Phishing and The New Age of Email Security and Trust

We usually hear the term ‘phishing’ but don't fully comprehend its implications. This word refers to a larger category that includes a variety of targeted email attacks. Cybercriminals emphasize simple, low-cost assaults with a high likelihood of entangling victims. The economics must make sense, whether it's phishing (low cost, wide net) or spear-phishing (higher cost, high-value target). Phishing through email throws up a whole new can of worms in cyberspace.

Phishing and its types
When massive phishing assaults impair networks, energy systems, or other infrastructure, most Americans become aware of them. But it's not the ‘Big One’ that's the problem; it's the billions of phishing emails sent every day, which account for more than 90% of all attacks.

The most common type of phishing is fraudulent phishing, which tosses and draws victims into a vast web. Although most throws do not yield lucrative fish, a net this large will almost certainly capture a few good ones. It frequently looks to come from respectable senders and steals information by impersonating a real company or brand. Cybercriminals utilize phishing emails to acquire personal information and credentials, and they employ a variety of deception techniques:

To fool Exchange Online Protection, harmful and non-malicious code is mixed together (EOP).
Integrate legal links to prevent email filters from detecting them (and sending them to spam folders).
Taking and altering the logos of other companies or organizations.
Sending emails with only a few lines of text.
After an email arrives in a user's inbox, using abbreviated URLs to fool Secure Email Gateways (SEGs) or logic bombs and time bombs to redirect users to phishing landing pages.

Spearfishing takes a more personal approach (think handmade decoy), in which fraudsters personalize phishing emails using recipients' personal information to make them believe they are connected to the sender. This method also deceives people into opening malicious attachments or visiting URLs that gather personal information. Spear phishing assaults utilize a variety of techniques, including:

Attempting to compromise API or session tokens to get access to business resources like SharePoint sites and employee email accounts.
Using social media to investigate organizational structures in order to identify potential targets for assaults.
Detecting (and replicating) internal email formats by sending bulk emails to gather out-of-office responses.

Another phishing technique that has devastating effects if successful is whaling. It involves Business Email Compromise (BEC), in which attackers fake CEO or high-level executive sender information and domains to conduct fraud. Whaling attacks are similar to spear-phishing assaults in that they employ the same strategies. Hackers, on the other hand, utilize a hacked executive's account to obtain access to a corporation for financial benefit.

The lying trails
A close examination of these recent phishing efforts will reveal a pattern: the sender is not who or what they claim to be. In fact, 89% of all current phishing assaults have one thing in common: the sender's identity. When the assault is predicated on the sender and targeted for impersonation, it is far more difficult to filter/detect the false emails—and much more likely to capture the victim. Hackers take advantage of the fact that email is not verified by default, which is a little-known fact. Anyone may compose an email as someone else if there is no email authentication.

DMARC and phishing
Every day, cybercriminals send approximately three billion fake emails. A phishing or spoofing assault occurs in one out of every 100 emails. These attacks are protected by DMARC (Domain-based Message Authentication, Reporting, and Conformance) enforcement.

Unfortunately, only a few individuals outside of the email geeks’ circles are aware of it. In the email community, this open standard, DMARC, has a lot of support. In the larger security and brand protection industries, it has just lately gained increased recognition and acceptance as a compliance/best practice. Adoption can also be influenced by awareness and compliance. All federal agencies were instructed to implement DMARC, resulting in 92% of government email DMARC records being put in place and enforced. Only 22% of leading retailers, 30% of Fortune 500 domains, and 36% of significant banks, on the other hand, have complete DMARC enforcement. But that's changing fast: DMARC will be adopted by 70,000 businesses within this year alone.

DMARC is a tried-and-true form of email authentication that, when combined with typical email security measures, provides significant protection against a common email phishing attack vector: the sender's identity. Only approved senders can use the domain in the ‘From’ field of their email messages since DMARC is properly applied in enforcement. DMARC operates in the background, and most users are oblivious to its presence—which is exactly how it should be.

DMARC protects companies from misuse, prevents consumers and partners from getting false emails, and offers the control and freedom needed to validate data protection laws like GDPR and CCPA.

In the end, leaving our major communication tool (email) vulnerable to phishing is no longer an option. DMARC gives all organizations a mechanism to eliminate phishing, one of the most common forms of email fraud, leading us into a new era in which we can trust our emails once more.