Proofpoint Reveals Over 80% of Australia’s Higher Education Institutions at Risk of Email Fraud

Email fraud is on the rise globally, and Australia’s higher education sector is no exception. According to recent research by Proofpoint, Inc., a leading cybersecurity and compliance company, more than four out of five (82%) of Australia’s universities and higher education institutions are vulnerable to email-based impersonation attacks. Despite handling sensitive information and protecting millions of students and staff, many institutions have failed to implement basic email security protocols, leaving them exposed to significant cyber threats.

The Growing Risk of Email Fraud in Australian Higher Education
Proofpoint’s research, released in February 2024, highlights the precarious state of cybersecurity in Australia’s education sector. The analysis, which evaluated Domain-based Message Authentication, Reporting & Conformance (DMARC) adoption across 132 public and private universities, revealed a worrying lack of robust email security measures. DMARC is a protocol designed to protect domains from being exploited by cybercriminals for email fraud and phishing campaigns. However, only 18% of institutions have implemented DMARC at its strictest level, known as “reject,” while 82% have not taken sufficient steps to safeguard against email fraud.

Worrying Statistics on Cybersecurity in Education
Proofpoint’s findings come amid a significant increase in email-based scams across Australia. In 2023, Australians lost nearly $80 million to email fraud, as reported by the Australian Competition and Consumer Commission (ACCC). The number of email-based scam reports increased by over 65%, with email emerging as one of the top attack vectors for cybercriminals targeting vulnerable organizations. In the higher education sector, this risk is amplified by the wealth of personal and financial information held by universities, making them prime targets for cyberattacks.

Why Higher Education Institutions Are Targeted
Universities store a vast array of sensitive data, from student records and research to financial information and employee details. This diversity of data makes them an attractive target for cybercriminals who seek to exploit email systems for phishing, credential theft, and other malicious activities. Steve Moros, Senior Director of Proofpoint’s Advanced Technology Group in the Asia Pacific and Japan, emphasized that “universities hold some of the most valuable data in the country,” making it crucial for them to strengthen their email security protocols.

The State of DMARC Adoption in Australia’s Universities
Proofpoint’s DMARC analysis found that 76% of institutions have adopted some level of DMARC, but the majority of these policies are inadequate to prevent email-based attacks. Here is a breakdown of the DMARC adoption levels among Australia’s universities:

• 18% have implemented the strictest “reject” policy, which blocks unauthorized emails from reaching recipients.
• 16% use the “quarantine” policy, directing suspicious emails to recipients’ spam folders.
• 42% have adopted the “monitor” policy, which allows universities to track email usage but does not prevent fraudulent messages from reaching inboxes.
• 24% of institutions have not adopted any DMARC policies, leaving them completely unprotected.

Consequences of Weak Email Security
The lack of comprehensive email security in Australia’s higher education sector poses significant risks. Email remains the number one attack vector for cybercriminals, and phishing campaigns, in particular, are on the rise. With universities failing to fully implement DMARC, they leave themselves, their staff, and students vulnerable to sophisticated email fraud schemes, including phishing, spoofing, and business email compromise (BEC) attacks.

Moreover, non-compliance with DMARC could hinder universities’ communication efforts with students and stakeholders. As email providers like Google, Yahoo!, and Apple begin enforcing stricter email authentication standards, institutions that fail to implement DMARC risk their legitimate emails being marked as spam or rejected altogether, reducing the effectiveness of important communications.

10 Tips to Avoid Email Fraud in the Future

1. Implement DMARC at the “Reject” Level: Universities should ensure that they implement DMARC with the strictest “reject” setting to block fraudulent emails from reaching recipients.
2. Enable SPF and DKIM: Use Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to authenticate email senders and protect against spoofing.
3. Conduct Regular Email Security Audits: Continuously assess email systems to identify vulnerabilities and gaps in security.
4. Train Staff and Students on Phishing Awareness: Regularly conduct cybersecurity awareness training to help stakeholders identify phishing emails and malicious links.
5. Use Multi-Factor Authentication (MFA): Ensure that all email accounts, especially administrative and sensitive ones, are protected with MFA to mitigate unauthorized access.
6. Monitor Email Traffic: Use tools to monitor email traffic for suspicious activity or unusual behavior, such as multiple login attempts or access from unknown locations.
7. Limit Access to Sensitive Information: Only authorized personnel should have access to sensitive student or financial data, reducing the risk of accidental exposure through compromised email accounts.
8. Set Up Anti-Phishing Measures: Implement advanced anti-phishing tools that can automatically detect and block malicious emails before they reach recipients.
9. Stay Updated with Cybersecurity Best Practices: Ensure your institution is updated on the latest email fraud trends and adapts its security measures accordingly.
10. Encourage the Use of Secure File Sharing Platforms: Prevent sensitive information from being shared via email by encouraging the use of secure file-sharing platforms that offer encryption and authentication.

Conclusion
The alarming vulnerability of Australia’s higher education institutions to email fraud should serve as a wake-up call. With cybercriminals continuously evolving their tactics, it’s crucial for universities to bolster their email security protocols and ensure that sensitive student and staff information is protected. By adopting strong DMARC policies and implementing comprehensive email security measures, these institutions can mitigate the risk of email fraud and safeguard their academic communities from growing cyber threats.

Source: Proofpoint

Want to stay on top of cybersecurity news? Follow us on Facebook – X (Twitter) – Instagram – LinkedIn – for the latest threats, insights, and updates!