cyber-security-news

[cyber-security-news]

Gmail increases email security by adding support for BIMI

Domain-based Message Authentication Reporting and Conformance (DMARC) will allow organizations to increase the trust of Gmail recipients by automatically displaying their logos in emails, newsletters, and offers.

Gmail's support for the Brand Indicators For Message Identification (BIMI standard) makes it possible to show that these types of email communications are indeed coming from a legitimate source.

About BIMI

BIMI allows the use of brand-controlled logos in email clients. BIMI does not provide security solutions, but it is a tool that allows you to use brand-controlled logos in your email clients.

The BIMI AuthIndicators Working Group explained that email must pass DMARC authentication checks to allow the logo to be displayed. It ensures that the domain of the organization has not been impersonated.

Fastmail, Google, and Mailchimp support the specification. The BIMI brand indicator is displayed next to the company email sent to Yahoo Mail and Fastmail addresses. It will also start appearing in Gmail.

The Working Group stated that "other mailbox providers have indicated intentions to adopt shortly".

Gmail: About BIMI Companies publish a BIMI record via DNS. It points to the SVG logo indicator used and a VerifiedMark Certificate for those recipients that require it (e.g. Gmail).

"BIMI leverages Mark Verifying Authorities (like Certification Authorities) to verify logo ownership and prove that verification in a VMC has been made. After these authenticated emails have passed our anti-abuse tests, Gmail will begin displaying the logo at the existing avatar slot," Neil Kumaran (Senior Product Manager, Counter-Abuse Technology at Google) and Wei Chuang (Senior Software Engineer at Gmail Security) explained.

The DigiCert and Entrust certification authorities can validate the logos of organizations.

"BIMI adds a layer of security to Gmail. It requires strong authentication and verification before logos can be displayed in the Gmail avatar slot. Strong authentication improves trust in the origin of the email and gives recipients a more immersive experience. This also helps email security systems distinguish legitimate messages from phishing or spoofed emails," said the Google Workspace team.

EmailAuth announced the general availability of Amplify. This solution allows clients to display their logos along with authenticated emails.

Original source: https://medium.com/@rawatnimisha/gmail-increases-email-security-by-adding-support-for-bimi-6deb865f04e0

[cyber-security-news]

BIMI allows the use of brand-controlled logos in email clients. BIMI does not provide security solutions, but it is a tool that allows you to use brand-controlled logos in your email clients.

[cyber-security-news]

How does DMARC prevent criminals from spoofing your domain?

If your organization does not implement DMARC, it enables cyberattackers to:

Transmit funds from susceptible employees through fraudulent emails while impersonating key officials in your firm.

Send bogus bills to your workers and business partners.

Use your domain to sell illicit items.

Spread ransomware.

Impersonate customer service in order to get sensitive customer or partner information.

Such scenarios might have long-term ramifications for your company. The hazards are numerous, ranging from jeopardizing the brand's reputation among its partners and customers to the loss of critical corporate information and millions of dollars.

Domain Spoofing for the Unversed

Domain spoofing is a typical type of security breach in which a cybercriminal attempts to imitate a company's corporate email domain in order to carry out a variety of destructive operations by faking the sender's address. The attackers use believable ‘From’ fields in the emails they send out to boost the likelihood of them seeming real and thus opened by recipients. The purpose of domain spoofing is to fool people into believing that the email originates from a reputable source and to influence them into interacting with the fraudulent email that contains harmful links.

So how do attackers do it? The answer is simple yet people tend to overlook it. The organization's absence of an email authentication procedure is what enables the success of domain spoofing. Email domains often use SMTP (Simple Messages Transfer Mechanism), a communication protocol that allows mail to be sent through digital systems.

It does, however, have limitations, such as the lack of an automatic email authentication system built into it. Cybercriminals use this flaw to spoof email domains and send out bogus emails that claim to come from you. Email spoofing may have serious effects, including the theft of critical corporate secrets or the solicitation of money payments from partners or workers while appearing as top leaders.

So, how does DMARC help?

DMARC, which stands for Domain-based Message Authentication Reporting and Conformance, is an email authentication mechanism designed to protect company domains and brands from spoofing attacks. To ensure that only genuine emails are delivered to end users, DMARC requires the deployment of a combination of SPF and DKIM email authentication methods.

Without DMARC, all emails sent from your company's email domain are sent to the recipient's inbox without any security checks or validation. However, using DMARC, the receiver's Mail Transfer Agent (MTA) pulls up the domain name's SPF, DKIM, and DMARC records to authenticate the sender. The email is delivered to the recipient's inbox once the sender has been validated or authenticated.

By authenticating all emails sent from your domain, you not only prevent imposters from using your domain name to conduct harmful actions and launder money, but you also increase email deliverability and help your customers and partners react to your emails more quickly.

Implementing email authentication techniques in your corporation allows you to keep up to speed on evolving attacker strategies, safeguard your corporate databases, and avoid financial or information losses.

Benefits of EmailAuth

To remain up to date with current hackers' ever-changing methods, selecting DMARC monitoring and timely reporting systems is important. To take your email authentication to the next level, however, opting for DMARC enforcement is the way to go. This will ensure email visibility and increase email delivery.

This is why you should put your trust in a product like EmailAuth. EmailAuth not only includes mechanisms for email authentication with DMARC, but it also includes a scalable set of extra functions that greatly outnumber the standard offerings.

[cyber-security-news]

If you're sending transactional emails for your application, you've certainly mastered the fundamentals, but you might be overlooking some advanced best practices without even realizing it. This article will assist you in ensuring that you haven't neglected anything and aren't inadvertently performing a task incorrectly that might harm your email delivery or user experience.

