1. DMARC@ICICI Bank ReBIT - Operational Excellence Webinar Series (DMARC)
Bhavin B. Bhansali
DGM, Information Security Group, ICICI Bank Ltd.
May 11, 2017

2. Common email frauds Phishing Business email compromise Ransomware
Data breach
Scams
Ransomware

3. …and email spoofing makes it more legit
spoofing is the forgery of an so that the message appears to have originated from someone other than the actual source

4. DMARC in action
DMARC - Domain based Message Authentication, Reporting & Conformance

5. Benefits of DMARC Email protection using DMARC Increase in
Customer & employee protection against frauds
Customer trust
Insight to evolving threat landscape
Reduction in
Senior mgmt. escalation
Bank’s liability for phishing s
Customer service cost
Phishing fraud/remediation cost 5 5

6. Pre- DMARC phishing sample email (1/2)6 6

7. Phishing website

8. Phishing email sample (2/2)
Source - 8 8

9. Phishing website
Source - 9 9

10. Approach for DMARC implementation
Domain identification
Identify all cust. domains
Identify the key domains from cust. risk perspective
Seek confirmation from all business units on outsourced arrangements
DMARC implementation
Move to DMARC monitoring mode
Ensure DMARC record is implemented for all mail servers sending s for the domain
Move to DMARC quarantine/block mode
Integration with monitoring controls
Integrate DMARC data feeds with anti-phishing process
Integrate DMARC data feeds with Fraud Management System/SIEM

11. Key learnings - DMARC implementation
Ensure appropriate collaboration of implementation, & biz teams @
Ensure outsourced service arrangements are inventorised
Update the domain induction process
Review the evolving modus operandi of fraudsters
Regularly review that no genuine s are blocked
“Best things come in small packages”

12. Post-DMARC phishing email

13. Thank you (bhavin.bhansali@icicibank.com)