School cyber-attacks up 55% Year on Year.

[psydii]

Ransomware up 170%

 

https://www.bbc.co.uk/news/articles/c2vwz4exq4xo

[Dos_Box]

We have some webinars coming up (details Monday) and have Sophos giving a session on ransomware in education + AV best practice. It is a growth industry for cyber-criminals sadly. Edited May 10, 2024 by Dos_Box

[Michael]

Also, the best advice I can offer is to sign up to the NCSC and gives some useful advice, especially with email traffic. Here are the settings I use:

 

DMARC + DMARC Insights

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; sp=quarantine; aspf=r; adkim=r; pct=100; rua=mailto:[email protected]; ri=86400; rf=afrf

 

SPF

Type: TXT
Name: @
Value: v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

 

DKIM

 

Enable in O365

 

Type: CNAME
Name: selector1._domainkey
Value: selector1-school-sch-uk._domainkey.school.onmicrosoft.com

Type: CNAME
Name: selector2._domainkey
Value: selector2-school-sch-uk._domainkey.school.onmicrosoft.com

 

Wait 5/10 minutes, then return back and select Enabled.

 

TLS/TLS Certificates - Nothing further to action.

 

TLS-RPT

Type: TXT
Name: _smtp._tls
Value: v=TLSRPTv1;rua=mailto:[email protected]

 

MTA-STS

 

Head over to Github and create a free account, then click here scroll down and select Use this template

 

Name your Repository: yourschooldomain.sch.uk and select Create Repository

 

Select the .well-known folder, then select mta-sts.txt (edit, middle right) and copy/paste:

 

version: STSv1
mode: enforce
mx: yourO365record.mail.protection.outlook.com
max_age: 1209600

 

Then click Commit changes

 

Head back to your DNS editor and create:

 

Type: CNAME
Name: mta-sts
Value: yourGithubaccountname.github.io

Type: TXT
Name: _mta-sts
Value: v=STSv1; id=20240510 (id = today's date format)

 

Return to Github:

 

Click Settings (top, middle) > Pages (left, middle)

 

Enter the custom domain: mta-sts.yourschooldomain.sch.uk and select Save

 

Wait for the certificate to be generated, then below tick Enforce HTTPS

 

Return to the NCSC portal:

https://my.ncsc.gov.uk/mailcheck/domain-security/yourschooldomain.sch.uk

 

For an overview. All being well, it should be green ticks all round, or you can select More Information per category if there's still an issue.

[timbo343]

Also, the best advice I can offer is to sign up to the NCSC and gives some useful advice, especially with email traffic. Here are the settings I use:

 

DMARC + DMARC Insights

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; sp=quarantine; aspf=r; adkim=r; pct=100; rua=mailto:[email protected]; ri=86400; rf=afrf

 

SPF

Type: TXT
Name: @
Value: v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

 

DKIM

 

Enable in O365

 

Type: CNAME
Name: selector1._domainkey
Value: selector1-school-sch-uk._domainkey.school.onmicrosoft.com

Type: CNAME
Name: selector2._domainkey
Value: selector2-school-sch-uk._domainkey.school.onmicrosoft.com

 

Wait 5/10 minutes, then return back and select Enabled.

 

TLS/TLS Certificates - Nothing further to action.

 

TLS-RPT

Type: TXT
Name: _smtp._tls
Value: v=TLSRPTv1;rua=mailto:[email protected]

 

MTA-STS

 

Head over to Github and create a free account, then click here scroll down and select Use this template

 

Name your Repository: yourschooldomain.sch.uk and select Create Repository

 

Select the .well-known folder, then select mta-sts.txt (edit, middle right) and copy/paste:

 

version: STSv1
mode: enforce
mx: yourO365record.mail.protection.outlook.com
max_age: 1209600

 

Then click Commit changes

 

Head back to your DNS editor and create:

 

Type: CNAME
Name: mta-sts
Value: yourGithubaccountname.github.io

Type: TXT
Name: _mta-sts
Value: v=STSv1; id=20240510 (id = today's date format)

 

Return to Github:

 

Click Settings (top, middle) > Pages (left, middle)

 

Enter the custom domain: mta-sts.yourschooldomain.sch.uk and select Save

 

Wait for the certificate to be generated, then below tick Enforce HTTPS

 

Return to the NCSC portal:

https://my.ncsc.gov.uk/mailcheck/domain-security/yourschooldomain.sch.uk

 

For an overview. All being well, it should be green ticks all round, or you can select More Information per category if there's still an issue.

Just be careful of the SFP for sfp.google.com. We found that some CEO attacks can come from @gmail.com emails which go undetected due to the sfp.google.com string allowing @gmail.com emails.

[Michael]

Just be careful of the SFP for sfp.google.com. We found that some CEO attacks can come from @gmail.com emails which go undetected due to the sfp.google.com string allowing @gmail.com emails.

