The diagram demonstrating the attack shows DMARC fails. All they have shown is that everyone should have DMARC configured properly, and use a reject or quarantine policy. This has been best practice for a long time now.
They use the example of state.gov. That domain's policy is currently set to Reject, which is what all Federal government services have been using for years now.
Here's CISA's requirements:
https://www.cisa.gov/news-events/directives/bod-18-01-enhanc...
Microsoft also uses their own auth mechanism in addition to DMARC. It's called composite authentication. In my experience, comp-auth is more strict than DMARC alone.
https://learn.microsoft.com/en-us/microsoft-365/security/off...
What am I missing? Why is this noteworthy?
EDIT:
After reading more of the paper, my conclusion is mentioned in a later reply:
"They are demonstrating a problem with managed providers, and their opinionated configuration. You give up a lot of control as an admin when you use 365 as your front-end. This further proves that. "
They use the example of state.gov. That domain's policy is currently set to Reject, which is what all Federal government services have been using for years now.
Here's CISA's requirements: https://www.cisa.gov/news-events/directives/bod-18-01-enhanc...
Microsoft also uses their own auth mechanism in addition to DMARC. It's called composite authentication. In my experience, comp-auth is more strict than DMARC alone.
https://learn.microsoft.com/en-us/microsoft-365/security/off...
What am I missing? Why is this noteworthy?
EDIT:
After reading more of the paper, my conclusion is mentioned in a later reply:
"They are demonstrating a problem with managed providers, and their opinionated configuration. You give up a lot of control as an admin when you use 365 as your front-end. This further proves that. "