Securing your Email with Digital Trust
With phishing attacks now commonplace, corporate information security programs routinely train on how to avoid email compromise. However, the frequency of email attacks has dramatically accelerated over the last couple of years. In their most recent quarterly report, the
Anti-Phishing Working Group reported the highest level of phishing activity on record: four times the number of attacks since early 2020. Other organizations reported staggering increases in suspicious emails targeting remote workers at the start of the pandemic, taking advantage of changing work habits.
This changing landscape raises the question: how do you enable email recipients to be certain of sender identity and email content integrity? A well thought out digital trust strategy can inject this important layer of security into email communications, making it easy for email recipients to readily differentiate between trusted and suspicious communication.
3 steps on how to ensure email recipients' sender and content integrity?
Step 1: Establish trust
The foundation of trust in email security is the S/MIME digital certificate. S/MIME stands for Secure/Multipurpose Internet Mail Extension, an industry standard for email signature and encryption supported by most corporate email clients. S/MIME certificates enable users to digitally sign emails, verifying the authenticity of the sender and indicating that the email contents have not been altered. S/MIME digital certificates can also be used to encrypt emails, protecting email communication containing sensitive information from data interception.
Step 2: Manage Trust
The next step to consider is the management of S/MIME certificates within an organization. IT leaders note that when measures that improve security are optional or dependent on actions taken by a non-technical corporate user, adoption can be a challenge. Companies can solve this problem by automating the provisioning of digital certificates such as S/MIME. To accomplish this, companies can leverage PKI management solutions that integrate directly with corporate directory services to automate the installation, renewal and revocation of certificates. This reduces the burden on IT technical support, ensures adherence to preferred security measures or corporate policy, and eliminates any provisioning or revocation gaps that can impact productivity or security.
When S/MIME is used for encryption, there are additional measures needed that benefit from the automation and integration capabilities of PKI management solutions. For example, when using S/MIME for encryption, users need to hold the same private key in the multiple devices where they receive email to decrypt communications. Otherwise, they will be limited to reading email only on the desktop or device where the key is present. Additionally, end-users need to preserve key histories to retrieve email records should laptops or other hardware crash or be compromised. IT security teams managing the PKI infrastructure should support key escrow and recovery to support users who need to retrieve keys or to fulfill legal requests for email histories.
PKI management solutions that can integrate with Unified Endpoint Management (UEM) solutions such as Microsoft Endpoint Manager and automatically manage key escrow simplify these aspects of certificate lifecycle management.
Encryption may be required in industries where sensitive data is transmitted by email, such as financial services firms communicating personal financial data or healthcare companies communicating personal health information. It may also be required by corporate policy for specific types of internal or external communications to protect data confidentiality or intellectual property.
Best practices in S/MIME management suggest that when encryption is required, separate certificates be used for digital signatures and for encryption. This is because the key escrow requirements of encryption can compromise the non-repudiation characteristics of a digitally signed email. Companies can also decide whether their business needs require encryption at the individual user level or whether it is preferable to encrypt communications at the point of an email gateway.
Step 3: Extend trust
Digital trust architects can next consider whether they need to secure email within an organization or between organizations. If email communication is staying within the corporate domain, IT professionals can use private S/MIME certificates chaining up to a private CA or intermediate.
If companies are securing email sent outside of corporate boundaries, then public S/MIME certificates must be used that chain up to a publicly trusted root such as DigiCert. Companies can also consider setting up a public dedicated intermediate CA that can be branded with their organization name. The ICA can chain up to the publicly trusted root but will allow certificates to inherit the ICA branding of the organization.
DMARC & VMC
Image source from digicert.com
Companies can also adopt other measures to combat phishing within an organization, such as implementing Domain-based Message Authentication, Reporting & Conformance (DMARC). DMARC is an email authentication, policy and reporting protocol that helps prevent organizations against phishing.
Companies that have adopted DMARC can use Verified Mark Certificates (VMCs) to display a verified organization logo alongside emails. VMCs validate that a company has implemented DMARC and that the logo being displayed is a trademarked entity of the organization. Email messages with brand logos indicate that the sender has met the strong security and authentication requirements of DMARC and VMCs.
The presence of a brand logo increases consumer trust in the email being sent and differentiates it from emails sent without a brand logo indicator. Some email clients, such as Apple, are going one step further and including “digitally certified” in VMC-related email headers.
Over time, the widespread adoption of VMCs can be another vehicle for enabling email recipients to easily distinguish digitally certified emails from business email imposters.
DNS traffic monitoring
Finally, companies can look to their DNS service as another key component of their email trust initiatives. DNS traffic is a rich source of data that can be analyzed using machine learning to show what is and isn’t normal for a domain. Traffic anomaly detection can detect and predict suspicious or unusual activity, enabling IT professionals to thwart directed attacks.
Image source from freepik
With email attacks on the rise, corporate training programs may be insufficient by themselves to enable employees to adequately protect their organization’s confidential or sensitive data or their personal credentials. And with phishing strategies becoming more sophisticated, it can be increasingly difficult for consumers to know when they are interacting with a trusted brand or an email imposter. Implementing a strong foundation of digital trust in email communication can help prevent credentials, sensitive data, or financial compromise. That is where digital trust meets the real world.
About WebNIC
WebNIC operates a digital reseller platform covering primarily domain name registration for over 700 TLDs, web security services, email and cloud services. With offices in Singapore, Kuala Lumpur, Beijing, Taipei and Jakarta, we serve 5,000 active resellers in over 70 countries. With over 20 years’ experience, we accelerate our partner’s growth through a robust platform, attentive support and wholesale pricing. To join us and become a reseller, live chat with us or email us at inquiry@info.webnic.cc.
(Source by: https://www.digicert.com/blog/securing-digital-trust-in-email-communications)