Lanworks

Network solutions, Cybersecurity, virtualization to lifecycle support and end point management.

Eric Rydzkowski

Why Every Organization Should Implement DMARC

By

What is DMARC?

DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol.

What does DMARC actually do?

DMARC is a protocol that protects your organization from emails sent by fraudulent imposters. The most simplistic analogy is you can very easily send a nasty post mail to Prime Minister Trudeau but put your next door neighbor’s full name and return address on the envelope making the letter completely appear as if it was sent by your innocent neighbor. The exact same applies to email and DMARC is a method to prevent this from happening.

Why would you need it?

Lanworks has several customers in which their internal email address books have been compromised and used by fraudulent imposters to send phishing emails to their own customers. You can imagine the embarrassment and damage control required to convince your best customer that the well-crafted phishing email they just received with your president’s name in the “From” field is in fact fraudulent. This is reality and it happens all the time.   

How Does DMARC prevent this?

Now this is the complicated part of this Blog.

DMARC builds on the widely deployed SPF and DKIM protocols, adding ties to the author’s (“From:”) domain name. The SPF and DKIM fields are typically set in your DNS records  

SPF: allows senders to define which IP addresses are allowed to send mail for a particular domain.

DKIM: provides an encryption key and digital signature that verifies that an email message was not faked or altered.

DMARC: unifies the SPF and DKIM authentication mechanisms into a common framework and allows domain owners to declare how they would like email from that domain to be handled if it fails an authorization test.

The options for a failed email authorization are:

None: treat the mail the same as it would be without any DMARC validation

Quarantine: accept the mail but place it somewhere other than the recipient’s inbox (typically the spam folder)

Reject: reject the message outright and discard it

What Does a Simplistic DMARC enabled Email Flow Look Like?

Summary

DMARC is a very important and effect mechanism to prevent fraudulent or spoofed email and every company should implement it. That being said, DMARC is not that straight forward to correctly setup. Lanworks has the experience to properly deploy DMARC/SFP/DKIM and our professional team would be glad to provide the required consulting to perform the work.

A Glimpse into the Future of Network Security

By

NetworkSecurity

This past week I was at the Juniper Partner Conference in Miami, where I sat through a number of talks and seminars. One of the sessions was about network security, and while taking notes, I tried to imagine what the future of network security should look like. So many organizations have routers, firewalls, anti-malware devices, IPS, wireless, network and endpoints – all from a variety of manufacturers. The key piece to note is they don’t really talk to each other to “share” what they are seeing on the network.

From the sessions I attended, I learned that large Fortune 100 companies spend upwards of 45% of their annual IT budgets on the operational maintenance, subscriptions, care and feeding of these elements in their networks. In many cases, logs or alerts from these devices are not proactively monitored or they go un-actioned in many organizations (e.g. Target security breach in Nov. 2013), which effectively makes them useless. A three-year study by Verizon Enterprise Solutions found that companies discover breaches through their own monitoring in only 31 percent of cases. For retailers, it’s 5 percent.

In the future, various elements of a network have to talk to each other.

There needs to be a “Security Back channel” that firewalls, IPS, malware, anti-spam, load balancers, routers, wireless controllers, switches and end points all use to talk to each other using a standard protocol that is vendor agnostic.

Let me provide an example. If a connection request to Amazon.ca is coming from Vietnam, the router (using reverse Geo IP lookup) is the first to see it and should raise a yellow flag on the security back channel. Now the firewall looks at it already knowing this is a suspect connection since 95% of requests come from a Canadian IP address. This may in itself trigger the Vietnamese connection to go through a more rigorous inspection (kind of like going through a pat-down at the airport with a sniffer dog giving you a once over at the end).

If the connection passes the “sniff test” the load balancer gets the packet already knowing it is flagged as high risk. Again, the load balancer breaks apart the packet and ensures the payload is constructed exactly as anticipated for Amazon’s specific type of Web front end application.

If at any time, any of the network elements along the kill chain determines the connection from Vietnam is malicious in nature, it notifies all other network elements to kill the connection. Simply sending a notice to a SIEM (Security Information and Event Monitor) console and waiting for a human to interpret and act on it is not an option (ask Target). The network elements all have to talk to one another and share their inspection information so the network can act and respond as a single element.

The example above stops at the Amazon Web server, but network switches and even endpoint devices must have the intelligence to be part of the kill chain that detects, notifies and reacts to malicious connections. Switches must be able to monitor and record “normal” behaviour for each node connected to them. Should a switch detect a ping sweep or other non-characteristic behavior from a particular node, it should be able to shut it down and notify all other network elements to beware of this node.

As I see it, the only way corporations will be able to keep ahead of the ever-improving security threats is if all network elements work together and “behave” as a single element when it comes to security. Unfortunately this cooperation among vendors does not exist today but hopefully one or more of the larger players will start the development of such an initiative, the security of our information relies on it.

MENU
CONTACT US