Email adalah vector attack #1. 91% cyber attack dimulai dari email — dan domain Anda bisa jadi senjata di tangan attacker tanpa Anda sadari. SPF, DKIM, DMARC bukan cuma untuk deliverability: itu adalah fortress pertahanan domain Anda.
Bayangkan: Attacker mengirim email "dari" bank Anda ke nasabah. Logo sama, domain mirip, tone profesional. Nasabah klik link, masukkan password. Domain Anda yang di-blacklist, reputasi hancur, trust hilang.
Di Indonesia, serangan phishing naik 340% sejak 2023. Fintech, e-commerce, dan SaaS adalah target utama. Tanpa proteksi email security yang kuat, Anda bukan hanya kehilangan revenue — tapi kehilangan kepercayaan publik.
🛡️ Email Security Stack
- Authentication: SPF, DKIM, DMARC (prevent spoofing)
- Encryption: TLS 1.3 (prevent interception)
- Monitoring: DMARC reports, anomaly detection
- Response: Incident plan, takedown procedures
🎯 6 Threat Model untuk Email Domain
1. Direct Domain Spoofing
Attacker menggunakan domain Anda persis untuk kirim email phishing.
From: [email protected]
Subject: URGENT: Verifikasi akun Anda segera
Body:
Kami mendeteksi aktivitas mencurigakan. Klik link berikut untuk verifikasi:
http://phishing-site.com/verify
[Logo yourbank.co.id]
⚠️ Dampak:
- Victim trust destroyed
- Your domain reported as phishing
- Blacklist di Gmail, Yahoo, Microsoft
- Legal liability jika data breach
✅ Defense: DMARC dengan
p=reject — email tanpa authentication langsung ditolak provider.
2. Subdomain Spoofing
Attacker menggunakan subdomain yang mirip atau tidak terproteksi.
Legitimate: security.yourbank.co.id
Spoofed: security-yourbank.co.id (hyphen)
Spoofed: yourbank-security.co.id (reversed)
Spoofed: yourbank.co.id.security-update.com (subdomain trick)
✅ Defense:
- Register variant domains (hyphen, common typos)
- Monitor untuk lookalike domains (brand protection services)
- DMARC untuk parent domain covers subdomains
3. Display Name Deception
From address valid, tapi display name menipu.
From: "CEO Budi Santoso" <random>
Reply-To: [email protected]
User lihat "CEO Budi Santoso" di inbox, tidak cek actual email address.
</random>
✅ Defense: Employee training + email client yang show actual address + internal verification procedures untuk wire transfer/financial requests.
4. Account Takeover (ATO)
Attacker mendapat akses ke email account legitimate (phishing, credential stuffing, breach).
Step 1: Phish employee dengan fake login page
Step 2: Dapatkan credentials
Step 3: Login ke email account
Step 4: Kirim email "internal" ke finance untuk wire transfer
Step 5: Atau: Reset password customer, takeover account
✅ Defense: MFA wajib, anomaly detection (login dari lokasi/device baru), session monitoring, least privilege access.
5. Supply Chain Attack via Email
Compromise vendor/partner untuk kirim malicious email dengan trusted domain.
Attacker compromise: [email protected]
Kirim: Invoice "update" dengan malware attachment
Ke: [email protected]
Dari: [email protected] (legitimate, compromised)
✅ Defense: Vendor security assessment, attachment sandboxing, email authentication verification, out-of-band verification untuk payment changes.
6. Business Email Compromise (BEC)
Target: Financial fraud melalui social engineering email.
From: [email protected] (spoofed atau compromised)
To: [email protected]
Subject: URGENT: Wire transfer untuk acquisition
Body:
Saya di meeting confidential. Transfer Rp 2.5 Miliar ke:
Account: 123-456-789
Bank: [Attacker controlled]
Jangan diskusikan dengan siapapun. Segera.
[Sent from iPhone]
✅ Defense: Verification procedures (phone call untuk transfer >threshold), DMARC strict, financial controls, employee training.
