DMARC deadline looms for federal agencies
Connecting state and local government leaders
Email authentication can help secure any organization, but the risks of doing it wrong are real -- and federal systems must be compliant by Oct. 16.
When it comes to cyber intrusions, email is the by far the biggest attack vector. One recent study found that phishing accounts for more than 90 percent of all successful attacks worldwide. So last October when the Department of Homeland Security issued Binding Operational Directive 18-01 to enhance email and web security, authenticating the domains federal email was sent from became a central focus.
Agencies were required to begin implementing the Domain Message Authentication Reporting and Conformance (DMARC) protocol in January 2018, and by Oct. 16 are expected to be blocking all unauthorized use of agency domains for sending email. Getting to full compliance is complicated, however -- and the risks of doing it wrong are significant.
To understand why, it helps to understand that email protocols -- like the internet itself -- were not originally designed with security in mind. "Email is not authenticated in and of itself," Valimail CEO and Co-founder Alexander García-Tobar said. With the right information in a message header, "anyone can send an email as anyone."
Garcia-Tobar, whose firm provides FedRAMP-approved DMARC services, spoke at FCW's Aug. 9 Cybersecurity Summit and explained how DMARC adds that missing authentication. First, by putting a DMARC record into the Domain Name System (DNS) for each agency domain -- a simple cut-and-paste effort, he said -- agencies can get notifications for every service or IP address that is sending out messages using that domain.
That list of senders produced by this "discovery phase" can be surprisingly long, Garcia-Tobar said. "We just had an agency [where] jaws just dropped when they were shown that there were 38 services -- legitimate ones -- that were sending as that agency’s domain," he said. "They had no idea."
Former Agriculture Department CIO Jonathan Alboum, who spoke on the same panel, said that sprawl of third-party email senders is a natural result of government's embrace of digital services.
It would be foolish to have every citizen-service message go out via an agency's core internal email system, said Alboum, who is now Veritas Technologies' CTO for public sector, but "over time we’ve added a lot of complexity to our environments. … [And] if you don’t understand the foundation landscape that you’re coming from, it’s really hard to move."
The second phase, Garcia-Tobar said, is enforcement and protection. An organization creates and publishes a whitelist of approved senders for each domain -- which effectively tells email servers around the world to trash messages from senders not on that list. This is the step BOD 18-01 requires for all agency domains by Oct. 16.
While discovery-phase compliance -- agencies were supposed begin gathering data for each domain back in January -- is still far from universal, Garcia-Tobar said the federal government's progress has been impressive. Less than 30 percent of .gov agencies had a DMARC record a year ago, he said. "Now it’s more than 70 percent. That is faster than any vertical sector we’ve seen … on the commercial side."
Actual enforcement, however, lags far behind. Among the top 30 federal agencies, he said, "if you look at their primary email-sending domain, less than 20 percent of those are protected at this point."
That lag is of little surprise, Alboum said. BOD 18-01's requirements did not come with supplemental funding, he noted, and "the enforcement phase is where the money is. It’s not cut-and-paste; it’s a lot of work."
There is also the fear factor, Alboum added. While stopping illicit use of an agency's domain has obvious appeal, accidentally disrupting mission-critical messages because they use a service that got left off the whitelist gives many IT shops pause. "Someone’s going to think that they’ve implemented DMARC successfully, and then it’s going to turn out that a program’s emails didn’t get out … and there are going to be a lot of surprised and disappointed people," he said.
That argues for using an automated service, Alboum said, for both the discovery and the enforcement aspects of DMARC.
"I don’t know that it’s terribly complicated," he said of the data-gathering and whitelist configuration. "But it’s a lot of stuff. "And the more stuff you’re doing, the more risk there is. There’s a lot of opportunities … to make mistakes."