School cyber-attacks up 55% Year on Year.

[Edu-IT]

There's some instructions on here for it: https://www.security.gov.uk/guidance/email-guidance/mta-sts/set-up

 

Cloudflare is how i host mine too.

What isn’t clear though is whether you can have different MTA-STS setups if you have different domains with different MX servers.

[Primus]

What isn’t clear though is whether you can have different MTA-STS setups if you have different domains with different MX servers.

 

How do you mean?

[jthompson]

I'd suggest a rule that quarantines any email that pretends (display name, first.last@, f.last@, firstlast@ etc) to be a manager/budget holder/etc and comes from a free domain (hotmail, gmail, etc).

 

So [email protected]er = delivered. [email protected] > quarantine.

 

It's not foolproof, there'll be a few false positives but it catches the low-effort scammers.

 

If your CEO, CFO and headteachers have relatively uncommon names, quarantine any variation of their name from any domain that's not the work-related one.

That looks like quite a job to maintain! I'm guessing M365 doesn't have the option that Gmail does of attaching a warning to any external emails where the display name matches that of any user in your org?

[HPlum78]

I posted about this a few years back but just for a refresh for those that are M365 tenants you should setup a rule that checks the Envelope from (helps prevent Domain Name spoofing) address and make some decisions based on that. Here is a useful link to configure that rule and also has a piece on Display Name spoofing as well (but as already mentioned could be a mountain of work!) .

 

https://office365concepts.com/stop-spoof-email-in-office-365/

 

And here is the MS view of the world:

https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-spoofing-about

 

Just get those DKIM, DMARC and SPF records done at the very least.

 

Oh and as a starter for 10 for those who have Azure Tenants go here (https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/UserSettings)

 

Stop users from registering applications and restrict non-admins users from creating tenants, think about your Guest users access and what you want to expose to these users (most inclusive is probably not the one...)

There are some other options in there that you may want to consider as well (show keep signed in is a NO imo).

[ITGuyNW]

I posted about this a few years back but just for a refresh for those that are M365 tenants you should setup a rule that checks the Envelope from (helps prevent Domain Name spoofing) address and make some decisions based on that. Here is a useful link to configure that rule and also has a piece on Display Name spoofing as well (but as already mentioned could be a mountain of work!) .

 

https://office365concepts.com/stop-spoof-email-in-office-365/

 

Just to double check, Is this saying only those who are a client in the tenant can send emails using the organisations domain name? I want to set all this up but want to make sure I'm not cutting anyone out who wants to send work emails from home.

[TechMonkey]

What isn’t clear though is whether you can have different MTA-STS setups if you have different domains with different MX servers.

 

Yes you can. I have a single github account with 2 different repos for two different domains.

[Michael]

What isn’t clear though is whether you can have different MTA-STS setups if you have different domains with different MX servers.

 

I believe you can specify multiple MX servers in the same TXT file, however personally I'd advise against this for security reasons.

 

Regardless if you have multiple O365 tenancies/schools, or a single O365 tenancy with multiple domains, each will still have a separate MX record, therefore I would have separate files for each.

 

I'd also advise against using criteria such as:

 

*.mail.protection.outlook.com

 

As again, this would apply to any O365 MX record and defeats the objective.

[pete]

That looks like quite a job to maintain! I'm guessing M365 doesn't have the option that Gmail does of attaching a warning to any external emails where the display name matches that of any user in your org?

 

365 (or at least A3-licensed 365) only has an external senders tooltip.

 

My kludge doesn't scale particularly well for a large trust with a lot of managers/budget holders (there's a character limit on the rules) but it's less work than cleaning up after someone helpfully buys Amazon gift cards.

[Edu-IT]

Sorry I probably wasn't clear. I meant can you use Github to host separate STS files or do you need an account for each domain.

[Michael]

Sorry I probably wasn't clear. I meant can you use Github to host separate STS files or do you need an account for each domain.

 

Yes, you can host as many repositories as you require under a single Github account. I don't know if there's a hard limit.

[andy_b]

Sorry I probably wasn't clear. I meant can you use Github to host separate STS files or do you need an account for each domain.

 

I have one github account that hosts multiple copies of the repository to have individual STS files for each domain - so it can be done all from one account.

 

Probably not efficient, but it is the way I started. I believe other people just point multiple domains to a single STS file

[Edu-IT]

I have one github account that hosts multiple copies of the repository to have individual STS files for each domain - so it can be done all from one account.

 

Probably not efficient, but it is the way I started. I believe other people just point multiple domains to a single STS file

Thanks. So within Github, just create different repo's, and add a custom domain to each so mts-sts.customdomain.co.uk works?

