The Definitive Guide to Email Management and Securityby Kevin Beaver
Learn the key steps for dealing with email threats and vulnerabilities! This eBook will provide a practical guide to increasing email security as well as give tips on how to deal with the growing dependence on corporate email. Kevin Beaver, information security expert, takes a close look at email security issues. From employee monitoring to dealing with spam, email security is a growing business concern and this eBook will give you the tools needed to effectively manage email and increase corporate security.
Chapter 1: A Look at Corporate Email Concerns
Email has long been hailed as the most popular Internet application. Although the Web tends to get the most attention and might be considered more useful and informational, thereâ€™s no denying that most 21st century organizations couldnâ€™t function properly without email. And what a nice upgrade email is from the telegrams and telephones that we have solely relied on in the past! Email allows us to communicate more quickly and conveniently. What more could we want from something that gives us the ability to communicate when itâ€™s convenient and makes us more productive in the workplace?
Chapter 2: Fighting Malware
In this chapter, Iâ€™m going to focus on malwareâ€”malicious softwareâ€”that affects email. First, weâ€™ll take a look at how the malware train got rolling and where itâ€™s headed. Weâ€™ll explore how email-based malware works, then finish up with some practical tips about how you can secure your email systems. The only place to start is at the beginningâ€¦
The roots of malware go back to 1949 when mathematician John von Neumann suggested in his paper â€œTheory and Organization of Complicated Automataâ€ that computer programs could reproduce. This science-fictional idea ended up being a very accurate prediction. In fact, only one year after this paper was released, before we experienced the first true computer virus, some employees at Bell Labs had already put von Neumannâ€™s theory to work in a computer game called Core Wars. It took several decades, but it 1981, the Apple II Elk Cloner virus, the first known computer virus, was released.
Chapter 3: Understanding and Preventing Spam
Spam: noun. 1. Commercial or other junk email sent without the recipientâ€™s permission. 2. Spiced, canned ham made by Hormel dating back to the 1930s.
Spam is a word with two very different meanings. For the purposes of this chapter, Iâ€™ll spare you the pig references and instead talk about spam as it applies to email in our daily business operations. This spam is sometimes referred to as unsolicited commercial email (UCE) or unsolicited bulk email (UBE). In fact, the two words unsolicited and bulk are what define spam. This definition can be expanded to include email jokes, hoaxes, urban legends, and so on.
Chapter 4: Email Content Filtering
Content filtering is one of the latest sexy buzzwords that we see and hear a lot about in IT. But what does it really mean? In a nutshell, content filtering describes the technologies and procedures required to permit or deny specific types of data from entering or leaving a network. In its most basic form, content filtering allows or disallows email or Web traffic via basic firewall rules. On the other end of the spectrum, content filtering could go as far as analyzing keywords or phrases within an email, determining what context theyâ€™re in, and, based on additional factors, stripping the sensitive words out of the message before sending it on to its destination. As Figure 4.1 illustrates, there are four generic types of content filtering.
Chapter 5: Email Security In-Depth
Email is one of our most critical business applications, but it is also one of the most vulnerable. Beyond malware, spam, and content filtering, another class of email risks affects how we deploy, use, and manage our electronic communications. This risk is partly due to the fact that email servers have to communicate with internal and external systems simultaneouslyâ€”all while housing some of an organizationâ€™s most critical assets.
Many useful resources provide technical theory about email protocols, information risk assessments, and encryption; Iâ€™ve included references to some of my favorite technical resources throughout the chapter. In this chapter, rather than focus on technical theory, weâ€™ll explore practical aspects of email security that you can immediately apply in your environmentâ€” assessing email risks, employing best practices for hardening servers and clients, and using incident response tools and techniques that can help you when your email system is attacked.
Chapter 6: Managing Email Effectively
Throughout this book, weâ€™ve explored several email management conceptsâ€”from thwarting off spam to monitoring employees. In this final chapter, the discussion will be more detailed regarding policies, user awareness training, data storage and backups, and data retention as they relate to email management.
Email used to be considered a casual method of communication; email messages are now being treated as true business documents. Email is slowly taking over the fax machine and telephone as the business communication medium of choice. Many organizations would be brought to their knees if their email systems were unavailable. Between the messaging, calendaring, and contact functions, many users simply want and need access to their email practically 24 Ã— 7 in order to function efficiently in their jobs.
Email message stores house the majority of critical intellectual property within todayâ€™s information systems regardless of the size of the company. As if this burden is not large enough for email administrators to bear, they must now ensure that their organizations adhere to strict federal regulations that affect every facet of email communication.
The retention of emails is becoming an increasing responsibility for organizations thanks, in part, to the corporate misdeeds of recent years in the United States. Larger companiesâ€”particularly those that are under intense federal regulationâ€”are taking email retention more seriously. As a result, the need for storage space as well as policies and procedures associated with email retention has become evident. The need to retain file attachments, deal with spam, provide unified message, integrate voice mail, enable access to videos and image files, and the sheer quantity of incoming and outgoing messages is causing many administrators to rethink their email system design and management.