How an I prevent spoofed email using IronPort C160?

Question

As part of Security Awareness training and testing we contracted a company called knowbe4 to initiate some random spoofed e-mail tests into our domain.  Normally I would have figured this would fail because when email comes into the C160 and it has our @domainname.com on it, it needs to validate the DKIM signature, and if it was not sent from our organization, IronPort would not have signed it, correct?
Anyway the security awareness organization was able to successfully send an e-mail inbound and make it appear as if it came from [email protected] (which we do not have a mailbox with that name, but I'm sure he certainly could have done research and used our real CEO's email address.).  In Outlook it does appear as [email protected] in the from box, but when you search message tracking for emails coming from that address you get nothing.  Upon further inspection of the e-mail headers, the message actually came from bounces+78188-4be9-username=[email protected]  So it matched policy DEFAULT for inbound mail policies and eventually it was successfully signed with domain key profile and DKIM profile matching [email protected], then queued for delivery.
How can an email arriving from one server "morph" into another?  Is there some sort of vulnerability that this organization is taking advantage of, perhaps some kind of active script that the IronPort ends up acting upon to alter the email address and sign it so it passes through?  This was a test today, but we need to plug this hole because the bad guys are going to use this technique to make phishing emails look legitimate coming from internal users.

Answer 1

I use knowbe4 as well, great phishing test templates, and what I found to work best to fight Domain spoofing are the following:
- Implement DMARC/SPF/DKIM DNS records and keys - You will want to set these to passive initially. I personally recommend using dmarcian.com they have tools to help with implementation. Initially you will just want to be in monitor mode then start suggesting actions that gateways should take based on your DNS records. (This will protect your domain from being spoofed to gateway or provider that has DMARC/SPF/DKIM enabled)
- Maintain your DNS SPF records (these are to used to help you authorize who can send emails from as your domains)
- Here is a good how-to video for configuring your appliance to block domain spoofing. You will want to add any providers you want to allow to spoof such as ADP, training, and other third party vendors that generally spoof your domain to send emails to your employees. https://supportforums.cisco.com/video/11932126/configure-spoof-protection-exception-lists
- Create a second mail flow policy similar to your allowspoof one, but turn off spam filtering, I called mine KnowBe4.
- Create a new HAT and call that KnowBe4 and point it to the new policy. Add all the Knowbe4 or who ever your phishing simulation provider is to this HAT table. I suggest adding a description so you will know which ones to delete later on.
You should now have taking care of e-mail spoofing, you will want to monitor this closely. Also if you are using Email Encryption you need to make sure the vendor's (even if using Cisco) gateways are added to your SPF record and your HAT table AllowSpoof list.
Finally I would recommend enabling DMARC feature in your appliance, this will help filter out and report to email providers and gateways who is spoofing their domains, it will also increase your filtering power, but it does not stop all spam just one more thing to eliminate low hanging fruit.
Knowbe4's test phish is a good way to test for spoofing, and your employees.