This practice is commonly known as 'phishing', which is typically carried out by 'email spoofing'. With increasing frequency, these criminals are no longer targeting just top brands, but also setting their sights on small and medium-sized businesses. As larger organisations adopt security strategies to prevent these attacks, hackers are moving down the road to easier targets.
No company is immune to a spoofing attack. Most large organisations and B2C companies are already taking steps to resolve this issue. It's important that B2B, as well as medium and small businesses also protect themselves.
Smaller businesses are especially vulnerable because, too often, they assume they aren't big enough to draw hackers' attention, and they haven't adopted the security strategies needed to fight this type of cybercrime. The flaw in that kind of thinking is that hackers don't care about the size of a business, they only care about vulnerability. They can get plenty of 'loot' from mounting a series of attacks on vulnerable small and medium-sized business, and then use that data to launch an attack against a larger target. In the meantime, they've collected your employee and customer data, banking information and passwords, and they've compromised your brand.
Hackers use spoofing to make an email message look like it's from a sender the recipient knows or trusts to trick them into opening it. They simply edit an email address to make it look like it came from the sender's email account, so that when it's opened, it can infect the recipients' system with malware, or provide a pathway for the hacker to steal credit card data, passwords or other personal and financial information. They can do this because email doesn't support authentication, allowing any criminal to send an email purporting to be from your company or brand.
The Anti-Phishing Work Group's Phishing Activity Trends Report for the first quarter of 2014 indicates the number of phishing sites grew by 10.7% over the fourth quarter of 2013. The report further notes that 557 brands were targeted by phishers in the first quarter of 2014, compared to 525 in the fourth quarter of 2013. Additionally, more than 32% of personal computers around the world are now infected with malware, adware or spyware.
To combat spoofing, 15 email services providers, financial firms and message security companies-including AOL, Google, Microsoft, Return Path and Yahoo!- founded DMARC.org, a working group to create standards to reduce the threat posed by phishing, spam and other messaging abuses. Domain-based Message Authentication, Reporting and Conformance (DMARC) standardises the way recipient email servers perform email authentication using SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) mechanisms. The organisation was launched in January 2012 and now protects 60% of global consumer email inboxes, and 80% in the US.
Large organisations, including such top brands as Twitter, Amazon, eBay, Facebook and PayPal have adopted DMARC to combat spoofing with relatively good success. According to DMARC.org, Outlook.com reported a 50% drop in reported phishing in 2013 due, in part, to DMARC. Additionally, more than 25 million email messages spoofing PayPal were rejected during the 2013 holiday buying season. What DMARC provides these organisations is visibility into whether their email is authenticating-proof that the email is coming from your own domain and not some other unauthorised domain that only looks like your site. Without DMARC there is no visibility and senders remain unaware of authentication problems because they have no way to get feedback about potential email spoofing, or to determine what to do with those emails-whether to block them or quarantine them somewhere.
As hackers troll for easier targets, it is vital for businesses of all sizes to protect their brands by adopting DMARC. Although most people today know not to open questionable attachments or click on suspicious links, spoofers have become so good at what they do that their targets can be easily fooled into believing an email is legitimate.
If you don't make it tough for other people to spoof your email, you're not only letting down your customers-who will stop trusting any email from your company-you're putting your brand at costly risk. By adopting DMARC, you can protect your customers against email spoofing, ensure they are getting your brand's legitimate messages, and help them to trust that when a message from your company appears in their inbox, it is a valuable email. As you adopt DMARC, it's also important to include your third-party marketing vendors that send emailed marketing pieces, such as newsletters, to your customers on your behalf to set up SPF and DKIM.
Email is still an important avenue of communication for businesses to maintain existing customer relationships and develop new ones. Unfortunately, it's also a widespread target for cybercriminals to cause irreparable damage to a brand. Any time a successful technology is adopted, it breeds creativity in criminals.
As DMARC becomes more widely adopted, not just by large organisations but also by small and medium-sized businesses, cybercriminals will look for other areas to exploit. Are you responsible for ensuring that emails sent on behalf of your company are legitimate, and not coming from a spoofer? Do you have a fiduciary responsibility to customers who are negatively impacted on by a spoofer's email appearing to be from your company? Let's assume you are a nation state issuing currency to be used by citizens. Is the government responsible for ensuring the currency cannot be easily counterfeited? If the answer is yes, then the same goes for your corporate email, too.
No company should allow spoofers to diminish its customers' trust in its brand. By adopting DMARC and implementing email authentication standards you can help thwart the attacks that could be the downfall of your business.
For more, go to DMARC.org
