1 / 25

Secure Email for organizations.

Secure Email for organizations. Making secure email a reality for large enterprise organizations. Understanding Email. Electronic mail, or email, lets you communicate with other people on the Internet. Email is one of the basic Internet services, and by far the most popular. .

wyman
Télécharger la présentation

Secure Email for organizations.

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Secure Email for organizations. Making secure email a reality for large enterprise organizations.

  2. Understanding Email • Electronic mail, or email, lets you communicate with other people on the Internet. Email is one of the basic Internet services, and by far the most popular. . • Inherently email is not secure, like open postcard being sent over the internet – every ISP can dump and read data. • Initial Email RFC was written for communications in a LAN. • Securing email was not considered in the early plans and implementation.

  3. Email threats and challenges. • Spoofing - any user can pretend to be another user • Eavesdropping – any ISP or network aware person can watch content • Validating author / content – There is no simple / inherent way to identify sender or sender’s server • Dangerous content – worms & viruses (I love you?) , phishing (Your credit card account expired?) • Annoying content – spam, junk mail, loop mail (healthy hair, sexual content) • Directory and privacy protection (identify users by directory search)

  4. Counteracting the threats. • Spoofing : Sender ID and SPF framework identifies sending domain with valid servers. S/MIME helps sign the email with private key and provide corresponding public key. • Validating content / author: S/MIME provides both but at an individual user level. • Dangerous content: Most email scanners can provide either external or internal scanning against known threats.

  5. Counteracting the threats (2) • Annoying Content: Most spam scanners and filter provide you with ability score and rate email and find spam using multiple techniques: (see later on spam scanning techniques) • Directory / protection and privacy: Most email server software provides you with directory harvesting protection and securing your backend directory from attacks.

  6. Approach to secure email • Encryption was introduced in email by PGP. – while a standard was still being discussed for SSL/TLS • PGP provides personally signed and trusted email network and provides end to end encryption • With signed and certified email threats such as worms and viruses are less likely.

  7. PGP or not? • PGP puts the full responsibility of encryption at user level – this is powerful but hard to manage. • PGP also requires client software that can encrypt/decrypt messages and create a “trust ring” • PGP Verify that messages were actually sent by the claimed sender and that messages have not been tampered with or altered. • PGP puts the user in full-control

  8. What is S/MIME? • S/MIME was originally developed by RSA Data Security Inc. The original specification used the recently developed IETF MIME specification with the de facto industry standard PKCS #7 secure message format. • Functionally S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption).

  9. S/MIME useability • Most email clients upport S/MIME (Outlook, Express, Thunderbird, Mac OS X Mail, Lotus Notes) • Before S/MIME can be utilized in any of the above applications, one must obtain and install an individual key/certificate from CA (Certificate Authority ) • Encryption requires having the destination party's certificate (public key) on store

  10. S/MIME key management. • Key management , revoking certificates and trust is hard to manage • Handling unmanaged clients. • Handling web roaming clients (internet café) and thin clients (PDA, Palm) • Lost or stolen PC hassle of identifying and checking keys.

  11. Server side encryption techniques • Server to provide encryption for client using mechanism such as https (e.g. imaps). • Server to Server encryption via STARTTLS or IPSEC-trust or opportunistic IPSEC • Server encrypted hard drive to save transient email (spooling) • Server encrypted mailboxes (Some email servers can do this natively – Lotus Notes)

  12. Serverside identification techniques. • SMTP-Auth with SSL to identify senders with secure tunnel. Client has to trust servers certificate. • Yahoo’s domain keys technique http://antispam.yahoo.com/domainkeys • POBOX sender-id (version 1) Microsoft’s sender-id (version 2) http://www.microsoft.com/mscorp/safety/technologies/senderid/default.mspx • Message-id verification proposed by PSMAIL

  13. Server-side anti-spam/anti-virus tools • Antivirus should provide quick turn around and smart or heuristic analysis – zero-day/zero-hour techniques to handle viruses. • Antivirus should also catch spyware / botware and worms • Antispam should use multiple techniques : Bayesian filtering, keyword detection, protection against Bayesian poisoning, lexi-graphical analysis of emails, sender ID, SPF v1 and v2 violations, random word detection, message checksum through non-bayesian techniques (e.g., DCC, Razor, database), source IP, Header detection, improper SMTP behavior, DNS blacklist, language analysis.

  14. Server-side anti-spam/anti-virus tools (2) • Antimalware and antiphishing techniques: detection of URL obfuscation, format strings in URL, URL encoding, detection of Uuencoded/base64 messages, file and filename in attachments, null email body, null text alternate message body, null space or hidden files, registry covert files, Iframe vulnerability testing, CLSID attachments, long filename /URL / headers and double extension attachments • The antispam and antivirus gateway should be able to provide custom configuration for incoming and outgoing email scanning. Both incoming and outgoing emails should be configurable independently for both viruses and spam and set independent actions. (see a sample RFP at http://info.psmail.net/dynamic/whitepapers/sample-rfp.rtf )

  15. Providing end-to-end protection. • Defense in depth – • Layers of defense for both servers and clients. (see picture next slide) • Add intrusion prevention device into the mix – stop network level threats • Allow incoming email to be encrypted and scanned for spam / virus (use STARTTLS proposal with 2048 –bit private key and SSL)

  16. Providing end-to-end protection. (3) • Provide server side certificate signed by a third party – Verisign / Thawte / Geotrust. • Use STARTTLS for communications between scanners, backup MX And secondary MX Scanners. (if not possible use IPSEC network layer encryption). • Use many techniques to protect against spam – some popular ones are listed below.

  17. Providing end-to-end protection. (4) • Greetpause / Greylist – check for improper SMTP behavior. • DHA (Directory Harvesting Attack), - protect by recipient verification and tarpitting attacks for recipient attacks. • Keep AV updated every hour with signatures. • Use SMTP-AUTH with SSL to protect and verify identity of senders. Use PSMAIL proposed message-id schema to verify senders.

  18. Providing end-to-end protection. (5) • Scan outgoing mail for virus and spam as well and verify no local user has violated trust or compromised access. • Use STARTTLS client mode for outgoing email to be signed communication by the server to remote servers when available • Use servers private key to initialize STARTTLS to remote hosts. • Verify STARTTLS server signing authority and build SSL signature into headers.

  19. Sandwiching a suitable solution. • Finally the solution turns back where ID-Management is pushed back to the server and the server becomes responsible for client ID Management. • A win for all. A suitable solution for LAN based authentication and concentrate on server to server authentication. • Identity Management has been argued for both server-to-server architectures and client-to-server and client-to-client.

  20. Debating identity management. • The structure and approach the consultant from PSMail recommends uses client-server and server-server ID management. • Servers can solidify and verify the clients identity. • Server can verify the remote server’s identity as well. This approach requires less management for the client and transparent usage for the client.

  21. Software tested for this approach in securing emai. • Postfix or Sendmail from www.postfix.org , www.sendmail.org as the MTA • Lotus Notes, MS Exchange or commercial sendmail as the Mailstore. • Scanning software Mailfrontier , Ciphertrust, CanIT, Barracuda provide you with reliable scanning MTA • Intrusion prevention is best handled by hardware IPS like Tippingpoint, StillSecure products.

  22. Conclusion and ideas • Secure email is a reality for organizations by offloading management to IT staff • Client workstation security is not covered in this report. • Mailstore is being used as a database for holding large amount of data (Gmail for example) – encrypting filestore is almost necessary

  23. Sample stats for University of North Carolina on SPAM / VIRUS

  24. More reports and notes. • Making your service & network architecture stable and secure is my job

More Related