The Department of Homeland Security binding directive (BOD 18-01) outlines several milestones that agencies must meet in order to show progress and, ultimately, compliance with the directive. The first of those milestones (due on November 15 th , 2017) is to create an Agency Plan of Action for BOD 18-01 outlining how the agency would implement the requirements of the directive and meet its...

On October 16, 2017, the U.S. Department of Homeland Security issued Binding Operational Directive (BOD) 18-01 that mandates the implementation of specific security standards to strengthen email and website security among government agencies. As part of this DHS mandate, all federal agencies that operate .gov email domains must implement a DMARC “monitor” policy within 90 days and must progress to...

If you are in the email business, the big story today is Mailsploit, a collection of email client bugs that threatens to undermine DMARC and render Secure Email Gateways (SEGs) obsolete. In other words, the end of the world is upon us, and we should all go back to using smoke signals or march forward and find a replacement for email. Before we all become tinfoil milliners, let’s take a step back...

Are you ready for Binding Operational Directive 18-01? On October 16, 2017, the Department of Homeland Security (DHS) issued this directive in order to implement better security protocols on government emails. The DHS BOD 18-01 is a compulsory directive to all federal departments and agencies. Among the measures mandated in BOD 18-01 is a requirement that federal agencies adopt Domain-based...

As with all great internships, I started this summer at Agari being delightfully bombarded with various acronyms and different technologies to learn. But though there was such a wealth of new information, within weeks, I found myself making real contributions to the product and essentially being treated as a full-time engineer. I came into this 10-week internship after my junior year at U.C...

Are you sending Google Calendar invites and not getting replies, or maybe your invitees tell you they tried to reply and it was blocked? Or maybe you are trying reply to Google Calendar invites and being blocked saying the mail is not accepted due to your domain's DMARC policy? This is an issue I have been seeing, so I did some digging and I have figured out what is going on. Before I get to the...

Every year, more than 5 million homes are bought and sold in the U.S. Given this volume, it should come as no surprise that the real estate industry is a prime target for email-based crimes. Cyber criminals are spoofing (and in some cases taking over) the email accounts of real estate agents, title companies, and others involved in the home buying process. Once the criminal gains access, he or she...

Companies are flocking to Office 365 as the leading choice of cloud-based email. But while it’s a great productivity enhancer and provides simplicity and cost savings over on-premises solutions, it raises serious security challenges. Threat actors typically target email accounts with identity deception. And with Office 365 being ubiquitous and publicly-discoverable, the risks become even greater...

We are delighted to announce that Agari is among the suppliers listed on the UK Government’s G-Cloud 9 framework. Agari will now be able to provide its award-winning DMARC Email Authentication service, Agari Customer Protect, to UK public sector organisations through the Government’s secure online store, the Digital Marketplace. Agari Customer Protect is listed in the the Software-as-a-Service...

Today, cybercriminals launched a highly effective email scam that included a link to a Google Docs document that was in fact a link to a 3rd party app designed to steal information from the recipient. Worse, the email appears to come from someone known to the victim. Based on information from the Agari Trust Network, we saw more than 3,016 organizations compromised that sent 23,838 emails to Agari...

In my previous blog post , I introduced the concept of open quarantine. This week, I’d like to explore the two phases of email filtering that make up the open quarantine process. Phase 1 - Tripartite Classification The notion of open quarantine depends on being able to perform a tripartite classification of messages into good , bad and undetermined , where the first two categories have a close to...

In my previous blog post , I provided examples of the growing sophistication – and subsequent success – of several high-visibility email attacks that used social engineering to evade traditional email security filters. This week, I’d like to introduce a new filtering paradigm: open quarantine. Open quarantine balances the needs of security and usability using a two-phase email filtering process...

In my previous blog post, I provided examples of the growing sophistication – and subsequent success – of several high-visibility email attacks. This week, I’d like to look at the different types of emails that are enabling these attacks. Deceptive emails are used by cyberattackers to carry out three different types of attacks: To coerce the recipient to follow a hyperlink to a website...

One of the things that often stumps even the most security conscious companies is knowing all the third-party email service providers they are working with. It is extremely difficult, if not impossible for these organizations to protect their customers from phishing attacks if they don’t even know who is sending legitimate email on their behalf. And this gets even more challenging when you...

Managing AWS costs is confusing, difficult and sometimes can seem downright hopeless. At Agari, we’ve found Cloudhealth to be a useful partner in measuring both AWS usage and spend. As the saying goes: “what you measure, improves!”. In particular, we’ve found it useful to track daily AWS spend. It's helpful both in terms of understanding what drives costs, as well as heading off unexpected...

Agari has made significant investment into infrastructure as code. Almost two years into this project, we’ve learned some lessons. In my previous blog post , I discussed organization of your automation repository and parameterizing environments. For this post, I'd like to talk about state management and database automation. State management One of the most frustrating things about working with...

Agari has made significant investment into infrastructure as code. Almost two years into this project, we've learned some lessons. (If you'd like to read about our first year efforts, check out my previous blog post - Ansible and Terraform at Agari: An Automation Journey.) Our efforts have already yielded dividends by increasing engineering velocity while maintaining infrastructure reliability...

If you have been following our previous posts, Airflow @ Agari and Leveraging AWS to Build a Scalable Data Pipeline or our recent talks on data pipelines and Apache Airflow , you are well aware that Agari leverages both the public AWS cloud and open source technologies, such as Apache Spark and Apache Airflow, to build resilient predictive data pipelines. This summer, we had the pleasure of...

With the surge of phishing and other advanced email attacks, you can’t be too careful when it comes to your inbound email messages. Beyond viewing the basic information provided, you should make it a habit of viewing and understanding your emails' full headers.

In this series of blog posts we examine the most common forms of phishing attacks and appropriate countermeasures to protect both individuals and organizations – in this post we explore hacktivism and the growing range of victims. Politically Motivated & Hacktivism The threat of cyber criminals pursuing a political agenda and seeking to disrupt critical infrastructures has been well documented...