ComputerScienceExpert
$18/per page/
THE ANSWER IS ATTACHED PLEASE DEVELOP IT AND PUT IT TOGETHER.
Prepare a paper that explains how e-mail messages can be securely sent. The paper should include the features of secure e-mail and how secure e-mail works. Include a discussion of vulnerabilities involved in e-mail and how they can be countered. The paper should include the following:
Be sure to document your references using APA format.
1 Running Head: E-mail Security American Inter Continental University Houston Texas
Kenneth Omaide
Introduction to Information assurance and information security Running Head: E-mail Security 2 There are three main e-mail problems: viruses, spam, and phishing.
Virus
Viruses attach to files so e-mail file attachments are a very easy way to spread viruses.
To mitigate this, you'll want to install anti-virus software on every system. You'll also
want to install anti-virus software on the e-mail server itself to scan attachments as well.
Best practice would be to detect viruses in the messages on the e-mail server before it
gets to the client, and then send warnings to the recipient to warn them of the malicious
e-mail. All kinds of malicious software or Malware could be attached to an e-mail, but be
aware it's not possible to perform any kind of scanning or password cracking via e-mail. Spam
Spam is unwanted, unsolicited e-mail sent to many recipients. It can be as benign as
trying to sell products like discount prescription drugs, or it can be malicious, with
phishing scams, drive-by downloads, and Malware. Spam can contain Malware as
attachments. Even when benign and deleted safely though, spam is still considered a
problem because it wastes a lot of bandwidth. To prevent spam on a client system, you'll
want to install anti-virus software, and install anti-spam or junk mail filtering software on
the client. Anti-Spam filters usually have pre-defined levels of security, but you'll want to
watch out for false negatives, where your legitimate e-mail might accidentally be sent to
the junk mail folder, because often junk mail folder has automatic deletion set up within Running Head: E-mail Security 3 a certain period of time. With anti-spam/junk mail filtering, you can also set up white lists
and black lists. On the client, you'll also want to disable the preview screen to prevent
auto preview of e-mails. This is because e-mails can have embedded links that can
automatically notify spammers that the e-mail address was valid. Now they know your
e-mail address is valid and will send you more e-mail. Preventing Spam on an E-mail Server
So, disable that preview screen.
To prevent spam on an e-mail server, again, install anti-virus software and install server
level anti-spam software. Much like the client side software, server level anti-spam
software has pre-defined levels of security, you could set up white lists and black lists,
but it's going to have a lot more features. As an example, if users are receiving
unsolicited e-mail from the same e-mail address, you can add that e-mail address to the
black list on the e-mail server. Closing Open SMTP Relays
Another strategy to prevent spam is to close open SMTP relays. SMTP Relay is
designed into e-mail servers, and allows them to forward e-mail from one server to
another. But, open relays are the most common method for attackers to send spam to
e-mails and spoofed e-mails. Running Head: E-mail Security 4 You can use a third-party mail relay, but a disadvantage of that is that spammers can
utilize the relay. If an ISP determines that spam is being relayed off one of your e-mail
servers, you can get blacklisted and not be able to send e-mail at all.
Preventing Open Relays
So, to prevent open relay, be sure to use strong authentication for your SMTP servers,
disable anonymous relays. Repudiation Attack
In addition to spam, another kind of attack on open relays is called a Repudiation
Attack. This is where someone accesses your e-mail server and sends inflammatory emails to other people. Well, what they're doing is spoofing the e-mails so it appears that
they come from you. Using S/MIME to Secure E-mail
And finally, if you'd like to secure your e-mail, you can use something called S/MIME.
S/MIME is a protocol that allows users to send both encrypted and digitally signed email messages. E-mail is by default clear text. Using Pretty Good Privacy (PGP) to Secure E-mail Another very popular solution for securing e-mail is PGP, Pretty Good Privacy. It's been
around a long time and it uses an asymmetric encryption scheme for security. The most
significant flaw in PGP is that the user must trust public keys received from other users Running Head: E-mail Security 5 and other entities. PGP is a peer-to-peer system, there's no root CA, or trusted CA
hierarchy, you must simply trust the other users using the system. PGP uses something
called a Web of Trust to establish authenticity in this decentralized system. There are also four main features of a secure e-mail are:
1. Confidentiality: Message encryption serves to ensure the substance of an email
message. Just the expected beneficiary can see the substance, and the
substance stay private and can't be known by any other individual who may get
or see the message. Encryption gives secrecy while the message is in travel and
away.