[cyber-security-news]

What is Transactional Email and how does it work?

Email is required for any program that requires user identification; nevertheless, email does not always receive the attention it deserves. It's simpler than ever to give your consumers a first-class transactional email experience thanks to current email service providers, but the difficulty for most of us is that we don't know what we don't know. 

We'll take a look at everything you'll need to bring your transactional email up to speed with the rest of your online application from beginning to end.

The distinction between transactional and bulk emails, as well as how and why to employ email authentication, will be discussed. We'll also go through how to gracefully handle delivery edge situations, how to write great email content, and what infrastructure you'll need to send email and track delivery. You'll be well on your way to being an expert in transactional email in no time.

Read Also: Set Incoming DMARC validation using TWO simple steps

Transactional email's challenges

An email has always been treated as a second-class citizen since it's more difficult to track and comprehend how well you're navigating through it. There are a plethora of performance monitoring solutions available for your application to give insights into the front-end, back-end, database, issues, and much more. The tools for using email are lesser-known and slightly difficult to master. So let's look at some of the issues that come with email monitoring and reporting. We'll then discuss the tools and methods that may help you overcome those obstacles and gain a better understanding of your transactional email.

The main problem with email monitoring is that it's tedious to check every recipient's inbox to determine if they've received the email. As a result, the greatest insights we can expect right now are essentially proxies or estimates of performance. The second significant issue is that each ISP has its own set of restrictions. What Outlook would classify as spam, and could end up in Gmail's inbox? Moreover, inbox providers can't divulge their ‘secret sauce’ since spammers would quickly abuse it. So, what should a developer do?

Open rates can offer you a general estimate, but they're incomplete since they rely on tracking pixels, which can be readily obstructed. Inbox rates and delivery times can't be measured directly, however. As a result, you'd have to make do with sending frequent tests to seed accounts that you can test. These aren't ideal, but they're the greatest proxy for understanding delivery to multiple inbox providers currently available. Later in the article, we'll talk about technologies that can help you automate this process.

Adding domain authentication in the form of DKIM, SPF, and DMARC may be complicated and confusing, and acquiring access or approval for DNS modifications, depending on the size of your firm, might be difficult or impossible. Even then, it's all too simple to make a mistake with the DNS entries. Don't worry if you're unfamiliar with domain authentication; we'll go over it in detail later.

Of course, even if you can consistently produce excellent results, bounce handling adds to the unpredictability. It's possible that the recipient's inbox is full. People move jobs, and their email addresses become dormant. Further, when it comes to email addresses, people make mistakes. When people join up using a group alias, one of the addresses in that group may cause a bounce. To add to that, temporary server or DNS failures might affect everyone on a domain's delivery. And then there's the issue of spam complaints.

So the odds are stacked against you from the start. There are several edge circumstances, and obtaining an accurate picture of your email delivery is quite challenging. Ongoing monitoring is difficult, and there's a lot of room for error. I realize it creates a bleak image. Fortunately, email has gone a long way, and while there are no easy fixes, there are viable alternatives to these issues.

Differences between transactional emails and bulk promotional emails

Before we proceed any further, it's important to understand the distinctions between mass promotional email and transactional email. Nobody will notice if an email is lost or delayed in the former case. A missing or drastically delayed password reset, on the other hand, might result in extra support requests. Transactional emails are just as important as a page in your app. A missing or delayed email might be compared to a malfunctioning page in your online application. Although email is a distinct medium, it is still an important part of the user experience when using your app.

Transactional emails generate greater open and click rates than mass promotional emails because people expect and want to receive them. Similarly, transactional emails will receive far fewer spam reports than bulk emails. All of this contributes to your transactional email having a higher reputation than mass promotional emails. That might mean the difference between the inbox and the spam folder in some circumstances. It might also be a question of which tab/label Gmail places the email in. Regardless, the distinction between transactional and bulk email is significant enough that Gmail suggests separating the two streams. Your transactional reputation will not be harmed as a result of your bulk reputation.

How can email authentication help

You've probably heard of acronyms like DKIM, SPF, and DMARC, and you've probably copied and pasted some DNS entries to put them up. You could even have skipped it because it seemed a little too difficult to implement. In any case, they are all important criteria to follow, and they all complement one another and work together to help you create and defend your reputation. The specific method for these will differ based on the supplier, but it's always worth putting in place.

Without going into too many technical specifics, DKIM accomplishes two goals. To start off, it functions as a virtual wax seal on your emails, ensuring that they haven't been tampered with in route. Second, you may use it to establish a domain reputation. While DKIM focuses on the domain, SPF provides a list of permitted IP addresses for sending emails. This gives recipient mail servers a better understanding of whether an email is coming from a valid source.

One of the most important advantages of DKIM is that it allows you to eliminate ‘via’ labels in Gmail and ‘on behalf of labels in Outlook. These components provide the impression that your emails are spam, and they might erode your receivers' confidence. As a result, DKIM is much more than a standard for behind-the-scenes communications. It's something that may have a direct impact on your receivers' experience.

While authentication cannot promise delivery, it is an important part of establishing your email reputation and doing everything possible to provide an excellent user experience and service. DMARC was created to aid in the prevention of phishing attempts. It combines DKIM and SPF to enable you to monitor your domain's sending and defend its reputation by allowing you to post a DMARC policy. When an email fails DMARC alignment, this policy instructs inbox providers what to do.

