97% Of Top Universities Can’t Secure Email Domains – Expert Comments

By   ISBuzz Team
Writer , Information Security Buzz | Aug 04, 2022 01:53 am PST

Proofpoint released a new study on the inability of universities to secure email domains: 97% of top universities in the US, UK and Australia putting students, staff, and stakeholders at risk of being impersonated by cybercriminals.


…97% of the top ten universities across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud. According to the analysis, universities in the United States are most at risk with the poorest levels of protection, followed by the United Kingdom, then Australia. 

These findings are based on Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of the top ten universities in each country. DMARC is an email validation protocol designed to protect domain names from being misused by cybercriminals. It authenticates the sender’s identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine and reject, with reject being the most secure for preventing suspicious emails from reaching the inbox.   

DMARC analysis shows:

  • None of the top U.S. and U.K. universities had a Reject policy in place, which actively blocks fraudulent emails from reaching their intended targets, meaning all are leaving students open to email fraud.
  • Five of the top ten U.S. universities do not publish any level of DMARC record.
  • 65% of the top U.S. and U.K. universities had a base level of DMARC protection (Monitor and Quarantine) in place.
  • 17 (57%) of all surveyed universities implemented a Monitor policy, while only four (13%) of the 30 universities implemented a Quarantine policy.
Notify of
2 Expert Comments
Oldest Most Voted
Inline Feedbacks
View all comments
Garret F. Grajek
August 4, 2022 9:58 am

Higher education isn’t the only sector at risk from email attack. The US Cybersecurity & Infrastructure Security Agency (CISA) has determined that the Kimsuky attack group, most likely commissioned by the North Koreans, have introduced a malware called “SHARPTEXT” that doesn’t need your Gmail login credentials, let alone worry about 2FA. The malware allows the attacker to read the email that the user browses. It is these types of attacks and more that should convince enterprises their systems are under attack and should be assumed to be compromised.  

The big question this begs is: how deep and how long the exposure will be? Key to enterprise security is a zero trust architecture, coupled with strong identity governance, that limits access and adheres to the principle of least privilege (NIST 800-53, PR.AC-6).

Last edited 1 year ago by Garret F. Grajek
Chloé Messdaghi
Chloé Messdaghi , VP of Strategy
August 4, 2022 9:57 am
  • There are at least four reasons why top universities are so vulnerable: Organizations need to have several security plans – plans that they actually implement. So many organizations talk about cybersecurity goals but don’t fully get beyond talking to cover the implementation phase
  • Universities often under invest or fail to invest in their security team and tools
  • Higher learning, as a sector, is often just reactive, not proactive when it comes to security approaches and ongoing security team training, which is short sighted. Education is their mission, and these institutions really need to educate and invest in their cybersecurity teams. This lack of investment can put kids and the institution itself in danger.
  • The fact is that college and university education is expensive, and students pay a great deal of money for their degrees. It’s incumbent upon these institutions to invest in ongoing cybersecurity team training and their security infrastructure, for the protection of their students, donors, employees and stakeholders. It’s central to their mission
Last edited 1 year ago by Chloé Messdaghi

Recent Posts

Would love your thoughts, please comment.x