 

Not sure what solution I (or anyone) can do about it linking O365 > G Suite, but then again native G Suite tenancies probably also have this issue!?

[Michael]

DKIM Upgrade 1024 > 2048 bit

 

Depending on the age of your tenancy, you may need to review/rotate and upgrade your keys as follows -

 

Sign into Exchange:

 

Import-Module ExchangeOnlineManagement

Connect-ExchangeOnline

 

Run the command:

 

Get-DkimSigningConfig -Identity yourschooldomain.sch.uk | Format-List

 

Review the following lines towards the top:

 

Selector1KeySize             : 1024

Selector2KeySize             : 1024

 

Towards the bottom:

 

Guid                         : 12345678-ABCD-1234-1234-123456789ABC

 

Now run:

 

Rotate-DkimSigningConfig -KeySize 2048 -Identity 12345678-ABCD-1234-1234-123456789ABC

 

Run this command a second time:

 

Get-DkimSigningConfig -Identity yourschooldomain.sch.uk | Format-List

 

Review the following lines towards the top:

 

Selector1KeySize             : 1024

Selector2KeySize             : 2048

RotateOnDate                 : 15/05/2024 09:00:00 (approx. 4 days time)

 

Repeat this process on the 15/05/2024 after 09:00 (in this example):

 

Get-DkimSigningConfig -Identity yourschooldomain.sch.uk | Format-List

Rotate-DkimSigningConfig -KeySize 2048 -Identity 12345678-ABCD-1234-1234-123456789ABC

 

Both keys should now read 2048 bit:

 

Get-DkimSigningConfig -Identity yourschooldomain.sch.uk | Format-List

Selector1KeySize             : 2048

Selector2KeySize             : 2048

Edited May 11, 2024 by Michael

[PotNoodleTech]

It was said in a meeting I was in the week before last that Microsoft recon 80% of all cyber attacks they see are from education.

 

If that's true it's pretty shocking!

[mikes]

I was asked to put a contact list of our various departments on our school website, and I did so stupidly without obfuscating them - within 2 days every single one of those e-mail addresses had gotten a phishing attempt using a gmail account using our headteachers name (one of those "Please contact me so we can speak about something urgent") ones. Luckily o365 caught it. I don't know how much cash these attackers hope to gain, I think they must know education can be some of the easiest targets due to no 24/7 monitoring, some schools in our area can't keep a technician more than a month, etc

[TechMonkey]

Rotating key instructions

 

You can also do it from the MS Security Portal and it will take care of everything for you at the correct times.

 

It was said in a meeting I was in the week before last that Microsoft recon 80% of all cyber attacks they see are from education.

 

If that's true it's pretty shocking!

 

From as in originating or reported by?

Edited May 13, 2024 by TechMonkey

[Dos_Box]

It was said in a meeting I was in the week before last that Microsoft recon 80% of all cyber attacks they see are from education.

 

If that's true it's pretty shocking!

 

It would be interesting to find out how many attacks are carried out via another schools spoofed email address. I'd also like to know if it's teacher accounts being the primary source of the attack via email links\attachments etc. or pupils.

It could also be down to statistics I suppose. Given the amount of email accounts a school has, they probably beat most companies\organisations hands down it terms of attack vector reach.

[jthompson]

It would be interesting to find out how many attacks are carried out via another schools spoofed email address. I'd also like to know if it's teacher accounts being the primary source of the attack via email links\attachments etc. or pupils.

It could also be down to statistics I suppose. Given the amount of email accounts a school has, they probably beat most companies\organisations hands down it terms of attack vector reach.

 

Yup. 100s of end users who aren't adults, aren't employees and have terrible online hygiene and are switching to different shared devices roughly once an hour. Oh, and can't be expected to have a personal mobile as an additional factor.

 

Surely NCSC or somebody has some leverage to convince Microsoft to stop charging schools for de facto baseline security features.

[jthompson]

Just be careful of the SFP for sfp.google.com. We found that some CEO attacks can come from @gmail.com emails which go undetected due to the sfp.google.com string allowing @gmail.com emails.

 

I'm not sure that it matters. gmail.com emails are going to be allowed regardless, since it'll be gmail.com's SPF that governs that, not your own org's.

[EssentialRug]

Also, the best advice I can offer is to sign up to the NCSC and gives some useful advice, especially with email traffic. Here are the settings I use:

 

DMARC + DMARC Insights

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; sp=quarantine; aspf=r; adkim=r; pct=100; rua=mailto:[email protected]; ri=86400; rf=afrf

 

SPF

Type: TXT
Name: @
Value: v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

 

DKIM

 

Enable in O365

 

Type: CNAME
Name: selector1._domainkey
Value: selector1-school-sch-uk._domainkey.school.onmicrosoft.com

Type: CNAME
Name: selector2._domainkey
Value: selector2-school-sch-uk._domainkey.school.onmicrosoft.com

 

Wait 5/10 minutes, then return back and select Enabled.