To increase your chances of alignment, create a bespoke return path. Then, keep an eye on your DMARC reports and make modifications as needed to verify that any genuine email sources are aligned. Finally, if your product or brand has been the subject of a large number of phishing assaults, gradually implement a more stringent quarantine or reject policy.

Closing note

When it comes to sending emails, you have a lot of alternatives. If you want to transmit for yourself, you can set up a server and Mail Transfer Agent (MTA), but you'll be taking on a lot of responsibility. It's tough to manage one's reputation. It's significantly more difficult to build partnerships with ISPs.

Regardless of how you handle email, make it an extension of your app's user experience rather than a last-minute addition. Take the time to produce clear, informative emails, and do everything you can to incorporate them smoothly into the user experience. Make sure you're not sending too many emails, and provide your users with the option to customize their email alerts.

Both delivery and engagement may be influenced by the content of your emails. While some regulations are apparent, others are more nuanced. Taking the time to carefully design good content may significantly boost open rates and engagement.

To learn more about email security, deliverability, and safety, head to EmailAuth.

Original source: https://www.reddit.com/user/emailauth-io/comments/u8kuwv/what_is_transactional_email_and_how_does_it_work/

[cyber-security-news]

How is Phishing Evolving and becoming increasingly dangerous?

Despite significant advances in how corporations can stop millions of cyber assaults, email threats continue to breach defenses because hackers are constantly modifying their attack patterns and strategies.

Cyber attackers change more than simply code; they also change methods. According to research, cyber threat actors are shifting from high-volume attacks to more focused operations, such as malware and social engineering. Ranging from lone operators to organized criminal organizations, malicious hackers are constantly laying down attacks that could begin with a single phishing email.

Phishing protection is becoming increasingly important as more crooks use online scams to steal your personal information. We've learned to avoid spam emails, but phishing emails can appear convincing. Some are even tailored just for you. Because you will almost certainly be subjected to a phishing attempt, you must be aware of the warning signs. Because frauds are nothing new on the internet, phishing is more difficult to detect than you may imagine.

Also Read: Best Practices for Protecting Your Company and Customers From Phishing Attacks Using Office 365 and DMARC

What is phishing?

Phishing convinces you to do anything that grants fraudsters access to your device, accounts, or personal information. They may infect you with malware or steal your credit card information by posing as a person or organization you trust.

To put it in simpler words, these social engineering tactics "bait" you with a fake sense of trust in order to obtain your vital information. This might range from a simple social media login to your full identification via your social security number.

These scams may get you to open an attachment, click a link, fill out a form, or respond with personal information. That logic requires you to be on alert at all times, which may be stressful.

Who can be attacked?

Phishing may affect people of all ages, whether in their personal lives or at work. Nowadays, everyone, from the elderly to small children, uses internet gadgets. A fraudster can add your contact information to their phishing target list if they can locate it publically.

Nowadays, it is more difficult to conceal your phone number, email address, online message IDs, and social networking profiles. As a result, simply possessing one of them makes you a target. Furthermore, attackers can be wide or extremely focused in terms of the people they choose to deceive.

Phishing scams you should  know about

The first challenge is determining what to anticipate from phishing. It may be transmitted through a variety of channels, including phone calls, SMS messages, and even hijacked URLs on completely legal websites. Once you've seen phishing in action, it's a lot easy to grasp. You've undoubtedly seen a couple of these frauds and dismissed them as junk.

Regardless of how they are targeted, phishing assaults can take a variety of paths to reach you, and the majority of individuals are likely to encounter at least one of the following types of phishing:

Phishing email comes in your inbox, frequently with a request to click a link, give money, reply with personal information, or open an attachment. The sender's email may be designed to look like a legitimate one and may contain information that feels personal to you.

Domain spoofing is a common method used by email phishers to impersonate legitimate email addresses. These schemes alter a legitimate company's domain (for example, @india.com). You might fall prey to the scam if you interact with an address like "@inndia.com."

Scammers use voice phishing (vishing) to trick you by calling you and impersonating a legitimate person or firm. They may divert you from an automated message while concealing their phone number. Vishers will try to keep you on the phone as long as possible, pleading with you to take action.

Phishing through SMS (smishing) This method, like vishing, will impersonate a legitimate company by utilizing urgency in a brief text message to trick you. You'll generally discover a website or a phone number in the message that they want you to utilize. This also applies to mobile texting services.

Criminals use postings or direct messages on social media to trick you into falling for their trap. Some are obvious, such as freebies or dubious "official" organization pages with an urgent requirement. Others may fake your close pals or develop a long-term friendship with you before 'attacking' to seal the deal.

Clone phishing is a forgery of a valid communication that was previously delivered, with legitimate attachments and links substituted with malicious ones. This shows in emails, but it may also surface in other forms, such as false social media profiles and SMS messages.

Phishing prevention tips

Every day, whether we like it or not, you will be the target of these phishing emails. Most of them are automatically filtered out by our email providers. Moreover, consumers have grown rather proficient at detecting these sorts of communications and using common sense to refuse their requests.

However, you are well aware of how misleading phishing can be. You're also aware that phishing attempts may affect any sort of communication or internet surfing, not simply emails. You may considerably lower your chances of being a victim of a scammer by following a few basic phishing avoidance guidelines.

Steps to protect yourself from Phishing

Internet security begins with your attitude and behavior in the face of potential cyber threats. Phishing tricks victims into revealing credentials for a variety of sensitive accounts, including email, workplace intranets, and others.

