1. Guide to Operating System Security Chapter 10 E-mail Security

2. 2 Guide to Operating System Security Objectives Understand the use of SMTP in e-mail and attacks on SMTP Explain how e-mail can be secured through certificates and encryption Discuss general techniques for securing e-mail Configure security in popular e-mail tools

3. 3 Guide to Operating System Security Overview of SMTP Enables exchange of e-mail across networks and the Internet Provides reliable – but not guaranteed – message transport No logon ID or password required A client and server process

4. 4 Guide to Operating System Security Sending E-Mail by SMTP

5. 5 Guide to Operating System Security Parts of SMTP Messages Address header  Envelope  Message header  Domain literal  Multihomed host  Host names Message text

6. 6 Guide to Operating System Security Overview of SMTP Protocols used to store and retrieve e-mail  Post Office Protocol (POP)  Internet Message Access Protocol (IMAP)

7. 7 Guide to Operating System Security Operating Systems That Use SMTP by Default Microsoft Outlook Express on Windows 2000/XP/2003 Microsoft Outlook in Windows-based systems that have Microsoft Office Ximian Evolution Mail in Red Hat Linux 9.x Mail in Mac OS X

8. 8 Guide to Operating System Security E-mail Server Software Systems That Use SMTP Eudora Lotus Domino Mail Server Mailtraq Merak Email Microsoft Exchange Sendmail SuSE Linux Open Exchange Server

9. 9 Guide to Operating System Security E-mail Attacks on SMTP Surreptitious alteration of a DNS server Direct use of command-line e-mail tools to attack SMTP communications Spread of unsolicited commercial e-mail (spam)

10. 10 Guide to Operating System Security DNS Server Directing E-mail

11. 11 Guide to Operating System Security E-mail Attacks Through Altering DNS Server Information

12. 12 Guide to Operating System Security Using Command-Line Tools for E-mail Attacks Windows 2000/XP/2003  Attacker can use maliciously constructed e-mail to attack an SMTP server UNIX/Linux  Easier; attacker can use built-in e-mail command- line options

13. 13 Guide to Operating System Security Unsolicited Commercial E-mail (UCE) Relatively inexpensive for sender Expensive for users whose resources are diminished by UCE traffic Expensive in terms of wasted time (estimated 25% of all Internet e-mail traffic is spam)

14. 14 Guide to Operating System Security Ways to Control UCE (Spam) Turn off open SMTP relay capability Configure SMTP server to have restrictions Require a computer to authenticate to Microsoft Exchange before e-mail is relayed Direct e-mail not addressed to internal recipients to a bogus IP address Obtain tools to block e-mail

15. 15 Guide to Operating System Security Securing E-mail Through Certificates and Encryption Ensures privacy Reduces chances of forgery or someone other than sender adding an attachment Accepted methods  Secure Multipurpose Internet Mail Extensions (S/MIME)  Pretty Good Privacy (PGP)

16. 16 Guide to Operating System Security Using S/MIME Encryption Provides encryption and authentication for e-mail transmissions An extension of MIME

17. 17 Guide to Operating System Security MIME Provides extensions to original SMTP address header information Different types of message content can be encoded for transport over the Internet Additional header fields  MIME-version  Content-type  Content-transfer-encoding  Content-ID  Content-description

18. 18 Guide to Operating System Security Using S/MIME Encryption Uses digital certificates based on X.509 standard Has flexibility to use 168-bit key Triple DES Designed to follow Public-Key Cryptography Standards (PKCS)

19. 19 Guide to Operating System Security Using PGP Security Provides encryption and authentication for e-mail transmissions Sometimes preferred by users of open systems (UNIX/Linux); enables use of X.509 or PGP digital certificates Unique characteristic of PGP certificate: web of trust

20. 20 Guide to Operating System Security Contents of PGP Digital Certificate PGP version number Public key Information about certificate holder Digital signature of certificate holder Validity period of the certificate Preferred algorithm for the key

21. 21 Guide to Operating System Security Typical Encryption Methods Used by PGP CAST IDEA Triple DES

