[Music]
okay
oh
all right hi i'm joe cicero and my talk
is going to be digi marsack or digital
marketing security
uh so today i'm going to cover a little
bit about the title um a little bit
about me just a small amount a little
bit about how the presentation came to
be
i'm going to talk about the red flag
concept and then i'm going to talk about
digital marketing
practitioners emails and digital
marketing practitioners domain ownership
all right so when i first thought about
this talk um i thought all right i'll
name it marsek so i ran out obviously
like an i.t uh person
google marsep and what pops up is uh the
us coast guard uses marsec already for
maritime security so i thought all right
well that's not a very good uh name
uh additionally i looked uh i looked at
a couple other links and i see here this
company and satan has trademarked marsec
all right i don't know how to get away
with that with the coast guard using it
but i don't want to break any trademarks
so i probably wouldn't want to use
marsept
continuing on i thought all right well
i'm going to be talking about digital
marketing security so when i googled
digi marsec there were no hits and due
to the advanced seo optimization of the
cyphercon con
if you google use uh duckduckgo put into
yahoo or put in a bing digi marsack the
first hit is this conference talk so it
really works out from a marketing
perspective
all right so for the last four years
i've been a senior security engineer um
18 years prior to that i was a i.t
security instructor
that's all i'm going to talk about from
my background if you're interested in
going into the depths of my background
you can go to joecicero.com which will
redirect you to my linkedin page or you
can snap that qr code which will bring
you to joecicero.com which will redirect
you to my linkedin page
um the talk is only 25 minutes long i
guess there's nobody after me so we can
we can go a little bit longer i don't
think we will i've got it timed out
pretty good it's going to be a machine
gun presentation so i have 30 slides
rather than putting bullets in a slide
and talking about the bullets every
slide is a bullet that way it's a little
bit bigger for you to see and we can go
through it pretty quickly
okay so four years ago on my first
second third fourth day of work an email
comes in
user says the security engineering team
should look at this email comes to the
security engineering team the subject
it's a yahoo email address the subject
is urgent reply requested
the body of the email says i'm sending
this on behalf of someone else please
open up the attachment for the free
evening
seminar
like it's got every flag you could
possibly want to say this is a phishing
email well after a little bit of
analytic
examination we found out no it was a
legitimate email
and a co-worker and i coined the term
stupid legit i was like this is just
awful but i started with a marketing
degree and i looked at the marketing
perspective of that and i said boy these
people that are doing this they really
don't know
all of these things so i i started
looking into resources that i could give
my marketing department or other
marketing departments all these things
that they shouldn't do from an i.t
security practitioner's perspective and
there was nothing out there so what
you're going to see today is a
culmination of all that information that
i said time after time after time right
this is a real mistake that these
organizations are making and if they
wouldn't make this mistake they wouldn't
have friction
so
red flag concept if you're an i.t
security practitioner you should be
familiar with the red flag concept the
red flag concept is when something is
amiss something's wrong it's a red flag
now any normal email or any normal
website can have a red flag one may not
be enough for you to say i'm not gonna
i'm gonna i'm not gonna block this but
you start getting more and more red
flags and you start saying all right
something is terribly wrong with this
now i want you to think about the
environment we're currently in from an
i.t security practitioners
uh a perspective we've got a war going
on with russia and ukraine we've got
tensions with china we've got korea
we've got hacking organizations that
have taken over i'm in healthcare
six months ago 24 hospitals falling for
health care uh related phishing emails
we're on edge
so
red one red flag
from an i.t security practitioner's
standpoint might be enough to block the
marketing practitioner's email or the
marketing practitioner's website so
keep that in mind as we go through these
slides
all right so every slide i'm going to
get into the presentation now and every
slide is going to be broken up into
three sections the top section is what
i'm going to be talking about the
section on the right is going to be a
screenshot of a website that had data
that's backing up what i say so you
don't have to say well joe cicero said
this you could say he provided me with
all of the
criteria on why he was making these
decisions down at the bottom is going to
be the url that will allow you to go to
see that web page so you can say all
right it's 20 years old why am i looking
at this or yeah all right this was from
2021 and it's recent all right so let's
start the presentation off url
shorteners what is a url shortener for
those if you don't know url shorter
takes a very long url and shortens it
down to something that's memorable that
you can type
why would a marketing practitioner want
to use a url sharpener well it's more
memorable and easy to type
why would a bad guy or a malicious actor
want to use a url shortener
because there's high risk url shorteners
