Cybersecurity

The Importance of Cybersecurity

Accountants handle a great deal of sensitive information. If hackers obtain this information, they can cause significant harm to their clients. In addition, because accountants are often highly trusted by their clients, hackers may attempt to exploit that trust to launch cyberattacks. Therefore, we dedicate significant resources to improving our security.

Social Engineering is the Most Common Cyberattack

Forget about the movies that depict hackers freely connect to any computer that they want; our computer systems are not that easy to break into. Instead, hackers often rely on social engineering, which involves gaining your trust and misleading you into taking the action that benefits them.

Think about the scam calls pretending to be from a bank or the CRA, or the suspicious emails claiming you have won a lottery. Yes, that is social engineering at work.

The following examples demonstrate how a cybercriminal may exploit your trust in your accountant to launch a cyberattack:

Vulnerability of Classical Email Protocol

Both examples above involve spoofing—faking an identity you trust—and phishing—tricking you into taking an action desired by the attacker. Gaining a victim’s trust is usually the first step in a fraud and email is one of the hackers’ favorite tool.

This is because classical email protocols lack built-in mechanisms to prevent spoofing. In fact, classical email protocols allow senders to specify any email address they want as the sender.

In response, Internet standard organizations have developed several protocols and technologies to help prevent spoofing and phishing. Let’s look at how well TaxWise Accounting and its competitors have adopted the following protocols: HTTPS, SPF, DKIM, DMARC and DNSSEC.

What Are the Purposes of These Protocols?

HTTPS

Since your are browsing our webpage, you are already using HTTPS, or Hypertext Transfer Protocol Secure. HTTPS and its predecessor, HTTP, define how you access a webpage. They form the foundation of the modern World Wide Web.

The major vulnerability of HTTP is that all communications between your device and the website are transmitted without encryption. You can think of this method of communication as sending a postcard through the mail. Any machine forwarding the message could potentially read read its content, which may include your user ID, password, Social Insurance Number, or bank account balance. You can imagine how devastating the consequence could be if one of the machines along the way is controlled by a hacker. That’s why HTTPS has largely replaced HTTP for modern websites.

HTTPS encrypts the communications between your device and the website. For example, instead of transmitting something like “Password: ABC123” in readable form, the information is encrypted into data that cannot be understood without the appropriate cryptographic keys. Because the encrypted data does not reveal the meaning of the communication, an eavesdropper cannot simply read your password or other sensitive information.

Email Authentication – SPF, DKIM & DMARC

SPF, DKIM and DMARC are all technologies used for email authentication. They help answer an important question: Is this email really from the sender shown in the message? These three technologies use different methods to validate the sender’s identity, and they are most effective when used together.

DMARC

DMARC, or Domain-based Message Authentication, Reporting and Conformance, allows a domain owner to specify how receiving email servers should handle message that fail email authentication checks. Without DMARC, receiving email servers are generally freely decide how to handle the SPF and DKIM failures. Because there are still many domains not implementing SPF and DKIM, many servers may choose to deliver these suspicious emails normally, as if nothing had happened.

DMARC publishes a policy in the sender’s DNS and tells the receiving email servers how to handle the messages that failed the authentication requirements. The sending domain can specify three policies:

• Ignore (p=none): The sending domain requests receiving servers to ignore the authentication failures. This policy indicates that the sending domain is not yet ready to fully implement email authentication.
• Spam (p=quarantine): The sending domain asks receiving servers to deliver the unauthenticated messages to a separate folder, usually the spam or junk folder. This creates partial reliefs but there is still a possibility that recipient still reads the message . This indicates the sending domain has partially implemented SPF and DKIM but not confident enough yet.
• Enforce (p=reject): The sending domain asks receiving servers to delete or return the messages that fail SPF or DKIM authentication. Essentially, this means the sending domain wants to treat all unauthenticated emails as fake and prevent them from reaching the recipients. In our opinion, this is the only secured option that protects clients from the spoofed messages.

In addition to specifying how receiving servers should handle authentication failures, DMARC can also request that receiving servers send reports to a designated email address. These reports allow the sending domain to monitor authentication results and identify potential spoofing attempts.

DNSSEC

If you have patiently read the article so far, you probably noticed that we have mentioned DNS many times. DNS is where we publish email authentication policies and cryptographic keys. Indeed, the Domain Name System is a fundamental part of the Internet and plays an important role in many cybersecurity systems.

However, the traditional domain name system has security limitations. Without DNSSEC, DNS responses can potentially be manipulated by an attacker under certain circumstances. For example, a attacker might successfully interferes with DNS resolution and provide a false IP address, redirecting users to a malicious website.

DNSSEC, or Domain Name System Security Extensions, adds digital signatures DNS so that receiving systems can verify that the information came from an authorized source and has not been altered. This helps protect cybersecurity measures that depend on the integrity of DNS information, including SPF, DKIM, and DMARC.