Cybersecurity vendors lag badly on DMARC email security, survey shows

Only 1 in 4 of the cybersecurity companies exhibiting at the celebrated Black Hat conference this week have implemented a set of best practices to prevent email spoofing and phishing.

Only 1 in 4 of the cybersecurity companies exhibiting at the celebrated Black Hat conference this week have implemented a set of best practices to prevent email spoofing and phishing, according to figures from the nonprofit Global Cyber Alliance.

In a release Wednesday, GCA said that 73 percent of the 268 exhibitors had not deployed Domain-based Message Authentication, Reporting and Conformance, or DMARC — a set of email protocols that prevents spammers, phishers and other cybercriminals from using an organization’s name and email domain to conduct hacking attacks.

Of the 72 exhibitors using DMARC, only six — just 2 percent — have fully deployed it so that it stops spoofed email from being delivered. Lower level implementations of DMARC warn an organization that their email domain is being spoofed — and can help spoofed mail get blocked by spam filters — but don’t prevent it from being delivered.

“A lot of [security vendors] clearly are not eating their own dog food,” Global Cyber Alliance CTO Andre Ludwig told CyberScoop, referencing an old IT industry saying about the value of a company using its own products.

This is a problem because of the “herd immunity” aspects of DMARC — spoofed email is only blocked if both and receiver have it implemented. Most major free email providers use DMARC, so 85 percent of consumer email inboxes in the U.S. and more than 2.5 billion email inboxes worldwide have it running.

The implementation is visible to those outside the organization and a selection of scanning tools are available to check if a domain has the protocol deployed.

Nonetheless, Ludwig said, GCA had decided not to name names.

“The cyber industry should lead in deployment of solutions. We need to do more than talk the talk; we have to walk the walk,” added CEO Philip Reitinger. “DMARC works.  It reinforces trusted relationships with partners, customers and employees. Collectively, we must focus on implementing solutions. If we lead the way, we know others will follow.”

A recent study showed that organizations which employ DMARC get just 23 percent of the email threats that those who don’t use it get. Nonetheless, adoption rates among enterprises and government agencies remain low.

Last week, Sen. Ron Wyden, D-Ore., implored the Department of Homeland Security to mandate the government-wide use of DMARC “to ensure that hackers cannot send emails that impersonate federal agencies.”  Last year, the British government directed all its agencies to deploy DMARC.

Black Hat exhibitors are not alone. Only 15 percent of the 587 email domains GCA checked for companies exhibiting at February’s RSA Conference — one of the world’s largest gatherings of cybersecurity experts — use DMARC. Of the 111 RSA exhibiting organizations that do use DMARC, more than 70 percent use the lowest level implementation, which only monitors for malicious email, but doesn’t stop it.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure