DHS to scan agencies for use of spoof email protections
The Department of Homeland Security has started collecting data about agencies’ use of Domain-based Message Authentication, Reporting and Conformance — an industry-standard cybersecurity measure that blocks forged emails.
CyberScoop’s Shaun Waterman reports that, in a letter to Sen. Ron Wyden, D-Ore., DHS official Christopher Krebs says the department “is actively assessing the state of email security and authentication technologies … across the federal government,” to include DMARC.
The collection is seen as a first step to encouraging wider adoption within the U.S. government, according to official correspondence.
DMARC is the industry standard measure to prevent hackers from spoofing emails — making their messages appear as if they’re sent by someone else. Spoofing is the basis of phishing, a major form of both crime and espionage, in which an email appearing to a come from a trusted third party directs readers to a website where login and password credentials can be stolen.
Krebs says DHS’s 24-hour cyber watch center, the National Cybersecurity and Communications Integration Center (NCCIC), “will soon be scanning federal agencies as part of its cyber hygiene service to incentivize the adoption of these technologies.” NCCIC already recommends the use of email authentication techniques like DMARC, Krebs says. “As we gain a better understanding of existing practices across the federal … government, DHS will consider additional options for promoting its implementation.”