there on the right-hand side because
when that email comes into the user it
now
doesn't show the actual domain that
you're going to it's going to go to the
url shortener which is going to redirect
to some other website
you'll notice number one and number
seven there bitly and uh
tinyurl.com are used a lot well my
response to this is why are marketing
practitioners using url shorteners when
was the last time you got an email with
a url shortened url and then called
someone up and said let me read you the
url
right the purpose of these is done we
don't do that you got it in an email
you've got a link to click click the
link
and you don't use the url shortener
besides
if size matters
the you are long url is better
all right tracking images what are
tracking images so marketers have
learned that you can take a one by one
pixel image and you can put it into an
html based email and when the user opens
up that email you now know the user
opened up that email why is the
malicious actor like that exactly the
same reason my email got through all of
the security mechanisms it needed to get
to to get to the user
now why is all this data meaningless
well if you are running a secure email
gateway it may have already visited that
link that
that pixel
making the marketing practitioner
believe that the email has been opened
when it has not
yet the email might be going through a
sandbox so the sandbox visits all those
links and so the marketing practitioner
who gets the information back oh someone
opened my email no nobody opens your
email that was a security mechanism that
was visiting that that link and so the
the no one did go to it
and then the third reason is if a user
is not viewing images in the email
they viewed your email but you don't get
alerted to it so the value of a tracking
image is very small it's a red flag for
the ik security practitioner so when you
use it we're looking at and saying is
this legit or not all right so for all
those reasons i would recommend to
marketing practitioners stop using the
tracking pixel or tracking image
all right what's a tracking link
tracking link allows a marketing
practitioner to s they provide you a
link
you get the email that link goes out to
one website that keeps track of
everything what browser were you using
what user agent were you using an email
what time did this happen
all of the data that marketers love to
get and then it sends you off to the
website
what do the bad guys do well they send
you links and i've seen them go through
eight other links so they'll send you a
link you that link is a legitimate
legitimate site it might be a
google drive it might be uh app.com some
microsoft website and that site
redirects you off to a credential
harvesting site or a malicious website
so the bad guys are doing exactly the
same thing
that's why the marketing practitioner
doesn't want to do this because for all
the reasons i talked about in the
previous slide this isn't going to
necessarily work for you you're not
going to get data back from the uh the
tracking link
i have a
few users that get marketing materials
every week
and every week they're blocked
and if i have time which i don't have a
lot of i want you to think about it
teams right i might have the time to go
say well i'll review that and then i'll
send it to the person so that they can
get to that otherwise they have to
create they have to go it gets blocked
they have to create a ticket they have
to that's making a phone call to the
service desk going through all that
process that ticket has to come to me do
you see all the friction here
like the marketing person wanted to get
you somewhere and you're never going to
get there so that's another reason you
want to stay away from the
the tracking links
all right this one i don't understand
fully
uh why would you get a blank email with
an attachment but it happens
with marketing material a blank email
comes in and the typical user is going
to that's had appropriate training is
going to say i'm not supposed to do this
i got a blank email i have to submit
that to the it security team the
security engineers have to take a look
at that so then it comes to us and we
have to go through a view and again this
is how much time and friction is this
causing that marketing material uh to
get to you if it's coming through the
i.t security department team
um
why might this happen there are a few
reasons why it happens legitimately one
is
multi-function scanners where you scan a
document and you send to email all right
that doesn't provide any body to the
email so someone gets an email they
don't know why it was a scanned document
another might be a phone what is it text
to email so somebody's using their phone
they're sending an email they send it
off to somebody at a corporation that's
that's looking at things it comes with
an attachment but nobody in the email we
get those all the time where we have to
do an investigation
if you look at the right side of your
screen you'll see no before has done
some research where blank emails often
come before business email compromise
attacks so if you're doing this as the
marketing practitioner understand that
the i.t security guy is going to look
and say i don't know if i want to allow
this creating a lot of friction
okay can spam requirements what are the
canned spam requirements so years and
years ago they the u.s government came
up with legal requirements for
unsolicited
marketing materials
if your email does not meet these
requirements it's categorized as spam
now if you listen closely to what i said
earlier it was uh
unsolicited marketing materials but how
many of you have gotten an email from
somebody