[TechMonkey]

Yes. Been a while since I did it but you can set up a vanity URL for the repo. The settings page walks you through it, I think you have to put a file into DNS to allow it.

[DrCheese]

Only had MTA-STS left to do out of that list. Much easier than you think! Got it set up in testing mode, and will switch to enforce soon. Not sure why I put it off for so long.

 

 

 

According to what I've read, it's meant to fail open so website uptime shouldn't be all that much of a conern

 

 

https://www.security.gov.uk/guidance/email-guidance/mta-sts/set-up

 

Thanks, have set this up today now I know this (because your post) - Only have it in testing mode currently, will leave it a week or so then flip over. The NCSC let you send the TLP-RPT reports to them so you know if enforcing it is going to cause any issues.

[Primus]

Thanks, have set this up today now I know this (because your post) - Only have it in testing mode currently, will leave it a week or so then flip over. The NCSC let you send the TLP-RPT reports to them so you know if enforcing it is going to cause any issues.

 

NCSC Mail Check is a brilliant resource.

[free780]

Surprising the amount of schools that don't have this set up, including some of the schools listed in that article...

 

Yep or orgs with no dmarc record!

 

That’s going to create delivery issues.

[CrootUK]

Yep or orgs with no dmarc record!

 

That’s going to create delivery issues.

 

This has been a repeated task for us, firms with incorrect spf config or missing completely along with dkim/dmarc… some big names too. We have been strict on following guidance no “allow listing” of any domains/email addresses.

Edited May 14, 2024 by CrootUK

[Primus]

AQA have had their DMARC set to none for well over a year now.

[highsky]

Two more secondary schools got attacked in South West, at the end of February and end of March.

 

It took them more than a month to restore their services, no details yet on the attacks.

 

On Microsoft tennants there are now preset conditional access policies for the admin portals and the admins to activate.

As by default they give read access to all members.

 

I would like to see this one presented by them as an interactive quiz with a 6-9 months mandatory retakes:

https://www.ncsc.gov.uk/information/cyber-security-training-schools

 

The training sites for CPD i would expect by no to have some sort of training for this too.

[TechMonkey]

This has been a repeated task for us, firms with incorrect spf config or missing completely along with dkim/dmarc… some big names too. We have been strict on following guidance no “allow listing” of any domains/email addresses.

 

I have had some very, very long conversations with people and companies about not white listing their domain just because they say it is safe. Lots of parents with custom domains, or using their own company emails, not understanding and getting fed up with me that no one else has the issue. Even talking to one parent's friend who runs a small ISP who argued that DKIM wasn't a guarantee or that secure.

 

The funniest one was a department telling me that a small company they work with was always being quarantined so could we white list them as they didn't have the resources to sort DMARC. My response that they sound exactly like the kind company that shouldn't be white listed, didn't seem to go down well

[Primus]

I have had some very, very long conversations with people and companies about not white listing their domain just because they say it is safe. Lots of parents with custom domains, or using their own company emails, not understanding and getting fed up with me that no one else has the issue. Even talking to one parent's friend who runs a small ISP who argued that DKIM wasn't a guarantee or that secure.

 

The funniest one was a department telling me that a small company they work with was always being quarantined so could we white list them as they didn't have the resources to sort DMARC. My response that they sound exactly like the kind company that shouldn't be white listed, didn't seem to go down well

 

Similar here - AQA recently emailed exams officers asking for their domain/address to be whitelisted - it's very very frustrating.

[HPlum78]

There is a massive issue with the understanding of DKIM/ DMARC and SPF and how they interact to increase the security of email and yes some big names out there are in the line of this. Along with those also not understanding the implications of white listing (so when you get owned we all get owned!), come on lets just be better....

[HPlum78]

OFSTED should have this as a check and should not allow management to anything but requires improvement if this and some other basic IT security is not in place, that would focus minds...

[jthompson]

I can appreciate that a larger org with many different divisions will have a harder time wrangling their outgoing email sources, but all the more reason to actually do it when you know that you have a deliverability problem across your recipients.

[free780]

I can appreciate that a larger org with many different divisions will have a harder time wrangling their outgoing email sources, but all the more reason to actually do it when you know that you have a deliverability problem across your recipients.

 

You’ll find there are probably all sorts of internal politics where marketing wants to use mailchimp and service X and Y. The shift in governance to engage with IT is seen as ‘too hard’. Until your domain gets spoofed with some repetitional damage it’s going to be difficult to get change to happen.