The Hardened Stack — Ep. 8: Email Security
From Holding the Line: Practical IT Security · 00:27:03
Show by SECURITIES
Welcome to Episode 8 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.Unlike a firewall that can default to denying all incoming traffic, email is designed by definition to accept messages from strangers. This makes email the single most common initial entry point for cyberattacks. In Chapter 8: Email Security, we break down how to secure an open communication channel without breaking business operations. We demystify the core trio of email authentication—SPF, DKIM, and DMARC—and walk step-by-step through a safe, phased DMARC rollout that moves from monitoring to full rejection without accidentally blackholing legitimate company invoices.What You’ll Learn in This EpisodeThe 4 Primary Email Threat Shapes:SPF (Sender Policy Framework): Authorizing specific IP addresses and mail services (spf.protection.outlook.com) via DNS TXT records, avoiding the 10-lookup limit, and publishing v=spf1 -all on unused or parked domains.DKIM (DomainKeys Identified Mail): Adding cryptographic digital signatures to outgoing mail headers via selector DNS records (selector1._domainkey...) to ensure tamper-evident delivery that survives email forwarding.DMARC (Domain-based Message Authentication, Reporting and Conformance): Forcing domain alignment between the visible From header and underlying SPF/DKIM domains, and establishing aggregate feedback loops (rua).The 3-Stage Safe DMARC Rollout:Defender for Office 365 Protections: Enabling click-time link rewriting (Safe Links), attachment sandboxing (Safe Attachments), anti-impersonation protection for key executives, and blocking automatic external email forwarding rules.Turning People into Sensors: Why BEC requires non-technical process controls (such as a mandatory second signatory for payment detail changes) and a one-click, non-punitive reporting button.At Meridian Foods: How network engineer Omar Haddad conducted a smooth 6-week DMARC rollout, and how an alert accounts-payable clerk stopped a convincing fake-CFO invoice request from David Chen by reporting it to service desk lead Lucy Fernández.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.
More episodes of Holding the Line: Practical IT Security
More episodes
- The Hardened Stack — Ep. 9: Secure Development and DevSecOps
- The Hardened Stack — Ep. 10: Secrets and Key Management
- The Hardened Stack — Ep. 6: Securing the Cloud (Azure and AWS)
- The Hardened Stack — Ep. 7: Microsoft 365 and Entra ID Security
- The Hardened Stack — Ep. 5: Network Security and Zero Trust
- The Hardened Stack — Ep. 3: Identity and Access Management
- The Hardened Stack — Ep. 4: Endpoint Hardening
- The Boardroom Firewall (Ep. 12) — Ransomware: The Decisions You Will Face
- The Boardroom Firewall (Ep. 13) — Incident Response and Crisis Communications
- The Boardroom Firewall (Ep. 14) — Cyber Insurance — What It Does and Doesn't Cover
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.