Even the most cautious customers may have difficulty recognizing a phishing effort. These assaults become increasingly complicated each time, as hackers discover new ways to alter their scams and give highly convincing messages that may easily deceive people.

Here are a few basic measures to take when it comes to your emails and other communications:

Use caution when disclosing sensitive information. Never open any links in an email that seems to be from your bank or any significant organization. Instead, open a browser window and input the address straight into the URL field to ensure the site is legitimate.

Never believe scary messages. Most respectable businesses will not ask for personally identifying information or account information over email. This includes your bank, insurance company, and any other corporation with whom you do business. If you ever receive an email requesting account details, delete it immediately and call the company to ensure that your account is in good working order.

Do not open any attachments in these suspicious or odd emails, particularly those in Word, Excel, PowerPoint, or PDF format.

Always avoid clicking on embedded links in emails since they might contain viruses. When receiving communications from merchants or third parties, be cautious; never click on embedded URLs in the original message. Instead, go to the site directly by putting in the right URL address to confirm the request, and study the vendor's contact rules and processes for seeking information.

Maintain the most recent versions of your applications and operating system. Windows OS products are frequently the focus of phishing and other malicious attempts, so be sure you're safe and up to date. This is true, especially for those still using Windows versions before 10.

Original source: https://www.reddit.com/user/emailauth-io/comments/u7006a/how_is_phishing_evolving_and_becoming/

[cyber-security-news]

DMARC (Domain-Based Message Authentication Reporting & Conformance) is an email authentication protocol, policy, and reporting protocol that allows organizations to protect their domain from unauthorized use, including spoofing, phishing, and other forms of spoofing. You must ensure that your organization complies with DMARC before you are eligible for a VMC.

[cyber-security-news]

How to setup DMARC to qualify your domain for VMC

What is DMARC?

DMARC (Domain-Based Message Authentication Reporting & Conformance) is an email authentication protocol, policy, and reporting protocol that allows organizations to protect their domain from unauthorized use, including spoofing, phishing, and other forms of spoofing. You must ensure that your organization complies with DMARC before you are eligible for a VMC.

Don't procrastinate

This process can take weeks to complete depending on how large your company is (bigger = more). It's best to start immediately. This blog provides a basic overview of the process.

For more information on securing your organization's email access, check out our blog on DMARC Benefits.

What you'll need

Before you start, ensure that you have the following:

A .txt editor (e.g., Notepad++, Vim, Nano, etc.)

Access to the DNS records of your domain

You can reach your server administrator if you cannot manage your DNS.

Step 1: Gather IP addresses to SPF

Setting up Sender Policy Framework (also known as SPF) is the first step in becoming DMARC compliant. It will stop unauthorized IP addresses from sending emails from your domain.

First, create a list with all authorized IP addresses that send mail from your domain.

These include:

Webserver

In-office mail server

Mail server for ISP

Any third-party mail servers

If you cannot find all IP addresses yet, don't panic. DMARC monitoring (step 4) can take care of this for you. It is good to gather as many documents as possible at this stage.

Step 2: Create an SPF record for your domain.

Next, use your text editor to create an SPF record.

Example 1: v=spf1 Ip4.1.2.3.4 ip4.2.3.4.5 ip4.x.x.x.x.x.x.x.x.x.x.x.x.x.x.x.

Example 2: v=spf1 ip4:1.2.3.4 ip4:2.3.4.5 include:thirdparty.com -all

Save the file once you are done.

To ensure everything is correct, use an SPF tool.

Step 3: Configure DKIM

DKIM, an email authentication standard, uses public/private keys cryptography to sign emails. It protects messages from being altered in transit.

First, select a DKIM chooser.

Example: "standard._domain.example.com" = hostname

Next, create a public-private key pairing for your domain.

PUTTYGen is a Windows tool that allows you to create custom windows.

Linux/Mac: Use ssh-keygen

Your DNS management console allows you to create and publish a new record for.TXT.

It should look something like this: v=DKIM1 p=YourPublicKey

Step 4: Monitor. Communicate. Continue to communicate.

It is the most crucial step. This step is also the most tedious. You will need to set up DMARC to monitor your email traffic and get a baseline of what was approved.

Note: Although it might be tempting to jump straight to enforcement, monitoring now will ensure important messages are not lost or permanently deleted after DMARC has been fully enabled.

Here are some ways to monitor your traffic using DMARC.

Make sure you have correctly set up DKIM and SPF.

Make a DNS record.

The "txt" DMARC record should be similar to "_dmarc.your_domain.com."

Example: "v=DMARC1;p=none; rua=mailto:dmarcreports@your_domain.com"

You can create a "p=none" (monitoring mode) DMARC record if you manage your domain's DNS. It is the same procedure as for the DKIM and SPF records.

If you cannot manage the DNS, your DNS provider can create the DMARC records for you.

A DMARC check tool can be used to verify your DMARC record.

Replication usually takes 24-48 hours.

DMARC will now generate reports that will provide you with a lot more visibility into the mail going through your domain and any messages flagged or flagged by DKIM and SPF.

Important: Here, you will find out if there are any legitimate senders in the report that weren't already included in your SPF records (step 1). You should update your record if there are.

Problem? The problem? We recommend using a DMARC processor as the data will be difficult to read.

Step 5: Socialize, then start stepping up enforcement

Once you have viewed enough mail to believe that legitimate messages are being flagged as unauthorized, you can now start to enforce your rights.

DMARC offers two levels of enforcement: "quarantine" and "reject." While "reject" is our final recommendation, it will still qualify your domain as a VMC.

