An ever-evolving and rampant form of cybercrime that targets emails as the potential medium to conduct fraud is known as Business Email Compromise. Targeting commercial, government as well as non-profit organizations, BEC attack can lead to huge amounts of data loss, security breach and compromise of financial assets. It is a common misconception that cybercriminals usually lay their focus on MNCs and enterprise-level organizations. SMEs these days are just as much a target to email fraud, as the larger industry players.

How Can BEC Affect Organizations?

Examples of BEC attack include sophisticated social engineering attacks like phishing, CEO fraud, fake invoices, and email spoofing, to name a few. It can also be termed as an impersonation attack wherein an attacker aims to defraud a company, by posing to be people in authoritarian positions. Impersonating people like the CFO or CEO, a business partner or anyone you will blindly place your trust on, is what drives the success of these attacks.

February of 2021 captured the activities of the Russian cyber gang Cosmic Lynx, as they took a sophisticated approach towards BEC. The group had already been linked to conducting over 200 BEC campaigns since July 2019, targeting over 46 countries worldwide, focusing on giant MNCs that have a global presence. With extremely well-written phishing emails, they are making it impossible for people to differentiate between real and fake messages.

Remote-working has made video conferencing applications indispensable entities, post-pandemic. Cybercriminals are taking advantage of this situation by sending fraudulent emails that impersonate a notification from the video conferencing platform, Zoom. This is aimed at stealing login credentials to conduct massive company data breaches.

It is clear that the relevance of BEC is rapidly surfacing and increasing in recent times, with threat actors coming up with more sophisticated and innovative ways to get away with fraud. BEC attack affects more than 70% organizations worldwide and leads to the loss of billions of dollars every year. This is why industry experts are coming up with email authentication protocols like DMARC, to offer a high level of protection against impersonation.

What is Email Authentication?

Email authentication can be referred to as a bevy of techniques deployed to provide verifiable information about the origin of emails. This is done by authenticating the domain ownership of the mail transfer agent(s) involved in the message transfer.

Simple Mail Transfer Protocol (SMTP), which is the industry standard for email transfer has no such in-built feature for message authentication. This is why exploiting the lack of security becomes exceedingly easy for cybercriminals to launch email phishing and domain spoofing attacks. This highlights the need for effective email authentication protocols like DMARC, which actually delivers its claims!

Steps to Prevent BEC Attack with DMARC

Step 1: Implementation

The first step to fighting BEC attack is actually configuring DMARC for your domain. Domain-based Message Authentication, Reporting and Conformance (DMARC) makes use of SPF and DKIM authentication standards to validate emails sent from your domain. It specifies to receiving servers how to respond to emails that fail either/both of these authentication checks, giving the domain owner control over the receiver’s response. Hence for Implementing DMARC, you would need to:

Identify all valid email sources authorized for your domain
Publish SPF record in your DNS to configure SPF for your domain
Publish DKIM record in your DNS to configure DKIM for your domain
Publish DMARC record in your DNS to configure DMARC for your domain

In order to avoid complexities, you can use PowerDMARC’s free tools ( free SPF record generator, free DKIM record generator, free DMARC record generator) to generate records with the correct syntax, instantly, to publish in your domain’s DNS.

Step 2: Enforcement

Your DMARC policy can be set to:

p=none (DMARC at monitoring only; messages failing authentication would still be delivered)
p=quarantine (DMARC at enforcement; messages failing authentication would be quarantined)
p=reject (DMARC at maximum enforcement; messages failing authentication would not be delivered at all)

We would recommend you to start using DMARC with a policy enabling monitoring only, so that you can keep a tab on the email flow and delivery issues. However, such a policy wouldn’t provide any protection against BEC. This is why you would eventually need to shift to DMARC enforcement. PowerDMARC helps you seamlessly shift from monitoring to enforcement in no time with a policy of p=reject which will help specify to receiving servers that an email sent from a malicious source using your domain would not be delivered to your recipient’s inbox at all.

Step 3: Monitoring and Reporting

You have set your DMARC policy at enforcement and have successfully minimized BEC attack, but is that enough? The answer is no. You still need an extensive and effective reporting mechanism to monitor email flow and respond to any delivery issues. PowerDMARC’s multi-tenant SaaS platform helps you:

stay in control of your domain
visually monitor authentication results for every email, user and domain registered for you
take down abusive IP addresses that try impersonating your brand

DMARC reports are available on the PowerDMARC dashboard in two major formats:

DMARC aggregate reports (available in 7 different views)
DMARC forensic reports (with encryption for enhanced privacy)

A culmination of DMARC implementation, enforcement and reporting helps you drastically reduce the chances of falling prey to BEC attack and impersonation.

With Anti-Spam Filters Do I Still Need DMARC?

Yes! DMARC works very differently from your ordinary anti-spam filters and email security gateways. While these solutions usually come integrated with your cloud-based email exchanger services, they can only offer protection against inbound phishing attempts. Messages sent from your domain, still remain under the threat of impersonation. This is where DMARC steps in.

Additional Tips for Enhanced Email Security

Always Stay under the 10 DNS Lookup Limit

Exceeding the SPF 10 lookup limit can completely invalidate your SPF record and cause even legitimate emails to fail authentication. In such cases, if you have your DMARC set to reject, authentic emails will fail to get delivered. PowerSPF is your automatic and dynamic SPF record flattener that mitigates SPF permerror by helping you stay under the SPF hard limit. It auto-updates netblocks and scans for changes made by your email service providers to their IP addresses constantly, without any intervention from your side.

Ensure TLS Encryption of Emails in Transit

While DMARC can protect you from social engineering attacks and BEC, you still need to gear up against pervasive monitoring attacks like Man-in-the-middle (MITM). This can be done by ensuring that a connection secured over TLS is negotiated between SMTP servers every time an email is sent to your domain. PowerDMARC’s hosted MTA-STS makes TLS encryption mandatory in SMTP and comes with an easy implementation procedure.

Get Reports on Issues in Email Delivery

You can also enable SMTP TLS reporting to get diagnostic reports on email delivery issues after configuring MTA-STS for your domain. TLS-RPT helps you gain visibility into your email ecosystem, and better respond to issues in negotiating a secured connection leading to delivery failures. TLS reports are available in two views (aggregate reports per result and per sending source) on the PowerDMARC dashboard.

Amplify Your Brand Recall with BIMI

With BIMI (Brand Indicators for Message Identification) you can take your brand recall to a whole new level by helping your recipients visually identify you in their inboxes. BIMI works by attaching your unique brand logo to every email you send out from your domain. PowerDMARC makes BIMI implementation easy with just 3 simple steps on the user’s part.

PowerDMARC is your one-stop destination for an array of email authentication protocols including DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT. Sign up today to get your free DMARC Analyzer trial!

About
Latest Posts

Ahona Rudra

Domain & Email Security Expert at PowerDMARC

Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.

How To Fight Business Email Compromise (BEC) with Email Authentication?