Proofpoint’s Australian and New Zealand country manager Crispin Kerr said a large number of ASX 100 companies are “unknowingly exposing themselves to cyber criminals aiming to capitalise on intricate supply chains and potentially trick critical stakeholders with fraudulent emails”.
He noted that Australia’s companies rely on an ever-expanding ecosystem to conduct business with integral stakeholders, including suppliers, vendors, employees, customers and partners.
“And in order to be successful, these relationships are based on an inherent trust in email communications,” he continued.
Proofpoint undertook an examination of the ASX 100 that found 42 per cent of these organisations have not published a domain-based message authentication, reporting and conformance (DMARC) record, “making them susceptible to cyber criminals spoofing their identity and increasing the risk of email fraud targeting users”.
A DMARC is an email validation protocol that is designed to protect domain names from being misused by authenticating the sender’s identity before the message is allowed to reach a designation.
Additionally, only 14 per cent of ASX 100 organisations have implemented recommended deployments to block malicious emails from reaching intended targets.
“In other words, 86 per cent of Australia’s largest companies aren’t leveraging established best practices for email security,” Mr Kerr said.
“Today’s Australian business climate requires constant email communication with a multitude of manufacturers, suppliers, resellers, employees and customers.”
And with 90 percent of cyber attacks coming through email, the manager said “securing this vector has never been more important”.
“What happens when a cyber criminal impersonates a trusted vendor asking that payment is wired to a new account? Or a customer receives a fraudulent notification that they need to reset their password?” he queried.
He flagged that global impostor email attempts have increased more than 400 per cent year-on-year.
“While these are generally highly targeted attacks that are sent to specific people within organisations – those that have the authority to execute wire transfers or send sensitive information – companies were targeted 120 per cent more frequently in quarter one of 2019 versus the same quarter in 2018.”
It comes after a lawyer’s warning to nestegg readers just how easily hackers can drain the life savings of retirees online.