However, before jumping to rejection, it is best to spend some time in quarantine. Here's how:

Log in to your DNS server, and search for the DMARC Record.

Open the DMARC records for the domain you are interested in and change the policy to "p=quarantine."

Example:

"v=DMARC1;p=quarantine;pct=10;rua=mailto:dmarcreports@your_domain.com"

Add the flag "pct", which indicates how many messages are subject to filtering. Start with 10%, and slowly increase the percentage until you reach 100%.

Once you have reached 100% filtering, your VMC qualification is complete, and you can start rejecting.

It is the easiest step.

Change "p=quarantine" to "p=reject" in your DMARC file

Congratulations! Officially, you have a lot more visibility into the messages coming from your domain. It has increased security for all users, protected yourself against large numbers of phishing attacks, and qualified your organization to receive a VMC certificate.

[cyber-security-news]

Email Spoofing 101: Methods of Prevention

Email Spoofing

Spoofing, in general, refers to the act of concealing the source of communication. Email spoofing occurs when thieves use emails to deceive receivers by faking an email header. The email receiver is, therefore, duped into thinking the email is from a reliable source and is likely to act on its contents.

Also read: Detect Email Spoofing via Email Headers!

Types of Email Spoofing 

Email spoofing can take many different forms:

Name spoofing occurs when an attacker impersonates the identity or display name of a person that the email receiver may trust.

Domain spoofing occurs when attackers imitate the domain of a website the receiver has signed up or subscribed to.

Lookalike domain spoofing occurs when an email address's domain is utilized to visually fool the receiver by sending emails from a similar-looking domain address. For example, if the letter 'o' in the domain address is substituted with a '0’, the receiver is visually duped into thinking the email is from a reliable source.

Certain security methods can assist administrators in protecting their domain from fraudsters. If these protocols are not enabled in the mail servers, there is no one validating the sender's authentication. This makes the domain vulnerable to attacks such as email spoofing, phishing, spam, and other cybercrimes.

SPF, DKIM, DMARC, and BIMI must all be configured to ensure that spoofing emails are recognized before they reach recipients’ inboxes, that attackers do not spoof your domain, and that your emails are sent appropriately to your recipients.

SPF: Protecting sending servers

The first step is to specify which servers will be used. SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are allowed to transmit messages for your domain. This protocol allows you to list the domain name’s authorized servers and IP addresses. This is the first step in the process of verifying your emails.

When a message from your company is delivered, the recipient's mail servers verify that it came from one of the approved domains. The communication will be classified as spam if it does not originate from a trusted domain. SPF records that are incorrectly set might create delivery issues. Depending on the email solution provider, they will generally give configuration instructions.

DKIM: Message signing and authentication

The DKIM (DomainKeys Identified Mail) protocol must also be deployed as a backup. It uses a pair of private and public keys to define the authentication of the email sending domain. The keys are used to sign and confirm the communications' origins.

It is a signature added to your DNS record that includes the signatory's identity. The signature is appended to the header of outgoing emails with the help of a private key. When the recipient's servers receive the email, they examine the source/sender and check whether it has been updated using the public key. The DKIM protocol works in conjunction with SPF to evaluate whether or not an email message should be deemed spam.

DMARC: Confirming the use of SPF and DKIM

SPF and DKIM are followed by DMARC (Domain-based Message Authentication, Reporting, and Conformance). The DMARC record certifies the implementation of the SPF and DKIM protocols, namely the header-to-sending-domain correspondence.

This authentication protocol may be used to check SPF, DKIM, and DMARC configurations. It specifies the procedures to be followed if an email fails to pass certain tests. Reject, quarantine, or do nothing are the three possibilities. The rules can be set to tolerate soft or hard alignment.

In addition, the DMARC protocol generates reports that reveal which communications from your domain have been validated and which have not. This can help you identify potential threats, abuse, or configuration problems.

BIMI: A visual signal

Finally, the BIMI setup (Brand Indicators for Message Identification) is available as a visual authentication protocol. It is a visual enhancement that indicates the sender's identity rather than a technological aspect that strengthens security.

The brand logo is shown next to the email in the recipients’ inbox. If you have SPF, DKIM, and DMARC protocols enabled, and the DMARC policy is set to quarantine or refuse, you can add BIMI. If any of these recommendations are absent, BIMI can’t be implemented.

Although BIMI has been in use since 2019, not all email services (such as Outlook and Office365) support it. Although the concept of strengthening trust by displaying a picture of the sender next to an email is appealing, it does not ensure protection from phishing.

It is no arduous task for an attacker to seek out the picture/logo of a reputed organization, then set up a domain with SPF, DKIM, and DMARC, and send an email to an unsuspecting victim. Users will be much less wary of this email, hence the BIMI will be a disadvantage.

These three procedures reduce the chances of users falling prey to email spoofing attempts. They're also used to safeguard domains that don't send emails. Email spoofing is substantially less widespread now than when these safeguards weren’t implemented. Check out more about DMARC, DKIM, and SPF at EmailAuth. 

Original source: https://telegra.ph/Email-Spoofing-101-Methods-of-Prevention-04-06

[cyber-security-news]

Email spoofing explained: Who does it and how?

Email spoofing definition

Email Spoofing is the act of forging email so that it appears as if it came from someone who it did not. I discovered how to spoof email during the autumn of 1993 in my second year of college at Northwestern. An upperclassman from my dorm demonstrated to me how to do it. In the past, we could read our emails through telnetting to the mainframe of the campus after which we used elm which was the first step to Mutt.