 

TLS/TLS Certificates - Nothing further to action.

 

TLS-RPT

Type: TXT
Name: _smtp._tls
Value: v=TLSRPTv1;rua=mailto:[email protected]

 

MTA-STS

 

Head over to Github and create a free account, then click here scroll down and select Use this template

 

Name your Repository: yourschooldomain.sch.uk and select Create Repository

 

Select the .well-known folder, then select mta-sts.txt (edit, middle right) and copy/paste:

 

version: STSv1
mode: enforce
mx: yourO365record.mail.protection.outlook.com
max_age: 1209600

 

Then click Commit changes

 

Head back to your DNS editor and create:

 

Type: CNAME
Name: mta-sts
Value: yourGithubaccountname.github.io

Type: TXT
Name: _mta-sts
Value: v=STSv1; id=20240510 (id = today's date format)

 

Return to Github:

 

Click Settings (top, middle) > Pages (left, middle)

 

Enter the custom domain: mta-sts.yourschooldomain.sch.uk and select Save

 

Wait for the certificate to be generated, then below tick Enforce HTTPS

 

Return to the NCSC portal:

https://my.ncsc.gov.uk/mailcheck/domain-security/yourschooldomain.sch.uk

 

For an overview. All being well, it should be green ticks all round, or you can select More Information per category if there's still an issue.

 

Surprising the amount of schools that don't have this set up, including some of the schools listed in that article...

[DrCheese]

Only one we don't have setup is MTA-STS. I've always been wary about tying our ability to receive/send emails to our website uptime...

[jthompson]

Only one we don't have setup is MTA-STS. I've always been wary about tying our ability to receive/send emails to our website uptime...

 

I guess that's where the GitHub method described above helps. Also, your policy file would get cached by sending servers and might only need to be fetched once it's stale (as per the max_age value you set), which would limit the impact of any hosting outage.Happy to be corrected on my assumptions there, though.

[Michael]

Only one we don't have setup is MTA-STS. I've always been wary about tying our ability to receive/send emails to our website uptime...

 

Agreed - that's why I think Github's a better bet.

[andy_b]

Had MTA-STS setup with Github for two years with out issue (that I know about ).

[Dos_Box]

In case you all missed it, the registration for next weeks webinars is now live - https://www.edugeek.net/s/edugeek/732-may-2024-edugeek-webinars-sophos-specops.html

I've seen the Sophos slide deck, and it's going to be very informative indeed!

[supportman]

This is great stuff, thanks for the links. I'd been trying to work out DKIM for a while.

[TechMonkey]

Github for MTA-STS was much easier than I thought it would be and we have multiple domains using the same github. Worked wonderfully and as we don't have access to our website file structure it was a great solution.

[Cat_Jam148]

Only had MTA-STS left to do out of that list. Much easier than you think! Got it set up in testing mode, and will switch to enforce soon. Not sure why I put it off for so long.

 

Only one we don't have setup is MTA-STS. I've always been wary about tying our ability to receive/send emails to our website uptime...

 

According to what I've read, it's meant to fail open so website uptime shouldn't be all that much of a conern

 

if your policy file is not available then it will not block you from receiving emails. The standard is designed to fail ‘open’ and follow the protections listed in the RFC.

https://www.security.gov.uk/guidance/email-guidance/mta-sts/set-up

Edited May 13, 2024 by Cat_Jam148

[pete]

Just be careful of the SFP for sfp.google.com. We found that some CEO attacks can come from @gmail.com emails which go undetected due to the sfp.google.com string allowing @gmail.com emails.

 

I'd suggest a rule that quarantines any email that pretends (display name, first.last@, f.last@, firstlast@ etc) to be a manager/budget holder/etc and comes from a free domain (hotmail, gmail, etc).

 

So [email protected]er = delivered. [email protected] > quarantine.

 

It's not foolproof, there'll be a few false positives but it catches the low-effort scammers.

 

If your CEO, CFO and headteachers have relatively uncommon names, quarantine any variation of their name from any domain that's not the work-related one.

[MYK-IT]

Free version of Cloudflare can also handle MTA-STS too. So no need for the config file to be on your website or elsewhere etc. Which works great, as we use Cloudflare for DNS, website protection etc. Edited May 13, 2024 by MYK-IT

[Edu-IT]

Github for MTA-STS was much easier than I thought it would be and we have multiple domains using the same github. Worked wonderfully and as we don't have access to our website file structure it was a great solution.

What’s the process for this? Does it support multiple custom domains?

[mrbios]

What’s the process for this? Does it support multiple custom domains?

 

There's some instructions on here for it: https://www.security.gov.uk/guidance/email-guidance/mta-sts/set-up

 

Cloudflare is how i host mine too.