How to Fight Business Email Compromise (BEC) with Email Authentication?

An ever-evolving and rampant form of cybercrime that targets
emails as the potential medium to conduct fraud is known as
Business Email Compromise.

Targeting commercial, government as well as non-profit
organizations, BEC can lead to huge amounts of data loss, security
breach, and compromised financial assets.

It is a common misconception that cybercriminals usually lay
their focus on MNCs and enterprise-level organizations. SMEs these
days are just as much a target to email fraud as the larger
industry players.

How Can BEC Affect Organizations?

Examples of BEC include sophisticated social engineering attacks
like phishing, CEO fraud, fake invoices, and email spoofing, to
name a few. It can also be termed an impersonation attack wherein
an attacker aims to defraud a company by posing people in
authoritarian positions. Impersonating people like the CFO or CEO,
a business partner, or anyone you will blindly place your trust in
is what drives these attacks’ success.

February of 2021 captured the activities of the Russian
cyber gang Cosmic Lynx as they took a sophisticated
approach towards BEC. The group had already been linked to
conducting over 200 BEC campaigns since July 2019, targeting over
46 countries worldwide, focusing on giant MNCs that have a global
presence. With extremely well-written phishing emails, they make it
impossible for people to differentiate between real and fake
messages.

Remote-working has made video conferencing applications
indispensable entities, post-pandemic. Cybercriminals are taking
advantage of this situation by sending fraudulent emails that
impersonate a notification from the video conferencing platform,
Zoom. This is aimed at stealing login credentials to conduct
massive company data breaches.

It is clear that the relevance of BEC is rapidly surfacing and
increasing in recent times, with threat actors coming up with more
sophisticated and innovative ways to get away with fraud.
BEC affects more than 70% of organizations worldwide and
leads to the loss of billions of dollars every year.

This is why industry experts are coming up with email
authentication protocols like DMARC^[1] to offer a high level of
protection against impersonation.

What is Email Authentication?

Email
authentication^[2]
can be referred to as a bevy of techniques deployed to provide
verifiable information about the origin of emails. This is done by
authenticating the domain ownership of the mail transfer agent(s)
involved in the message transfer.

Simple Mail Transfer Protocol (SMTP), which is the industry
standard for email transfer, has no such in-built feature for
message authentication. This is why exploiting the lack of security
becomes exceedingly easy for cybercriminals to launch email
phishing and domain spoofing attacks.

This highlights the need for effective email authentication
protocols like DMARC that actually delivers its claims!

Steps to Prevent BEC with DMARC

Step 1: Implementation

The first step to fighting BEC is actually configuring DMARC for
your domain. Domain-based Message Authentication, Reporting, and
Conformance (DMARC) uses SPF and DKIM authentication standards to
validate emails sent from your domain.

It specifies to receiving servers how to respond to emails that
fail either/both of these authentication checks, giving the domain
owner control over the receiver’s response. Hence for Implementing
DMARC, you would need to:

• Identify all valid email sources authorized for your
  domain
• Publish SPF record in your DNS to configure SPF for your
  domain
• Publish DKIM record in your DNS to configure DKIM for your
  domain
• Publish DMARC record in your DNS to configure DMARC for your
  domain

To avoid complexities, you can use PowerDMARC’s free tools (
free SPF record generator, free DKIM record generator, free DMARC
record generator) to generate records with the correct syntax
instantly and publish in your domain’s DNS.

Step 2: Enforcement

Your DMARC policy can be set to:

• p=none (DMARC at monitoring only; messages failing
  authentication would still be delivered)
• p=quarantine (DMARC at enforcement; messages failing
  authentication would be quarantined)
• p=reject (DMARC at maximum enforcement; messages failing
  authentication would not be delivered at all)

We would recommend you to start using DMARC with a policy
enabling monitoring only so that you can keep a tab on the email
flow and delivery issues. However, such a policy wouldn’t
provide any protection against BEC.

This is why you would eventually need to shift to DMARC
enforcement. PowerDMARC helps you seamlessly shift from monitoring
to enforcement in no time with a policy of
p=reject, which will help specify to receiving
servers that an email sent from a malicious source using your
domain would not be delivered to your recipient’s inbox at all.

Step 3: Monitoring and Reporting

You have set your DMARC policy at enforcement and have
successfully minimized BEC, but is that enough? The answer is no.
You still need an extensive and effective reporting mechanism to
monitor email flow and respond to any delivery issues. PowerDMARC’s
multi-tenant SaaS platform helps you:

• stay in control of your domain
• visually monitor authentication results for every email, user,
  and domain registered for you
• take down abusive IP addresses that try impersonating your
  brand

DMARC reports are available on the PowerDMARC dashboard in two
major formats:

• DMARC aggregate reports (available in 7 different views)
• DMARC forensic reports (with encryption for enhanced
  privacy)

A culmination of DMARC implementation, enforcement, and
reporting help you drastically reduce the chances of falling prey
to BEC scams and impersonation.

With Anti-Spam Filters, Do I Still Need DMARC?

Yes! DMARC works very differently from your ordinary anti-spam
filters and email security gateways. While these solutions usually
come integrated with your cloud-based email exchanger services,
they can only offer protection against inbound phishing
attempts.

Messages sent from your domain still remain under the threat of
impersonation. This is where DMARC steps in.

Additional Tips for Enhanced Email Security

Always stay under the 10 DNS Lookup
Limit.

Exceeding the SPF 10 lookup limit^[3]
can completely invalidate your SPF record and cause even legitimate
emails to fail authentication.

In such cases, if you have your DMARC set to reject, authentic
emails will fail to get delivered. PowerSPF is your automatic and
dynamic SPF record flattener that mitigates SPF permerror by
helping you stay under the SPF hard limit.

It auto-updates netblocks and scans for changes made by your
email service providers to their IP addresses constantly, without
any intervention from your side.

Ensure TLS Encryption of Emails in
Transit

While DMARC can protect you from social engineering attacks and
BEC, you still need to gear up against pervasive monitoring attacks
like Man-in-the-middle (MITM).

This can be done by ensuring that a connection secured over TLS
is negotiated between SMTP servers every time an email is sent to
your domain.

PowerDMARC’s hosted MTA-STS makes TLS encryption mandatory in
SMTP and comes with a straightforward implementation procedure.

Get Reports on Issues in Email Delivery

You can also enable SMTP TLS reporting to get diagnostic reports
on email delivery issues after configuring MTA-STS^[4]
for your domain. TLS-RPT helps you gain visibility into your email
ecosystem and better respond to issues in negotiating a secured
connection leading to delivery failures.

TLS reports are available in two views (aggregate reports per
result and per sending source) on the PowerDMARC dashboard.

Amplify Your Brand Recall with BIMI

With BIMI (Brand Indicators for Message Identification), you can
take your brand recall to a whole new level by helping your
recipients visually identify you in their inboxes.

BIMI works by attaching your unique brand logo to every email
you send out from your domain. PowerDMARC makes BIMI implementation
easy with just 3 simple steps on the user’s part.

PowerDMARC is your one-stop destination for an
array of email authentication protocols, including DMARC, SPF,
DKIM, BIMI, MTA-STS, and TLS-RPT. Sign up today to get your free
DMARC
Analyzer^[5] trial!