• by Ray Schultz , Columnist, 2 hours ago

Don’t be surprised if a phishing email brings down our water or some other critical system. They are highly vulnerable, according a new report from Red Sift. 

Of those studied, 52% of water and waste organizations lack full DMARC (Domain-based Message Authentication, Reporting, and Conformance) enforcement, as do 42% of companies in the water, waste, chemical and energy sectors.

"When nation-state actors target critical infrastructure, they rarely begin with sophisticated attacks,” says Brian Westnedge, director of alliances and partnerships at Red Sift. “More often, they exploit overlooked weaknesses such as phishing emails, domain impersonation, and compromised credentials to gain a foothold inside an organization. Water utilities have become an increasingly attractive target because they provide essential public services and often operate with limited cybersecurity resources.” 

Westnedge adds: “The recent incidents in Minnesota and beyond are a reminder that organizations responsible for critical infrastructure cannot afford to treat email security as a secondary concern.”

How hideous that the email medium can be used for such threatening purposes. But there are effective remedies, including DMARC, Sender Policy Framework (SPF) and DomainKeys Identified By Mail (DKIM), used in tandem.  

Still, the news on other fronts was also not good.

An impressive 89.5% of U.S. organizations have published a DMARC record, but 57.1% still do not block spoofed emails.  

And of 5,000 domains studied throughout 50 states and Washington, D.C., only 1,919 have reached full enforcement. 

Geographically, the strongest region is on the East Coast. But that may not be saying much. 

“The spread between the strongest and weakest US region is 12.8 points,” the study states. That narrowness makes the finding harder to dismiss rather than easier. No region of the United States is well protected. The Mid-Atlantic, which contains the federal government and the country's second-largest banking center, still leaves 56% of its top organizations unable to block email claiming to come from them.” 

North Carolina was the top state, with 55% enforcement, while Montana and New Mexico were on the bottom at 25%. Of the two major cities studied, New York achieved 73% and Washington, D.C. had 57%.

Situated in New York, we hope they are keeping an eye on their water systems.