Putting it all Together

8 Putting it all Together

This paper therefore proposes a range of techniques, each supporting the other and designed to address specific weaknesses in any one technique used alone. So in summary:

  1. Implement technical counter-spam controls on your domains:
    1. SFP; see 4.1 Sender Policy Framework – SPF [RFC 7208]
    2. SIDF; see 4.2 Sender ID Framework – SIDF [RFC 4406 (4405, 4407 & 4408)]
    3. DKIM; see 4.3 Domain Key Identified Mail – DKIM [RFC 6376]
    4. ADSP; see 4.4 Author Domain Signing Practices – ADSP [RFC 5617]
    5. DMARC; see 4.5 Domain-based Message Authentication, Reporting and Conformance – DMARC
  2. Register and ‘park’ domain names that might be used to fraudulently represent your organisation. See 4.6 Domain Registration & Parking
  3. Introduce monitoring and intelligence feeds:
    1. Customer feedback; see 5.1 Customer Feedback
    2. DMARC reporting; see 5.2 Tracking Real-World Traffic and 4.5 Domain-based Message Authentication, Reporting and Conformance – DMARC
    3. An Email monitoring service; see 5.2 Tracking Real-World Traffic
  4. Introduce a take-down service; see 5.3 Take-Down Services
  5. Track the registration of ‘dubious domains’; see 5.4 Tracking Malicious Domain Registration
  6. Introduce organisation controls and policies
    1. Don’t permit unrestricted sign-up of Email services even if well-intentioned; see 6.2 Control Where Email Quoting Your Domain Name is Sent From
  7. Consider future options of securing message hyperlinks; see 7.1 Protecting Against Fraudulent Email From Domains You Do not Control

8.1 Introduce, Monitor and Adapt

And finally, never lose sight of the need to constantly monitor the scale and evolving techniques of fraudulent Email being used against your organisation. You not only need to consider introducing the various control mechanisms we outline in this paper, but will need to continue to monitor and adapt your controls as almost inevitably, the fraudsters will look to adapt their techniques to overcome each control you have put in place. This is in part why we propose a blended set of controls designed to tackle different aspects of fraudulent Email control and significantly raise the difficulty fraudsters will encounter in attempting to subvert your brand and defraud your customers. We wish you every good fortune in your clamp-down on fraudulent Email targeting your customers and organisation.

Continue reading ‘About the Authors & this White Paper’ »