and forgot you requested
that happens all the time
so if you're an i if you're a marketing
practitioner
and you say well i don't have to adhere
to this because i can just send the
email out to these people because they
checked the box on a website that said
yeah i want the marketing materials and
it comes in
and one user submits it to the it
security team
and the security team reviews the email
and says
there's no
conspicuous or straightforward way to
unsubscribe therefore this email is
categorized as spam
then the it security practitioner blocks
it for the entire organization
so even if you had a legitimate email
that you were sending to somebody who
requested it if they forgot
that they requested it and it does not
meet these requirements your emails will
now be blocked for the entire
organization potentially depends upon
their policies my organization you're
going to get blocked for the whole
organization that's a whole lot of
friction for the marketing department so
you should be aware of the can span act
requirements and my recommendation is no
matter what you're sending and i'm
starting to see people do this you have
the requirements in the email even if
the user requested it you put that in
because you don't want to be blocked for
the entire organization
all right let's get into domains
free and cheap domains top-level domains
are friction they're a red flag for me
in some organizations a lot of these
free domains are just going to be
blocked and i'm amazed that i see
marketers using the free nom domains the
tkml gacf domains additionally things
like info and xyz that cost the marketer
five dollars instead of a dot-com that
cost them 15
right those are red flags for me they're
cheap and they're used by the bad guys
all the time and i'll look at it in this
environment i'll say i i don't even know
if i want to go there i don't even know
if i have time to research it all right
so you should be aware that cheap and
free domains are a mistake from the
marketing practitioner's standpoint
so here's my freenom uh
uh interface and i thought oh ml is a
lot like mill so i went out and i
registered united statesmarines.ml
anybody got guts enough to go to that
qr no one
all right i gotta freeze
is it working
is it redirecting you no it's not no
that's because it's a free service why
would i expect a free service to work
good catch
all right if if you want to see one work
you can go to digimarc.ml
and that one will actually work but
something's going on on the freedom site
that they won't let you take because i
used to well i originally i originally
had united states marines.ml united
states navy.ml and i took them all i was
like oh they're all there and they're
all free i'm going to suck them all up
and i'm going to redirect them to my
linkedin page and they lock me out of my
account
all right so something else you should
know from from a marketing perspective
side right free and cheap resellers are
a huge mistake
so uh
you'll look on the right-hand side this
is something i would expect the
marketing department to do we're gonna
register a domain if you're not dealing
with the it department to do this uh go
out and find out which ones are used by
bad people the most and don't use those
so if you see here there's a list on the
right hand side top that's probably top
10 malicious domain registrars the one
that i run into the most is namecheap so
right in the middle that was a different
website a different website provided me
oh yeah namecheap is a bad one uh sure
you got a cheaper domain but you have to
understand
that's going to cost you from the
perspective of getting that domain
through the it security department to
look at that in use here you'll see
morgan stanley.com legitimate domain
registered spoofed slash lookalike
domain morgan
samly.com i can say right t and the s
reversed and where was that registered
namecheap and on a regular basis when
i'm reviewing websites or trying to
doing my it security work i'm seeing
namecheap and others other cheap free
resellers being used and i'm telling you
from a ig security standpoint to the to
the marketing practitioner that is a
mistake pay the extra ten dollars
all right pre-owned domains this is
something that the marketing
practitioner may not even think about
pre-owned domains
can be a red flag so you're out looking
for a domain you know all those domain
registrars say just type your domain
here and we'll tell you whether we we
have it and if they don't a lot of times
they'll say hey guess what
we can you can buy that one this stuff
so i'm in healthcare i'm not with
prevail but preview was very close to
prevail so i wonder what preview how
much per deal cost that's that that's
going to cost you 10 000
uh what might that domain have been
categorized as previously well if you
look here you've got
malicious website shopping advertising
and back to phishing so think about that
you purchase a pre-owned domain the
marketing practitioner may not even
realize that you don't check hey what
has this site been categorized as
previously by the
the
web filtering software that's out there
and all of a sudden you buy a domain
that's been categorized as phishing or
malware is the is the i.t security
practitioner going to let that through
probably not you're done you're done in
a wood so so think about that if you're
considering buying a pre-owned domain it
might be already categorized as
something which would cause friction
all right 10 years ago i would have
changed my answer on this but now that
i'm on the blue team
things change so who is data for those
of you that don't know who who is data
is when you purchase a domain you can
