack of security has had serious consequences for everyone from citizens and businesses to law enforcement and national security officials. Cybercriminals have found a way to use almost any brand, for just about any purpose, to attack your customers. Criminals use the instant trustworthiness of a well-known company against us to infiltrate our home networks. They can hide malware in fake emails, make them look like they’re coming from a real source and prevent spam filters from blocking them. The Department of Homeland Security measure the adoption of the DMARC email security standard by two categories: large federal agencies (those employing 250 or more employees) and smaller federal agencies. As of November 2017, only 32% of federal agency domains had published a DMARC policy to comply with the DHS mandate. WHAT IS DMARC? DMARC.org [Domain-based Message Authentication, Reporting, and Conformance] is an open email standard published in 2012 by the industry consortium DMARC.org to protect the email channel. Through DMARC, email senders can request reports about attempted mail-forgery for a given domain, allowing email receivers to evaluate mail streams for patterns of spoofed email that could be indicative of phishing or other malicious acts. DMARC is the only way for email senders to tell email receivers that emails they are sending are truly from them. DMARC enables agencies that send email using .gov domains to:
Authenticate all legitimate email messages for their email-sending domains, including messages sent from their own infrastructure as well as those sent by authorized 3rd parties Publish an explicit policy that gives mailbox providers a clear path on how to handle email messages that cannot be proven authentic. These messages can either be sent to a junk folder or rejected outright, protecting unsuspecting recipients from exposure to attacks
Gain intelligence on their email streams by letting them know who is sending mail from their domains. This data helps companies to not only identify threats against their customers, but to also discover legitimate senders that they may not even be aware of
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication, policy, and reporting mechanism that builds on existing technologies such as SPF and DKIM in order to improve their effectiveness and interoperability. By adopting DMARC in a coordinated way, both individual organizations and now entire industries can fight back against phishing attacks. You can use DMARC to create a record verifying that your domain sends email using only legitimate domains and uses the latest anti-spoofing technologies available. Furthermore, you can choose to tell receiving mail servers how each message should be handled if a domain in the message header fails authentication; this is called a DMARC policy. The simplest policy is “none,” which lets all messages pass through unaltered. You can also set “quarantine” to mark suspicious messages so they land in the recipient’s spam folder. And if you select the strongest policy, “reject,” messages will not be delivered, with an error instead.