iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
The United Kingdom’s National Cyber Security Centre (NCSC) has announced a new email security check service to help organisations identify vulnerabilities that could allow attackers to spoof emails or lead to email privacy breaches.
The new email security tool has been launched in the UK to help organisations check their defences, according to a report by Bleeping Computer.
As a government agency, NCSC leads the UK’s cyber security mission. It states the Email Security Check tool requires no sign-ups or personal details, with the free email security check service, organisations can identify vulnerabilities.
This service was developed and is now provided online for free as a direct response to some UK sectors having a superficial adoption of recommended email security controls (as low as just 7 per cent in some cases), as highlighted in NCSC’s guidance on email security and anti-spoofing.
Using Email Security Check allows defenders to look up publicly available information about email domains and check for anti-spoofing and email privacy risks.
It works by checking publicly available internet DNS records to verify if anti-spoofing controls (notably the DMARC Policy) are correctly configured and the TLS configuration by initiating a server “handshake”.
“It checks that anti-spoofing standards, such as DMARC, are configured correctly to help organisations prevent cyber criminals from abusing their domain and sending out malicious emails pretending to be them,” according to the NCSC.
“It also looks up whether privacy protocols, such as TLS, are in place to ensure that emails are encrypted when in transit so they cannot be accessed and remain confidential between mail servers.”
While the Email Security Check service will only be able to identify vulnerabilities that cyber criminals can discover, its goal is to help organisations identify them before they’re exploited, and the email domain targeted in attacks.
Eligible organisations can also gain access to more “in-depth guidance” on securing their email by signing up for the NCSC’s free Mail Check service.
However, Mail Check is not currently available for the private sector, but only to organisations from central government, local authorities, devolved administrations, emergency services, NHS organisations, academia and charities.
According to Paul Maddinson, NCSC director for national resilience and strategy, the new Email Security Check tool is designed to help users identify where they can do more to prevent spoofing and protect privacy and offers practical advice on how to stay secure.
“By following the recommended actions, organisations can help bolster their defences, demonstrate they [have] taken security seriously, and make life harder for cyber criminals,” Maddinson said.
Although the tool can check the security of email domains, it cannot check if individual emails or email domains are malicious.
[Related: Pro-Ukrainian hackers target Russia following invasion]
Be the first to hear the latest developments in the cyber industry.
