Proofpoint released new research which found that the top universities in the United States, the United Kingdom, and Australia are lagging on basic cybersecurity measures, subjecting students, staff and stakeholders to higher risks of email-based impersonation attacks. The research found that 97% of the top ten universities across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud. According to the analysis, universities in the United States are most at risk with the poorest levels of protection, followed by the United Kingdom, then Australia. These findings are based on Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of the top ten universities in each country. DMARC is an email validation protocol designed to protect domain names from being misused by cybercriminals. It authenticates the sender’s identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine and reject, with reject being the most secure for preventing suspicious emails from reaching the inbox. The full findings of Proofpoint’s DMARC analysis show:
- None of the top U.S. and U.K. universities had a Reject policy in place, which actively blocks fraudulent emails from reaching their intended targets, meaning all are leaving students open to email fraud.
- Five of the top ten U.S. universities do not publish any level of DMARC record.
- 65% of the top U.S. and U.K. universities had a base level of DMARC protection (Monitor and Quarantine) in place.
- 17 (57%) of all surveyed universities implemented a Monitor policy, while only four (13%) of the 30 universities implemented a Quarantine policy.
“Higher education institutions hold masses of sensitive personal and financial data, perhaps more so than any industry outside healthcare. This, unfortunately, makes these institutions a highly attractive target for cyber criminals. The pandemic and rapid shift to remote learning has further heightened the cybersecurity challenges for tertiary education institutions and opened them up to significant risks from malicious email-based cyber-attacks, such as phishing,” said Ryan Kalember, EVP, Cybersecurity Strategy at Proofpoint.
Analyst Notes
Implementing email security controls such as DMARC can help prevent against email fraud and Business Email Compromise (BEC), which is a form of social engineering used to lure victims into providing sensitive information. It is also recommended to provide user training on how to spot phishing emails, as well as implementing Multi-Factor Authentication (MFA) on email accounts.
Source: https://www.helpnetsecurity.com/2022/08/04/universities-email-based-impersonation-attacks/?web_view=true