"Look," he said, "You just change the "From" header to whatever you want. Do not ever do this again or you'll be caught in the crossfire." I never did.

For a long time, email spoofing was easy but only in recent years have security measures to combat this problem been added as an afterthought. Kludges such as SPF, DKIM and DMARC make spoofing emails more difficult than it was previously; however these solutions aren't widely used, and there are still workarounds for fraudsters, spammers and Phishers to spoof.

Even more troubling, the idea of bringing backport security to email is a challenge for many of the most sophisticated security minds of our time. Many of them would rather throw email out and start from scratch. Email is not secure due to the fact that most email users of the 1970s were either military or academic and were therefore considered to be reliable. Because email is so integrated into our lives, attempting to remove it and substitute it for something that is secure by design is like trying to turn windmills.

Forgery is so much simpler on the internet. It is difficult to fake signatures written by hand. Criminals who are skilled provide (and continue to offer) services like this, however the barriers to entry are extremely high, and so is the chance of being found guilty. A letter written by hand or even a typewritten letter that has a signature that you can recognize, is a powerful evidence that the letter is genuine.

The level of trust that we have in our lives isn't reflected in the digital world, however our brains are yet to catch up. A known email address has the same amount of trust within our brains like a letter written by hand from a friend or loved one, but without proving that trust.

Who would like to sabotage your confidence? So many people.

Who is spoofing email?

"I am your CEO and will hereby ask you to pay the paltry amount of USD 14 million in our brand new provider of gadgets such as whatchamacallits, thingamabobs and others. As a petty gesture of good faith, I've taken a blood oath to pay prior to when it is the time that Celestial Serpent consumes yonder fiery orb. I beg you, my number cruncher, do it happen."

I'm kidding, but fake emails such as this one are the graveyards of well-meaning corporate careerists attempting to impress their boss. An authentic letter from your boss advising you to transfer money abroad In many departments of accounts payable This isn't only an everyday thing, but maybe it's an hourly thing.

What's the best way for the world of business going if the information you receive in your email is reliable? We're trying to solve it.

How do you stop emails from being spoofing: SPF, DKIM and DMARC

SPF (Sender Policy Framework) was the very first attempt to fill an opening with the smallest bandage that they sell. What are those tiny ones that are about 1 inch wide and one quarter inch wide? That's SPF.

The first time it was proposed was in 2004. SPF was not officially adopted as a Request for Comments (RFC) up to 2014. SPF operates by publishing by letting the domain administrator publish the IP addresses that are allowed to send emails to that domain, which makes it possible for an email server to examine the DNS before deciding to accept or reject any particular email.

The band-aid's tiny size was not sufficient, so a more substantial piece of gauze was used: DKIM (DomainKeys Identified Mail) that cryptographically sign outgoing emails on the server. Domain owners can publish the public key within the domain's Domain Name Service (DNS) and allow email servers to search for and verify cryptographically DKIM signatures. DKIM was not standardized until the year 2011.

What happens when an incoming email fails both tests? SPF as well as DKIM checks? Shrug emoji here. Enter DMARC (Domain-based message Authentication reporting, Conformance) is a big bandage that generally does the job however that axe-gash remains pretty gritty. DMARC does not really solve the problem but it can get injured email warriors to their feet.

DMARC lets domain owners publish on their DNS the information they wish to happen with spoofed mail and, most importantly, it establishes a mechanism to report on email servers to notify domain owners that they have received fake email. A typical implementation of DMARC begins by not reporting ("p=none") Then, it requires that any spoofed email is declared spam ("p=quarantine") and lastly, the public is informed that the spoofed email will be returned to the face of the sender ("p=reject").

How can you fake email

Despite all this effort to protect emails -- which has, it should be noticed, greatly reduced the use of the use of email spoofing, smart attackers have numerous technical loopholes they can exploit.

It isn't possible to spoof emails sent from xyz@xyz.com because AcmeCorp.com is DMARC configured to "p=reject"? You can spoof an email sent coming from AcneCorp.com instead. The domain doesn't need to be in existence. If it exists, do you think that the parked domain has DMARC used? Perhaps it doesn't.

You can even make an account that is a throwaway Gmail account, xyz@gmail.com. If you're a lazy user, or someone who is in a hurry, might not even think about it.

This requires universal adoption and proper implementation and configuration of SPF, DKIM and DMARC. This isn't the reality that we live in our day-to-day lives.

It's a simple matter to spoof emails to perform, and the technical capabilities required for this type of attack are extremely weak and could be extremely lucrative. If we don't find a way to dump all of our email in the trash and set it on fire , and then swap it out with something that is secure by design, we'll be spending a huge amount of money and time to defend our businesses, our governments as well as our entire society from this baffling weakness.

Original source: https://medium.com/@rawatnimisha/email-spoofing-explained-who-does-it-and-how-e7f82c3ab0a3

[cyber-security-news]

As you read this, the cybersecurity sector is expanding. More experts are joining the ranks, and more malware is being released on a regular basis than ever before. Every day, 230000 new malware samples are recorded. To counter cyber threats, additional resources are being deployed. That's why I thought it would be useful to compile a list of seven cybersecurity facts that describe today's information security landscape.

[cyber-security-news]

Email Security Flaws That May Leave Your Business Vulnerable to Attacks

Email dangers are emerging quicker than ever in this digital risk landscape. Cybercriminals are becoming sophisticated in their strategies, tactics, and techniques, such as social engineering and file-less malware, to fool users, circumvent security measures, and, eventually, get paid. 

