Scribd Logo
Upload

Welcome to Scribd!

  • 44 views

    Email Security

    Uploaded by

    mgnanasekar
    The document discusses threats to email security such as message interception, modification, false messages, and replay. It describes how digital signatures and encryption can provide sender authenticity, nonrepudiation, message integrity, and confidentiality. The document outlines secure email systems like S/MIME and PGP that use these techniques. However, it notes that secure email is not widely adopted due to usability issues and that threats still remain.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd

    Email Security

    Uploaded by

    mgnanasekar
    44 views13 pages
    The document discusses threats to email security such as message interception, modification, false messages, and replay. It describes how digital signatures and encryption can provide sender authenticity, nonrepudiation, message integrity, and confidentiality. The document outlines secure email systems like S/MIME and PGP that use these techniques. However, it notes that secure email is not widely adopted due to usability issues and that threats still remain.

    Original Description:

    Tips and process for securing the emails in an organisation

    Copyright

    © © All Rights Reserved

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses threats to email security such as message interception, modification, false messages, and replay. It describes how digital signatures and encryption can provide sender authenticity, nonrepudiation, message integrity, and confidentiality. The document outlines secure email systems like S/MIME and PGP that use these techniques. However, it notes that secure email is not widely adopted due to usability issues and that threats still remain.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    44 views13 pages

    Email Security

    Uploaded by

    mgnanasekar
    The document discusses threats to email security such as message interception, modification, false messages, and replay. It describes how digital signatures and encryption can provide sender authenticity, nonrepudiation, message integrity, and confidentiality. The document outlines secure email systems like S/MIME and PGP that use these techniques. However, it notes that secure email is not widely adopted due to usability issues and that threats still remain.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    You are on page 1of 13

    Email Security

    Jonathan Calazan
    December 12, 2005
    Threats to Email
     Message interception
     Emails sent in clear text over the Internet.

     Message modification
     Anyone with system admin rights on the mail servers
    your message visits can not only read your message,
    but also delete or change the message before it
    reaches its destination (and the recipient won’t be able
    to tell if the message has been modified).
     False messages
     It is very easy to create an email with someone else’s
    name and address. SMTP servers don’t check for
    sender authenticity.
    Threats to Email
     Message Replay
     Messages can be saved,

    modified, and re-sent later.


     Repudiation
     You can’t prove that someone

    sent you a message since email


    messages can be forged.
    Solutions
     First, let’s review the requirements for
    secure email.
     Sender authenticity
     Nonrepudiation
     Message integrity
     Message confidentiality
    Solutions
     What do we need to meet these
    requirements?
     Digital Signatures
     Solves integrity, authenticity, and
    nonrepudiation problems.
     Encryption
     Solves confidentiality problem.
    Secure E-Mail Systems
     Both of these systems provide
    encryption and digital signatures for
    security.
     Secure Multipurpose Internet Mail
    Extensions (S/MIME)
     Pretty Good Privacy (PGP)
    S/MIME
     Developed by RSA Data Security, Inc.
     The Internet standard for secure e-mail
    attachments.
     Integrated into many commercial email
    clients, such as Microsoft Outlook, Netscape
    Communicator, and Lotus Notes (making it
    likely to dominate the secure e-mail market).
     Encourages users to obtain a Digital
    Certificate from a reliable Certification
    Authority (CA) (you can get a free one from
    here: http://www.thawte.com/).
    S/MIME
     S/MIME-aware email clients automatically detect
    the presence of the signature if the certificate was
    validated by a well-known CA.
    PGP
     Invented by Phil Zimmerman in 1991.
     Originally free, became a commercial product
    after being bought by Network Associates in
    1996 (freeware version is still available here:
    http://www.pgpi.org/);
     Available as a plug-in for popular email
    clients. Can also be used as a stand-alone
    software.
     There is no centralized authority.
    PGP
     Addresses the key distribution problem with a
    trust model called “web of trust.”
     Users create their own self-signed certificates,
    which can be later signed by others.
     Users interpret trust level for themselves.
    Problems with Secure Email
     Many people don’t use it because:
     They don’t know how.
     Difficulties of obtaining a Digital Certificate.
     S/MIME and PGP schemes do not protect the sender
    against a recipient claiming not to have received the
    message.
     It is still possible to create fake certificates (Class-1
    and Class-2 certificates which can be obtained online)
    if you know enough information about a person.
     Key availability and migration
    Other Useful Links
     Trace the source of the emails (using
    the email header).
     http://www.theinquirer.net/email_tracker.ht
    m
     Check to see if the sender is a known
    spammer.
     http://www.senderbase.org/
    Sources
     http://luxsci.com/extranet/articles/email-
    security.html
     http://www.tim-
    richardson.net/misc/security.html
     http://www.aamc.org/members/gir/audioc
    onferenceseries/gregackerman110403.pdf
     http://www.lasa.org.uk/knowledgebase/pa
    ges/Netadvicesecurity.shtml
     http://www.antiphishing.org/smim-dig-
    sig.htm

    You might also like