22. 22 Guide to Operating System Security Other Techniques for Securing E-mail Train users Scan e-mail Control the use of attachments

23. 23 Guide to Operating System Security Training Users for E-mail Security Never send personal information or a password response via e-mail Delete e-mail from unrecognized sources Use message filtering, if available

24. 24 Guide to Operating System Security Scanning E-mail Place virus scanning software on e-mail gateway Update virus definitions frequently Quarantine specific kinds of attachments Scan zipped files Scanner code should be written to be relatively fast

25. 25 Guide to Operating System Security Controlling the Use of Attachments Delete attachments from unknown sources Never configure software to automatically open attachments Avoid using HTML format for opening e-mail Use virus scanner on e-mail before opening it Place attachments in quarantine

26. 26 Guide to Operating System Security Backing Up E-mail For storage To ensure that unread e-mail is not lost if server goes down

27. 27 Guide to Operating System Security Configuring Security in Popular E-mail Tools Microsoft Outlook Express Microsoft Outlook Ximian Evolution Mail in Red Hat Linux 9.x Mail in Mac OS X

28. 28 Guide to Operating System Security Microsoft Outlook Express Included with Windows 2000/XP/2003 Can obtain messages from SMTP-based servers running e-mail server software Can be used to access newsgroups

29. 29 Guide to Operating System Security Microsoft Outlook Express

30. 30 Guide to Operating System Security Security Measures Supported by Outlook Express S/MIME (version 3) 40-bit and 128-bit RC2 encryption 64-bit RC2 encryption 56-bit DES encryption 168-bit Triple DES encryption Digital signatures encrypted using SHA-1

31. 31 Guide to Operating System Security Configuration Options for Outlook Express

32. 32 Guide to Operating System Security Microsoft Outlook Express Enables you to export e-mail to Microsoft Outlook or a Microsoft Exchange server Can be used to back up messages from other systems Enables you to block or filter messages from unwanted sources

33. 33 Guide to Operating System Security Microsoft Outlook Included with Microsoft Office Has multiple capabilities  E-mail communications  Calendar  Ability to track tasks, list contacts, and make notes

34. 34 Guide to Operating System Security Microsoft Outlook Security Features S/MIME (version 3) 40-bit and 128-bit RC2 encryption 64-bit RC2 encryption 56-bit DES encryption 168-bit Triple DES encryption Digital signatures encrypted using SHA-1 V1 Exchange Server Security certificates

35. 35 Guide to Operating System Security Configuration Options for Microsoft Outlook

36. 36 Guide to Operating System Security Microsoft Outlook Ability to back up messages by exporting to a file (many file types available) Ability to add specific Web sites to junk e-mail list

37. 37 Guide to Operating System Security Ximian Evolution Mail in Red Hat Linux 9.x Processes e-mail Schedules activities on a calendar Records tasks Creates list of contacts Summary function (weather, inbox/outbox totals, appointments, updates and errata)

38. 38 Guide to Operating System Security Ximian Evolution Mail in Red Hat Linux 9.x

39. 39 Guide to Operating System Security Ximian Evolution Mail in Red Hat Linux 9.x Capability to configure more than one account with unique properties Can be configured to use either PGP security or GnuPG

40. 40 Guide to Operating System Security Configuration Options for Evolution Mail

41. 41 Guide to Operating System Security Apple Mail (Continued) Comes with Mac OS X Focuses on handling e-mail activities Enables creation of filters to reject mail from unwanted or unknown sources Capability to configure different accounts

42. 42 Guide to Operating System Security Apple Mail (Continued)

43. 43 Guide to Operating System Security Apple Mail (Continued) Uses PGP for security Can specify use of SSL for security over Internet links to e-mail Provides different authentication methods for verifying access to an e-mail account  Password authentication  Kerberos version 4 and version 5  MD5 challenge-response

44. 44 Guide to Operating System Security Summary How operating systems use SMTP for e-mail Sources of e-mail attacks  Over 90% of malicious software strikes through e-mail How certificates and encryption can protect e-mail How to configure security in e-mail software typically used with operating systems