register it under your name or you can
check a box that says hide all my data
and 10 years ago 15 years ago i would
say i don't know you check that box you
don't want any of that out there well on
the blue team side i want to see a
corporate entity that owns a domain now
why does that happen
you have a primary domain and then you
have somebody for marketing that's going
to buy up a bunch of other domains
except they don't register them with the
same company
they don't so they have a different
registrar or they put different data in
there and now i have a hard time
understanding whether or not is this
really owned by this company or not so
you want to be consistent with
purchasing these things and you and it's
a it's a best practice for you to have
your domain registrar information go to
a corporate entity
all right this is another thing that i
would not expect a marketing
practitioner to know
newly registered and newly observed
domains
by best practice are blocked so you're
thinking about doing this marketing
campaign ooh let's go out and buy a
domain and i've seen
examples where where employees buy the
domain another department buys the
domain
they don't think about any of these
things and then they just redirect it
where they want to redirect it and i've
seen malicious actors do the same thing
so they do that and now all of that work
that they've done goes nowhere because
that domain is newly registered or newly
observed and it's blocked
in my organization we would pick up on
that right away right it would be a
block website what is this it's it's us
it's a spoof lookalike now i have to
make phone calls find out where did this
come from who owns this what is going on
here so other organizations that's not
going to happen right in my organization
that's easy i'm dealing with my people
but if your organization has done that
i'm going to look at that website and
say no this is not right something's
wrong here and again you have the
friction that you don't want as the
marketing practitioner
okay hosting companies now i'm getting a
little uh uh uh picky here but the
hosting company use where you put the
website what server you put the website
on that company
may be a red flag there is if you look
off to the right there is the top 10
malicious uh hosting companies
so another thing the marketing
practitioner wants to do is say where
are we hosting this and is this website
one of those that or is this hosting
provider one on this list or are they
are they on a list anywhere it would be
advantageous to not use hosting domains
that would be categorized by the i.t
security practitioner as a red flag
okay hosting ip this is a biggie so if
you're going to communicate you're going
to do hosting you've decided on a
hosting company one of the questions
that you absolutely want to ask them is
what is your ip space
because you can be blocked your the i.t
security practitioner can block a
website based upon domain name
and based upon ip address
and the software we use may do that
right it may be that i haven't i haven't
purposefully done that but some product
i'm using says uh malicious ip i'm going
to block that or malicious domain i'm
going to block that two different things
if you go purchase a website and they
put you on the same ip address with
hundreds of other malicious sites what
are the odds that the i.t security
practitioner is going to say yeah i'll
go ahead and open that up it's there
with 100 other malicious sites and i
have seen that i have seen where we have
one legitimate site and there's a
thousand websites on the same ip address
and hundreds of them were registered by
somebody that was malicious and they
have malware on them there's no way i'm
opening up your site to that that's the
friction you have to worry about so
domain hosting ip
new
as of a month ago so uh we got an alert
i think it was a cisa alert that csu.gov
saying you know what uh due to current
environments in russia and ukraine you
may want to geo-block
these countries
so while you probably are not hosting a
website in
ukraine and russia
unless you're ukrainian or russian
uh you're probably not a us company
doing that you might be hosting it
overseas somewhere and an organization
in the united states has said you know
what we're we're so afraid of this that
we're going to geofence to united states
based ips or u.s and canada-based ivs so
it's another consideration as a
marketing practitioner you have to have
to say okay
i don't think i want to i think this
hosting company is in the u.s we're
going to deal with uh u.s i'm sorry u.s
based hosting uh companies
and ips
all right the cms this is getting really
picky but i have a story we don't
remember these presentations we remember
the stories in the presentation so the
cms
the the content management system that
you decide to use for your marketing
website
can be a red flag
i had an organization or i had a user
contact me this website is blocked
i take a look at the website like all
right let's go over to virustotal oh
yeah firestone's got four or five things
that are saying it was a bad website a
little more research and i find the
exact links that had the malware on them
testing those links they don't exist
anymore they've been cleaned up they're
gone
however the website is a wordpress site
it was probably a hacked wordpress site
when one of the vulnerabilities for
wordpress came out but last week a new
wordpress vulnerability came out
what are the odds they're not patched
for that one
like that's up there
so what do i do as the i.t security
practitioner do i gamble and say oh it's
probably clean
i'll get fired
right so the marketing person has to
