Secrets to Achieving End-to-End Email Security

The problem with email is that is has been around forever, but it has never really been locked down. As a result, one of the main channels that we use for communicating has no built-in security. To underscore the problem that the insecure email channel presents, the Online Trust Alliance recently analyzed breaches publically disclosed over the last ten years and reported that 95% of the breaches started with an email phishing attack.

DMARC is lauded as a best practice for locking down email. By turning on DMARC monitoring, security practitioners can gain visibility into when and how their domain is being abused or impersonated, as well as the magnitude of the attacks.

Recommendations include:

• Publish DNS policies to immediately allow DMARC participating inbox providers to provide reports about phishing emails that impersonate your domain.

• Publish a Reject Policy to provide quarantine or delete instructions for email that doesn’t match established authentication protocols or DNS policies.

• Institute DMARC reject policies with a considered approach because the can have a lot of consequences, such as breaking the mail flows if not done properly.