🛡️ DMARC sebagai Security Control (Bukan Cuma Deliverability)
DMARC adalah single most effective defense terhadap direct spoofing.
| Policy | Security Level | Attack Prevention | When to Use |
|---|---|---|---|
p=none |
Monitoring only | 0% — attacker free pass | Initial setup, testing |
p=quarantine |
Medium | 70% — masuk spam folder | Transition phase |
p=reject |
Maximum | 99% — outright rejection | Production, financial, healthcare |
Advanced DMARC: RUA + RUF + Forensic
v=DMARC1;
p=reject;
rua=mailto:[email protected];
ruf=mailto:[email protected];
fo=1;
adkim=s;
aspf=s;
pct=100;
rf=afrf;
Parameter keamanan:
adkim=s; aspf=s— strict alignment (domain harus exact match)fo=1— generate forensic report untuk failuresrf=afrf— authentication failure reporting formatruf=— real-time failure reports (immediate alert)
👁️ Security Monitoring & Threat Detection
DMARC Report Analysis
// Aggregate report (daily)
<<record>
<row>
<source_ip>192.168.1.100</source_ip>
<count>150</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>yourdomain.com</header_from>
</identifiers>
</record>
// ALERT: 150 emails failed authentication dari IP 192.168.1.100
// Investigation: Legitimate server atau attacker?
Anomaly Detection Rules
📋 Security Alert Rules
- Volume spike: >200% normal send volume dalam 1 jam
- Authentication failure spike: >10% DMARC failures
- New sending IP: IP tidak terdaftar di SPF mengirim email
- Geographic anomaly: Login dari lokasi tidak biasa
- Off-hours activity: Send/Login di luar business hours
- Lookalike domain registration: Domain mirip terdaftar
- Attachment type anomaly: Executable, macro-enabled docs
🚨 Incident Response Plan untuk Email Security
PHISHING DETECTED USING YOUR DOMAIN:
T+0 min: DETECT
├── Monitor alert: DMARC failure spike
├── User report: Suspicious email received
└── Threat intel: Lookalike domain detected
T+5 min: ASSESS
├── Scope: How many emails? Which recipients?
├── Impact: Financial? Data breach? Reputation?
└── Source: Spoofed? Compromised? Infrastructure?
T+15 min: CONTAIN
├── DMARC policy: Emergency p=reject (if belum)
├── Takedown: Report phishing site ke hosting provider
├── Blacklist: Submit ke Google Safe Browsing, PhishTank
└── Notify: Internal security team, legal, PR
T+1 hour: ERADICATE
├── Block malicious IP di firewall
├── Revoke compromised credentials
├── Patch vulnerability yang exploited
└── Forensic: Preserve evidence
T+4 hours: RECOVER
├── Communication: Notify affected customers
├── Verification: All systems clean
├── Monitoring: Enhanced untuk 30 hari
└── Review: What worked, what didn't
T+24 hours: POST-INCIDENT
├── Report: Full incident documentation
├── Improve: Update procedures, training
├── Insurance: Claim jika applicable
└── Legal: Compliance notification jika required
📋 Compliance: POJK, GDPR, dan Standar Industri
| Regulasi | Email Security Requirement | Penalty Non-Compliance |
|---|---|---|
| POJK (OJK Indonesia) | Authentication, encryption, audit trail untuk fintech | Sanksi operasional, denda |
| GDPR (EU customers) | Data breach notification 72 jam, consent tracking | €20M atau 4% revenue global |
| ISO 27001 | Email security controls, incident management | Certification revocation |
| PCI DSS | Email tidak boleh contain card data, encryption wajib | Fine, card processing revocation |
🔒 Security Audit Gratis
Evaluasi email security posture Anda: DMARC maturity, authentication gaps, threat exposure, incident readiness. Report dengan prioritized remediation roadmap.
Audit Keamanan Email Saya →❓ FAQ: Email Security
Apakah DMARC p=reject 100% efektif?
▼
Hampir, tapi tidak sempurna. DMARC hanya protect domain yang terproteksi. Attacker bisa pakai lookalike domain. Also: forwarding services bisa break DMARC. Layer dengan monitoring dan user education.
Berapa sering review DMARC reports?
▼
Daily automated parsing, weekly human review. Forensic reports (ruf) immediate alert. Aggregate reports (rua) weekly trend analysis. Gunakan DMARC analytics tool untuk automate.
Apakah email encryption (TLS) cukup untuk security?
▼
TLS protect transit, bukan content. End-to-end encryption (S/MIME, PGP) untuk sensitive content. Tapi: key management complex, adoption rendah. Balance: TLS wajib, E2E untuk financial/health data.
Bagaimana dengan third-party email services?
▼
Vendor risk assessment wajib. Cek: mereka support DMARC? TLS enforced? SOC2/ISO certified? Data residency? Contractual security requirements. Jangan asumsi "provider handle everything."
Employee training: seberapa efektif?
▼
Phishing simulation: 30-50% click rate sebelum training, 5-10% setelah. Tapi: decay dalam 3-6 bulan. Continuous training + simulated phishing tests quarterly. Make it easy to report suspicious emails.
