DMARC Adoption Amongst US Education Sector
DMARC works by allowing organizations to define how their email domains should be authenticated and to receive reports on how their emails are being handled by other mail servers — protecting them against unauthorized email spoofing, phishing attempts, and cybercriminals seeking to impersonate their domain.
However, despite its effectiveness, DMARC adoption in the US education sector is lagging behind other sectors, such as retail and technology. This lag in adoption leaves educational institutions vulnerable to a range of email-based threats, making it crucial for them to recognize the importance of DMARC implementation and enhance their email security measures.
Low DMARC Adoption Rates in Education
The adoption of DMARC within the US education sector remains alarmingly low, leaving many institutions exposed to email-based attacks such as phishing, ransomware, and business email compromise (BEC). This blog delves into the reasons behind the low adoption rate of DMARC, the various types of email attacks plaguing the education sector, and the promising trends in DMARC adoption.
A Campus Technology report revealed a startling statistic: only 152 out of the US’ 1,930 .edu domains and 3.3% of worldwide .edu domains have implemented a “reject” DMARC policy, which is the highest level of email security. This low adoption rate is particularly concerning because educational institutions are attractive targets for phishing attacks.
Challenges in DMARC Adoption
Several factors contribute to the low DMARC adoption rate within the US education sector. First, many educational institutions remain unaware of DMARC and its security benefits. This lack of awareness hinders their ability to take proactive measures to protect their email systems.
Second, implementing DMARC can be a complex process, demanding continuous management, which can strain IT departments already juggling multiple responsibilities. Educational institutions should make email security a top priority and dedicate resources to educating their staff, ensuring the successful DMARC implementation. In this regard, DMARC solution providers, like DMARCReport, can serve as invaluable assets to enhance their email security measures.
Types of Attacks Targeting Educational Institutions
Educational institutions face a range of significant cyber threats: most significantly, ransomware, the risks associated with Business Email Compromise (BEC) attacks, and the disruptive impact of Distributed Denial of Service (DDoS) attacks.
Ransomware:
In a typical ransomware attack on higher education institutions, hackers often target these establishments because they store a vast amount of valuable data. This data includes confidential student records, sensitive research findings, and other critical systems that are essential for the institution’s operations.
A report published by The Statesman revealed that nearly half of educational institutions worldwide were targeted by ransomware attacks in 2020. Of those attacks, 58% resulted in cybercriminals encrypting the institutions’ data, causing significant disruptions and financial losses.
Business Email Compromise (BEC) Attacks:
Threat actors often employ BEC tactics to target educational organizations: 28% of spear-phishing attacks on educational institutions were aimed at conducting business email compromise scams.
Image sourced from kmtech.com
BEC attacks have the potential to cause severe consequences, including data breaches, where sensitive information is exposed, and financial fraud, which can result in substantial monetary losses. The combination of sophisticated social engineering and deceptive tactics makes BEC a significant threat in the realm of email-based attacks against educational organizations.
DDoS Attacks:
Distributed Denial of Service (DDoS) attacks pose a significant threat to the digital infrastructure of educational institutions. In a recent incident during the Ukraine-Russia war, cyber attackers targeted Ukrainian educational institutions with over 100,000 DDoS attacks on 30 websites hosted by WordPress within 24 hours, disrupting online operations and services.
Rising DMARC Adoption
While the low DMARC adoption rates are concerning, there is some positive news. In recent years, there has been a noticeable increase in DMARC adoption across the education sector. A report from 2018 highlighted that nearly 90% of top US higher education institutions failed to protect their students and faculty from phishing attacks.
In comparison, 58% of the country’s .edu domains having adopted the DMARC standard in 2023 is definitely a promising start. However, effectively implementing DMARC security policies to flag, report, and remove outbound phishing emails remains an ongoing effort, reflecting a step in the right direction for improved email security within the education sector.
Only 7.8% of institutions have implemented DMARC to automatically “reject” emails impersonating their domain. This leaves users vulnerable to phishing emails and creates a substantial risk of ransomware attacks, fraud, and data breaches.
With the education and research sector seeing a 44% increase in cyberattacks globally in the first six months of 2022 and email-delivered attacks comprising 89% of all “in the wild” cyberattacks during that period, it’s imperative for educational institutions to fortify their email security infrastructure and practices to safeguard sensitive data and ensure uninterrupted operations.
Conclusion
In conclusion, strengthening email security in the US education sector is an urgent need. The low DMARC adoption rates are a cause for concern, considering the sector’s vulnerability to various email-based attacks.
To address this issue, educational institutions must prioritize DMARC adoption, increase awareness of its benefits, and allocate the necessary resources to enhance their email security. The recent increase in DMARC adoption is a promising sign, but there is still much work to be done to protect sensitive data and prevent disruptive attacks in the education sector.
