Deleting Email’s Original Sin: An Historical Perspective
Can DMARC do for email security what SSL certificates did for e-commerce?
For consumers and businesses alike, opening email has long been an exercise in trust. Do you know that the person or company whose name appears in the ‘From’ field really sent that message? Are you sure? As the CEO of an email authentication company, those are the questions that keep me (and my clients) up at night.
But it wasn’t always that way. For most of the past 40 years, we just took it on faith that the sender’s name and email address of the sender in our inbox are legitimate. That’s because when the wizards who first created the Internet initially set up email’s basic protocols, they balanced costs in computing power, implementation, and ease of use versus the risk of fraud. At the time, it was nearly inconceivable that 80 percent of all email would be malware, phish or spam. So they didn’t include any provisions for authenticating the sender of an email.
That’s led to a rash of phishing attacks aimed at getting employees or customers to click on malicious links, send W-2s and employee data to scammers, or wire funds into criminals’ accounts. Just ask John Podesta, Hillary Clinton’s campaign chairman, whose emails were allegedly compromised by Russian hackers, or the unsuspecting employees at Snapchat who gave away highly sensitive payroll data to scammers, or Medstar Health in Washington DC, where someone, in all likelihood, received an email asking them to click on what seemed to be an innocuous link or PDF attachment, but was actually a virus that brought the entire system to its knees.
These costly and dangerous attacks all reveal the deep vulnerabilities facing our national email and internet infrastructure today. The problem is pervasive — the FBI reports that just one scam, the BEC (Business to Email Compromise) is up 1,300% since last year, costing U.S. companies more than $3 billion dollars in losses.
DMARC: The Email Authentication Gold Standard
The good news is the situation is beginning to change for the better, thanks to a movement toward email authentication led by the major email service providers, including Google, Yahoo, AOL and Microsoft. These entities have recently converged around a set of open email authentication standards called DMARC