NZ Govt Leads Five Eyes On Critical Email Security Measure - New Study
by SMX Email · SCOOPNew Zealand is now leading the Five Eyes in protecting government emails from a cyberattack that could allow sensitive information to be intercepted before it reaches its destination, according to new research.
The SMX Email Security Report found 55% of New Zealand’s core government email domains actively enforce a critical security measure designed to protect emails while they are being delivered, compared with just 0.9% in the United States.[1]
The findings come as the Government shifts agencies from its ageing SEEMail system to the new Secure Government Email (SGE) framework, with the wider decommissioning programme due to be completed by November.
An industry expert warns significant gaps remain across the Government’s email systems and says an attack on an inadequately protected connection could expose information being exchanged between government agencies, businesses and members of the public while an email is being delivered.
Thom Hooker, co-founder of Auckland-based cybersecurity SMX Email, says the transition is also making the remaining weak points in government email security more obvious, describing the situation as a “shrinking pond” in which vulnerable domains stand out more clearly to attackers as more of the government network becomes properly protected.
Advertisement - scroll to continue reading
He says the findings mark a significant turnaround for New Zealand and show how a coordinated shift to modern email security standards has rapidly strengthened protection across the Government’s digital infrastructure.
“New Zealand has spent years playing catch-up in some areas of email security, particularly against Australia, but in this instance we’re actually leading the way.”
The research examined 1,940 domains within the official government namespaces of New Zealand, Australia, the United Kingdom, Canada and the US, comparing the extent to which each country had adopted measures designed to protect email as it moves between computer systems.
The protection being measured, known as MTA-STS, is designed to make sure emails sent to government agencies travel over encrypted connections to legitimate mail servers, making it harder for an attacker to interfere with a message while it is moving between systems.
The research found 66 of New Zealand’s 120 core government domains, or 55%, were actively enforcing the protection, compared with 46.9% in the UK, 15.3% in Australia, 0.9% in the US and none of the Canadian government domains measured.
Hooker says the shift is significant because government email can carry sensitive information relating to individuals, businesses and public agencies, while the remaining gaps become more obvious as the overall level of protection improves.
“As more of the Government’s email environment is secured, the remaining gaps become easier for attackers to identify, which means you don’t want to leave part of the estate behind.”
The study found New Zealand does not lead the Five Eyes on every measure of email security, with Australia, the UK and US ahead on DMARC, a separate protection designed to stop criminals sending emails that falsely appear to come from a government agency.
About 66.7% of New Zealand’s core government domains enforce DMARC, compared with 90.3% in Australia, 84.5% in the UK and 83.3% in the US, while Canada was at 20.5%.
Hooker says the two protections tackle different weaknesses and are most effective when used together.
“One helps establish whether the sender really is who they claim to be, while the other helps make sure the email gets to its destination securely, so you need both.
“The US has one of the strongest records in the Five Eyes for stopping forged government email but almost no adoption of enforced transport protection, while New Zealand is combining relatively strong performance across both measures.”
Hooker says the impact of the SGE rollout is likely to extend beyond central government as the standards flow through to other public sector organisations and businesses that exchange information with government agencies.
“No Five Eyes country has finished the job across every measure, but New Zealand is now closer than most to having both sides properly covered,” Hooker says.
The source reports can be found here and here
Notes:
[1] The analysis was conducted using publicly available DNS and HTTPS information from government domains across the Five Eyes countries. SMX Email assessed the deployment and enforcement of email security standards including DMARC and MTA-STS. No government systems or data were accessed as part of the research.
About SMX Email
SMX Email is a New Zealand-owned specialist cloud email security company providing services designed to protect organisations against threats including email impersonation, interception, phishing and other malicious activity. The company has monitored email security standards across the Australasian market since 2022 and publishes annual research tracking the adoption of technologies including DMARC and MTA-STS across government and business sectors.
Advertisement - scroll to continue reading