Date: 5 December 2017
Would you believe IBM’s claim that half of all email traffic worldwide may be malicious!? (IBM Threat Intelligence Index 2017). Even the UK’s tax collector, HMRC, found themselves at the mercy of cyber fraudsters and were labelled as the most abused and phished domain. Over half a billion unauthorised and spoofed emails a year were sent from their domain (source: HMRC).In this short piece, aimed at a predominantly non-technical management audience, I discuss the following
- HMRC's email fraud problem and how they solved it.
- DMARC and its benefits to your business.
- A brief introduction to DMARC (not technical).
- Benefits of using a managed service approach to DMARC.
- How you can check if your email domain is DMARC enabled.
What did HMRC do?
To repair their damaged reputation, HMRC’s former CISO and a long-standing friend of Cyber Management Alliance adopted DMARC and within 12 months, significantly reduced the number of spoofed emails! Now this is where it gets really interesting.
Benefits of DMARC
Enabling DMARC not only cut down HMRC's spoofed emails (emails that fraudsters were sending to customers), it enabled them to dramatically increase email deliverability rate by up to 400%. Now, imagine the expressions on the faces of your marketing team when they hear that DMARC will:
- Increase email deliverability by up to 400% or more - imagine the business benefits!
- Greatly reduce the chances of your domain being put on the SPAM register!
- STOP fraudulent emails using your domain from being delivered to your clients and customers
As you know, we at Cyber Management Alliance are passionate about making the Internet a safe place for businesses and consumers. Some of the questions that DMARC can help you answer include:
- How many fraudsters are impersonating your domain to commit cyber fraud?
- How many emails these fraudsters are sending?
- How many marketing agencies are sending email on your behalf?
- Are you able to block these fraudsters that are damaging your brand?
- Can you increase the deliverability of your emails to customers?
DMARC’s role is crucial enough that, in the UK, it has been made mandatory by the NCSC/GCHQ for all UK government departments.
How Does DMARC Work?
Sender Policy Framework
DomainKeys Identified Mail, or DKIM, uses cryptography to prove that the email header and/or body of an email is correct at the point of sending and receipt, and determines the sender is indeed the owner of the email domain.
DMARC-as-a-Service or DIY?
You can implement DMARC yourself if you have the time and the skilled resources to manage it. You will need to understand and make sense of the XML data, and create and display the valuable output you get from DMARC implementation.
Or, you can do what our business does and use Advanced Cyber Solutions, our partners for implementing DMARC-as-a-Service. In our opinion, using a managed service provider has several benefits including:
- Make setting up DMARC really straightforward.
- Saving you time and the headache in interpreting the output.
- Having a management-ready dashboard to gain useful and actionable insights.
A sample of what a managed service provider offers.
Is my email domain DMARC-enabled?
By now, you and I can agree that most cyber criminals are a deceitful bunch and they will continue to use emails and email-spoofing as their primary method of attack. As a first step, I urge you to check if your email domain is using DMARC via the link below. If DMARC is not enabled on your domain, it should be!