understand that if you're going to have
a website and it's going to be drupal or
wordpress or whatever that that website
has to stay up to date and it cannot get
hacked because the minute it gets hacked
you're going to start being on a list
and when you're on a list for me i can't
risk it
so think about those things when you're
when you're deciding on what cms you
want to use
all right https tls certificates so uh
let's encrypt was a good idea from a
privacy perspective but from a blue team
guy not so much as a security
perspective when i see a let's encrypt
certificate i naturally think
i don't it's a red flag now it might not
be a red flag that stops you
cold but that combined with other red
flags your website may not be getting
unblocked
in a little bit i'm going to talk about
uh uh actually it's this next slide so
https redirection
so i've run into organizations if you
want to do something cool go to
dnstwister.report
and put in the domain bank of america
what
dnstwister.report will do is show you
all of the iterations all of the spoofed
slash lookalike domains for bank of
america
and it'll tell you whether or not email
has been registered for that domain and
whether or not that domain is up and
running so that doesn't even exist right
it can twist it see is there something
out there with that name and show you
that so
so https redirection
if you buy a vanity domain
and a lot of companies will do this oh
we'll just buy that domain
junk dot healthcare i'll buy jump down
healthcare and i'll redirect it uh i'll
only buy it for this little reason and
then i'll redirect it back to my website
well that redirection
may not be in a secure manner if
somebody goes to jump down healthcare
that's going to be via port 80
and then it's going to redirect to your
secure website that's called uh uh it
instantly
am i in the right place insecure yeah
insecure that's called insecure
redirection so it will not redirect in a
secure manner
what then happens is you get yours your
cyber security score reduced for those
of you not familiar there's two
companies out there that are primary
companies one's bitsight the other
security scorecard for your organization
they will keep your security score well
that security score can be used by your
cyber insurance to decide how much
you're going to pay this year and cyber
insurance this year for many
organizations has increased 50 to 500
percent
so
the marketing department does something
that's going to cost the organization a
lot of money think about that https
redirection i have a slide in two more
slides that's going to cover a lot of
settings that you have to think about
all right website contents another thing
i want the marketing practitioners to
know is that before you set up the
website you should go and review scam
site red flags
one of our red flags if we go to a
website is is the contact page using a
free email service and i can't believe
how many are right you go to the domain
and then you click on a contact page and
it's a gmail account or a yahoo account
like that's a huge red flag is this site
legit or not
and we're trying to do things at the
speed of light right we need to get this
fixed so that we get on to the next
issue so
i highly recommend if you're setting up
a marketing website that you are aware
of what the scam sites use as
documentation for whether or not you
would be considered a scam site uh
free email services the contact is one
of the huge ones
all right so these are some of the
settings if you know i don't expect you
to see them and read them and i'm not
going to go through them all i only have
so much time uh uh but that bit site and
security scorecard these are the
settings that they will keep track of
that will look some of them that will
lower your score and cost your
organization more money from a i.t cyber
insurance perspective so you should the
marketing department should be aware
that and work with the id security
department to make sure that
you're getting the best grade that you
can get from these companies
okay holding releasing a domain i think
this is one of my last slides
so
i i
if you buy up these domains these vanity
domains
and
you create all kinds of links that go
back to them people create favorites on
them
and there and this campaign is working
great and then the campaign ends
and you release the domain
the domain can be picked up by a
malicious actor
for multiple purposes one is if you add
email to that domain they will be
picking up any emails because now it's
going to them
and the second is they can redirect
anybody going to those domains to
malicious sites
so
my recommendation is don't redirect the
domain back to your primary domain
redirect it to a part domain for several
years
yeah it's going to cost you 15 a year or
whatever it costs to keep a domain for
another couple of years but
your your
brand is not now going to be used
against you or against your clientele or
against somebody who google something
sees your brand in a link clicks on it
and now ends up on a malicious web page
so i highly recommend the domains you
own you develop a process that will
enable you to decommission that domain
redirect it to a domain park page it is
a best practice to block domain park
pages
leave it there for a couple of years get
all the web filtering uh uh
software packages
now categorizing it as domain parked and
then you're
good all right i want to thank you for
attending my talk i really appreciate it
nice nice audience out there and i want
to thank michael getzman and uh
cyphercon for having me
any questions
we hate marketers why are you telling
them
i gotta learn all right thanks everybody
[Music]
you