Too many organizations are trying to adapt and adjust to the heightened digital threat landscape caused by the pandemic or have neglected to prioritize email security, putting them in danger of a severe cyberattack or data breach.

Endpoint security solutions, antivirus software, spam filters, and built-in Microsoft 365 email protection are no longer effective in safeguarding corporate emails against advanced and developing assaults. This blog post will illustrate the critical areas where traditional email security defenses fail to protect users, sensitive data, and vital company assets from contemporary attacks.

Also Read: Email Security for Your Organization — EmailAuth

2022 and the Rise of Unseen Challenges 

Because of the obstacles posed by the pandemic, many organizations have neglected to commit appropriate time and money to email security in recent years. This is a major error: email security is not a commodity; rather, it is more important than ever for cybersecurity and commercial success. Email is the most popular attack channel among cybercriminals, accounting for more than 90% of all current cyber assaults and breaches.

While email-borne cyber assaults used to be simple such as ‘cookie-cutter’ phishing schemes that preyed on unsuspecting victims, those days are long gone. Modern email attacks are so complex and misleading, utilizing advanced tactics such as social engineering, zero-day ransomware, and polymorphic viruses, that you can’t blame the victims for falling for the hoax. Let's take a look at some of the top email security vulnerabilities that will leave firms exposed to attack in 2022.

Let’s take a look at the major challenges to email security:

Relying On In-Built Protection

Despite email service providers’ built-in email safety, 85% of customers have experienced an email data leak in the last year. Although native email security is a solid start, it exposes key security vulnerabilities that cybercriminals may easily exploit to deceive users into providing important passwords or installing harmful malware on their devices. The limitations to the native security are:

Protection is static, one-layered, and incapable of anticipating evolving threats. Microsoft EOP ignores human error and is poor at anticipating incoming zero-day attacks, malicious URLs, and attachments that are not specified in static lists.

Homogeneous architecture makes it easier for attackers to circumvent security measures. Because the security system in native systems is consistent, cybercriminals may enter any account, test their tactics until they can circumvent default filters, and then repeat their strategies to attack thousands of different accounts.

Making End-Point Security the Main Line of Defense 

The trend of depending only on endpoint security is changing as organizations see that protection that works at the client level on devices such as laptops, desktops, and mobile devices is limited in its capacity to protect people and critical assets from today's sophisticated threats. Despite widespread usage of endpoint protection, email-borne assaults and breaches are occurring at an unprecedented rate, with one out of every five firms being attacked on a daily basis.

Improper Email Authentication Services

Even the most inventive and cutting-edge email security solutions continuously fall short when it comes to managed services. An efficient email security solution cannot simply be chosen and purchased, leaving the administrator in charge of configuration and administration. Small firms frequently lack a full-time IT department or mail administrator, and even when these roles are filled, enterprises cannot rely on IT personnel to safeguard corporate email accounts since they are not always qualified email security specialists.

Instead, safeguarding corporate email is an ongoing effort that needs round-the-clock monitoring and management by a team of professionals committed to identifying developing dangers and providing the unique real-time counsel required by each firm. Failure to install a corporate email security solution that is followed by continuous, professional management, system monitoring, and support services frequently leaves firms exposed to attack - even when additional email security protections are in place.

This is where we come in. EmailAuth provides complete email authentication services automating security for your domain. Ranging from DMARC automation to other email authentication protocols such as SPF, DKIM, and BIMI. Secure your business email using EmailAuth’s services today! 

Follow us on social media

Linkedin:https://www.linkedin.com/company/emailauth/

Facebook: https://www.facebook.com/emailauth.io

Instagram: https://www.instagram.com/emailauth

Original source: https://www.evernote.com/shard/s373/sh/39fb13c6-7040-fb4c-1fee-48328df6eb98/818ee59473715fbb44a394bf59808b89

[cyber-security-news]

Companies expend time and money to prevent fraudulent emails before they reach customers' inboxes using the DMARC (Domain-based Message Authentication Reporting and Conformance) standard to protect from SPAM emails.

[cyber-security-news]

The Role of DMARC in preventing Phishing

Introduction

We’ve all heard a lot about phishing and how attackers steal money and data from gullible users. The impact is huge. You might wonder. How do we get rid of this menace? How do we keep our emails safe? How do we ensure that our emails are used by just us and not somebody else? 

We have an answer for all your questions: DMARC!

DMARC for Dummies

DMARC (Domain-Based Message Authentication, Reporting, and Conformance) is a standard or system for determining whether or not an email is legitimate. It uses SPF and DKIM, two additional protocols, to determine an email's authentication state. DMARC allows organizations to see who is sending emails from their domain, improves email delivery, and, most critically, protects against domain spoofing, phishing, and impersonation threats.

If your company's domain name is mycompanyisthebest.com, you don't want a cyber attacker to be able to send emails from that address. This jeopardizes your brand's reputation and has the ability to propagate financial malware. The DMARC standard avoids this by verifying that emails are being sent from the expected IP address or domain. It defines how domains should be informed if there are difficulties with authentication or migration, and it gives forensic information so that senders may monitor email traffic and quarantine suspicious emails.

Now you might ask why would you need DMARC specifically? 

Why DMARC?

Well, firewalls and Internet security software, for example, are insufficient to guard against email phishing attacks. To strengthen your security, you must first understand how your firm communicates via email. This necessitates the use of advanced techniques, such as professional email forensics software. These programs can help you parse and analyze every email that your company sends and receives in order to identify potential email phishing attempts and mitigate damage even if an attack has already happened. However, before you do so, you should think about implementing easily available email security standards like DMARC, SPF, DKIM, and DMARC is the best option available to safeguard your incoming and outgoing emails.