2. Integrity: Similarly, as with digital signature, message encryption gives
information honesty benefits accordingly of the particular operations that make
encryption conceivable.
3. Authentication: A signature serves to approve an identity. It confirms the
response to "who are you" by giving a method for separating that entity from all
others and demonstrating it's from a trusted source. Since there is no verification
in SMTP email, there is no real way to know who really communicated something
specific via message sent. Validation in a digital signature tackles this issue by
empowering or enabling a recipient to realize that a message was sent by the
individual or organization who claims to have sent the message.
4. Nonrepudiation: The uniqueness of a mark signature helps the owner of the
signature from repudiating or disowning the signature. This capacity is called
non-repudiation. Consequently, the confirmation or authentication that a mark
gives the way to enforce non-repudiation. The concept of non-denial is most Running Head: E-mail Security 6 natural with regards to paper gets: A signature contract is a legitimately restricting
report, and it is more hard to repudiate a verified mark. Computerized signature
give a similar capacity and, progressively in a few zones, are perceived as
lawfully official, like a mark on paper. Since SMTP email does not give a method
for confirmation, it can't give non-renouncement. It is simple for a sender to
repudiate responsibility for SMTP email message. Discussion of the 5-step process for handling secure e-mail with PGP and
S/MIME\
There are ways of making sure your email system is secure:
Secure the Mail Client: This should include patching and upgrading the mail client
applications, configuring the mail client security features, enabling antivirus, antispam
and antiphishing features, configuring mailbox authentication and access and secure
the host operating system.
• Implement Management Controls: There should be information security policies
and procedures and training for all employees in every agency or organization. • Things like risk assessments should be done.
Secure the Mail Server Application: Install a mail server service and keep it • updated by patches and upgrades.
Plain Text: When viewing e-mails you should use plain text instead of things like •
• HTML
Automatic Updates: Always use the latest version of the mail client software.
Do Not Unsubscribe: If you are constantly receiving e-mails from an unwanted
source, do not click on unsubscribe. This may take you to a place you don’t
want to be. Running Head: E-mail Security 7 Discussion of the vulnerabilities of e-mail
Email messages are by and large sent over untrusted systems external network that are
outside the organization security limit or boundry. At the point when these messages
need fitting security shields, they resemble postcards that can be perused, replicated. Since email is widely deployed, surely knew, and used to communicate with untrusted,
organizations, it is every now and again the target of attacks. Attacks can abuse email
to pick up control over an organization, get to secret data, or disturb IT access to
assets. Normal dangers to email system including the following.
1.
2.
3.
4. Malware
Social engineering
Entities with malicious intent
Unintentional act by authorized users. 5. Discussion of countermeasures that address the vulnerabilities
organization ought to introduce the minimal mail server administrations required and
eliminate any known vulnerabilities through patches, setups configuration, or upgrade.
In the event that the establishment program installs unnecessary applications or
scripts, these ought to be removed promptly after the installation procedures or process
is finished. Securing the mail server application for the most part incorporates fixing and
redesigning the mail server; arranging the mail server client verification and get to and
asset controls; designing, ensuring, and breaking down log documents; and
intermittently testing the security of the mail server application. Running Head: E-mail Security References
Rouse, M. http://searchsecurity.techtarget.com/definition/Pretty-Good-Privacy.
Retrieved on September 4, 2015
Brodeur, S, (November 19, 2014). http://www.windowscentral.com/what-smime-andshould-you-use-it. Retrieved on September 4, 2015.
Stine, Keven and Scholl, Matthew. “E-mail Security: An overview of Threats and
Safeguards.” Journal of AHIMA 81, no 4 (April 2010): 28-30. 8