Get details right to safely implement DANE in Exchange Online, warn experts – Source: www.csoonline.com

Microsoft’s announcement this week that it is adding support for two new security standards in Exchange Online is seen by experts as encouraging news — as long as CISOs and email administrators get the complex implementation details right.

The announcement should encourage all email administrators and vendors of email solutions to add the capabilities to their solutions, experts told CSO Online. But, they caution, adding the two protocols – DNS-based Authentication of Named Entities (DANE) for SMTP and Domain Name System Extensions (DNSSEC) isn’t easy, even if they are Exchange Online customers.

DANE provides a safe way to detect if a remote mail server supports TLS (Transport Layer Security), and which certificates it uses to encrypt and authenticate the connection. Microsoft further explained in its announcement that “SMTP DANE with DNSSEC provides a secure connection between sending and receiving mail servers that is resistant to both TLS-downgrade attacks and adversary-in-the-middle attacks (a form of eavesdropping where the communication is monitored or modified by a bad actor).”

The Microsoft announcement “is helpful,” commented David Shipley, who heads the security awareness training provider Beauceron Security and is former director of strategic IT initiatives at the University of New Brunswick, “but only so much as people have good records and implement good records. I’m sure big brands like Microsoft will be resourced to do this, but doubtful all enterprises or even a fraction of small and mid-size firms will do it.”

Many sites haven’t yet implemented other existing email security protocols, he pointed out. For example, only 59% of the top 1 million domains have an older protocol, SPF (sender policy framework), validly configured, he said, citing an article in DMARC Checker. And of the Top 1,000, only 77% have the basic SPF correct.

DANE won’t stop phishing, Shipley added, although “it may help further put a dent on spoofing.”

Exchange Online customers may not have to do much, Johannes Ullrich, dean of research at the SANS Institute, pointed out, because Microsoft is taking care of it on its platform. However email administrators using their own domains will have to face configuring these protocols if they want added email protection.

And a mistake in implementing DNSSEC can easily lead to a self-inflicted denial of service attack, Ullrich added. It’s a risk he feels many CISOs are not willing to take.

On the other hand, Jess Burn, a principal analyst at Forrester Research, said the Microsoft announcement is “great news for enterprises of all sizes as well as consumers with personal email addresses.”

“Any additional protection email infrastructure and security firms can provide to ensure users know who they are communicating with will help. More and more successful BEC [business email compromise] attempts originate with attackers jumping into email threads via unencrypted connections. The use of SMTP DANE and DNSSEC, if configured properly and widely adopted, will reduce man-in-the-middle attacks.”

The best combination to protect end users from falling for phishing and BEC attempts is implementing SMTP DANE and DNSSEC to secure the confidentiality of messages, he said, as well as using email authentication protocols like DMARC, DKIM, and SPF to validate the sender and reduce the number of emails from spoofed domains from hitting inboxes.

“Achieving this combination, however, requires effort, maintenance, and often multiple stakeholders and functions to implement,” he cautioned.

How much work will Exchange Online admins have to do to add Inbound SMTP DANE? Quite a lot, and the advice Microsoft offers in a paper explaining how SMTP DANE works should be followed closely. Admins should note that to get the benefit of SMTP DANE, Microsoft says DNSSEC has to be enabled for the domain.

Before starting, the admin must have added the organization’s domain set as an ‘Accepted Domain’ and the domain status must be ‘Healthy’ in the Microsoft 365 Admin Center. The domain’s MX record has to be set and there should be no fallback or secondary MX record. If there is a secondary record, changes have to be carried out correctly.

Microsoft warns that if an organization’s business partners use connectors to your Outlook endpoint, those connections will have to be updated to a new endpoint before you configure Inbound SMTP DANE with NDSSEC.

Microsoft also warns that DNS record provisioning and updates can take some time to complete and become visible due to multiple layers of caching.

Again, refer to the exhaustive paper before starting.