Identifying a Phishing Attack

The threat of spoofing is not new. Email spoofing is a misleading technique used by attackers to modify both the identity of the sender and the seeming origin of email communication. The majority of spoofing attacks employ falsified header information or construct a bogus sender email address.

Recipients can detect phishing emails sent from a faked firm domain by inspecting the email header information, such as the "from:" and "return-path" addresses, and ensuring that they match. While the email "From" address is normally accessible in the header, the "return-path" address is not always visible, and upon inspection, it might assist receivers to determine the original identity of the attacker.

Stop Email Phishing Using DMARC 

To let DMARC handle all security checks for your email communications, you need to set up the policy of p=reject. It is an effective solution in countering a wide range of assaults, such as direct-domain spoofing and email phishing.

DMARC assists in verifying the origin of emails and preventing bogus emails from being received and opened. However, only a tiny number of firms have embraced the protocol, and an even fewer number of them have done it successfully.

EmailAuth's DMARC analyzer assists businesses in attaining proper DMARC enforcement! While ignoring a DMARC reject policy might result in the loss of genuine emails, hosted DMARC services assure improved email deliverability and fewer email phishing assaults over time.

EmailAuth's DMARC analyzer assists enterprises in securely upgrading their DMARC policy from monitoring only to p=reject, allowing them to reap the advantages of email authentication without fear of repercussions.

Furthermore, while you are on p=reject, you may take advantage of BIMI's visual identification benefits by attaching your distinctive brand logo to certain outgoing emails that reach your clients.

Original source: https://www.reddit.com/user/emailauth-io/comments/tatkpk/the_role_of_dmarc_in_preventing_phishing/

[cyber-security-news]

Fight BEC using Email Authentication

The Impact of BEC on Organizations

It is a prevalent misperception that cybercriminals target multinational corporations and enterprise-level businesses. Email fraud now affects SMEs just as much as it affects bigger corporations.

Social engineering assaults like phishing, CEO fraud, false invoicing, and email spoofing to mention a few are examples of BEC. It's also known as an impersonation attack, in which an attacker tries to defraud an organization by impersonating persons in positions of authority. The high effectiveness of these assaults is due to impersonating persons such as the CFO or CEO, a business partner, or anyone you would blindly trust.

Post-pandemic, video conferencing programs have become important due to remote working. Cybercriminals are taking advantage of the issue by sending bogus emails that appear to be from Zoom, a video conferencing company. This is focused on acquiring login credentials in order to commit big data breaches at an organization.

It is undeniable that the importance of BEC has risen in recent years, with threat actors devising increasingly complex and imaginative ways to get away with fraud. BEC impacts more than 70% of enterprises globally, resulting in annual losses of billions of dollars.

This is why email authentication mechanisms like DMARC are being developed by industry specialists to provide high-level security against impersonation.

Safeguarding your Assets Using Email Authentication 

Email authentication is a collection of mechanisms used to offer verifiable information about the source of emails. This is accomplished by verifying the mail transfer agent(s) engaged in the message transfer's domain ownership.

The industry standard for email transport, Simple Mail Transfer Protocol (SMTP), does not include a built-in mechanism for message authentication. As a result, fraudsters may easily conduct email phishing and domain spoofing attacks by abusing the absence of protection. This emphasizes the need for good email authentication methods such as DMARC that really deliver on their promises.

The Role of DMARC in Fighting BEC 

Configuring DMARC for your domain is the first step to combating BEC. SPF and DKIM authentication standards are used by Domain-based Message Authentication, Reporting, and Conformance (DMARC) to authenticate emails received from your domain. It tells receiving servers how to handle emails that fail one or both of these authentication tests, providing the domain owner complete control over the recipient's response. As a result, in order to implement DMARC, you'll need to:

Determine all permitted email providers for your domain.

To configure SPF for your domain, publish an SPF record in your DNS.

To configure DKIM for your domain, add a DKIM entry to your DNS.

To configure DMARC for your domain, add a DMARC record to your DNS.

You may configure your DMARC policy to:

p=none (solely used for monitoring; communications that fail authentication are still transmitted)

p=quarantine (quarantine level; communications that fail authentication are sent to the spam/junk folder)

p=reject (DMARC’s strictest setting; communications that fail to authenticate will not be transmitted at all)

We propose that you start utilizing DMARC with a monitoring-only policy so that you can track email flow and delivery difficulties. However, such a strategy would be useless in the face of BEC. This is why you'll need to switch to DMARC enforcement in the future, and EmailAuth can help with this.

With a policy of p=quarantine or p=reject, EmailAuth affords you a smooth transition from monitoring to enforcement in no time, indicating to receiving servers that an email sent from a malicious source using your domain will not be sent to your recipient's inbox at all.

EmailAuth is your one-stop destination for an array of email authentication protocols, including DMARC, SPF, DKIM, BIMI. Sign up today to avail a free DMARC checker.

Original source: https://www.reddit.com/user/emailauth-io/comments/t4yckx/fight_bec_using_email_authentication/

[cyber-security-news]

The DMARC (Domain-based Message Authentication, Reporting, and Conformance) anti-phishing and anti-spoofing protocol can help reduce this ambiguity and danger. 

[cyber-security-news]

Business Email Compromise is an ever-evolving and pervasive kind of cybercrime that uses emails as a possible conduit for fraud. BEC, which targets commercial, government, and non-profit organizations, has the potential to cause massive data loss, security breaches, and financial asset compromise.