Proofpoint: One month out from deadline, half of agency domains are DMARC compliant

Proofpoint predicts that no more than 70 percent will have full DMARC implementation by the Oct. 16 deadline.

With a month left on a deadline for federal government domains to implement a key email security policy, cybersecurity company Proofpoint says agencies have made significant progress, but is doubtful that each one will actually make it in time.

The Department of Homeland Security issued a binding operational directive (BOD) last year ordering all agencies to have the highest level of DMARC (Domain-based Message Authentication, Reporting and Conformance) within a year. DMARC protects domains from being spoofed via email.

Without it, malicious actors can send messages that appear to be, for example, a .gov website.

As part of the directive, agencies are required to have a DMARC policy of “reject” — the highest of three levels — by Oct. 16.

In a report published Monday, Proofpoint notes 51.9 percent of agency domains are compliant at this point. However, that’s roughly the same assessment Agari, an email security company, put out in July. Proofpoint compares the figure to 20 percent one year ago.

While more than half of the total number of agency domains are in the green, Proofpoint says 25 percent of the 133 agencies subject to the directive are fully compliant with all of their domains. The rest of the agencies are a mixed bag.

“Our data shows that agencies have made commendable progress on their journeys to compliance … and that these projects were not part of their existing budgets,” Proofpoint assessed.

According to Proofpoint, 26 percent of agencies have not yet begun deploying DMARC. A number of agencies have been using in-house resources to carry out their deployment, at 55 percent, while another 19 percent have called in third-party assistance.

Proofpoint notes that DMARC implementation is difficult and that DHS’s timeframe for the directive is tight — the BOD was issued in October 2017. With that in mind, the company predicts that no more than 70 percent of domains will be able to meet the deadline.

Apart from the yearlong project of having DMARC at the highest level, the directive asked agencies to at least implement DMARC on some level within 90 days. That deadline was on Jan. 15 and Proofpoint says 31.6 percent of domains are past due.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure