Many of the email breaches don’t start with advanced hacking. Beginning with small settings no longer tightened up. Ten misconfigurations that are frequently seen and their quick fix solutions:
- MFA on mailboxes – Enable multi-factor authentication for all users, especially applies to admins.
- Weak passwords/no password policy – Establish a policy for length, complexity and lockouts with a known breached passwords blocklist. For advice on using a Barracuda Partner, visit a site like primesys.co.uk/partnerships/barracuda/
- Sender Policy Framework not published or very lax – Publish SPF and remove “+all” do NOT include unnecessary senders.
- Domainkeys Identified Mail missing – use DKIM signing by your sending domains.
- DMARC not set (or permanently in the “none” position) – Monitor to begin with, switch for quarantine/reject later when both are aligned.
- Too many global allowlists – Say no to “always allow” and apply narrowly focused exceptions within a specific time period.
- Auto-forwarding to external addresses – Turn off or limit; watch for new forwarders.
- Unmonitored mailbox rules – Raise alert on suspicious mailbox rules (delete, move to RSS folder, forward or mark as read).
These are not huge projects and do not take a major project to fix. It all starts with MFA and authentication (SPF, DKIM + DMARC) that later results in tightening exceptions or monitoring rules. Certainly, any tweaks made here can eliminate the quickest avenues attackers use to gain access to your most valuable business data.