Securing Email Communications Module 9 Simplifying Security. 1
Email Security: Malicious Messages 'A Problem For Govt. Too' May 16, 2011 Individuals who are concerned about data loss may be surprised to hear of the number of hacking attacks attempted on the Treasury. Chancellor George Osborne revealed at the Google Zeitgeist conference on Monday (May 16th) that each month around 20,000 malicious emails are sent to UK government networks. Furthermore, he noted: "During 2010, hostile intelligence agencies made hundreds of serious and pre planned attempts to break into the Treasury's computer system. In fact, it averaged out as more than one attempt per day." As a result of these figures, Mr Osborne pointed out that the Treasury is one of the most targeted by data attacks across the whole of Whitehall. Government is not the only area concerned about breaches though, with Square Enix recently confirming that a couple of websites it is associated with have been attacked. http://www.cryptzone.com 2
Module Objectives Email System Email Security Email Security Threats Spamming Hoax/Chain and Scam Emails Email Security Control Layers Email Security Procedures How to Obtain Digital Certificates? Online Email Encryption Service Email Security Tools Email Security Checklist Security Checklist for Checking Emails on Mobile 3
Module Flow Introduction to Email Security Email Security Threats Email Security Procedures How to Obtain Digital Certificates? Email Security Tools 4
Email Threat Scenario 2011 Email Spam Intercepted Top 5 Geographies Email Virus Intercepted Top 5 Geographies Email Phish Intercepted Top 5 Geographies Italy 93.5% South Africa 1 in 147.2 South Africa 1 in 99.0 Denmark 93.2% UK 1 in 164.6 UK 1 in 214.8 Austria 92.0% Spain 1 in 174.1 Oman 1 in 341.9 France 92.0% Oman 1 in 229.0 United Arab Emirates 1 in 424.0 Switzerland 91.5% Switzerland 1 in 237.8 New Zealand 1 in 568.1 Global Spam Rate (89.1%) Global Virus Rate (1 in 284.2) Global Phish Rate (1 in 444.5) 5
How Various Email Systems Work? Email (electronic mail) is a method of exchanging digital messages from a sender to one or more recipients Companies such as Microsoft, Yahoo!, Google, and AOL offer free email accounts Email accounts can be accessed from any web browser or a standalone email client such as Microsoft Outlook, Mozilla Thunderbird, etc. Internet Sender Email Clients Email Server Email Server Email Clients Receiver 6
Email Security No email communication is 100% secure Insecure emails allow attackers to intercept personal and sensitive information of the user If not secured, emails sent/received can be forged or read by others Emails are one of the sources of viruses and various malicious programs It is necessary to secure emails to have safer communications and to protect privacy 7
Module Flow Introduction to Email Security Email Security Threats Email Security Procedures How to Obtain Digital Certificates? Email Security Tools 8
Email Security Threats Malicious User Redirection Mails may contain links that websites hosting malwares and pornographic material Malicious Email Attachments Attachments may contain a virus, Trojan, worms, keylogger, etc., and opening such attachments infects the computer Phishing Phishing mails lure victims to provide personal data Hoax/Chain Mail The user may receive hoax emails that contain false information telling him/her to forward the mail Spamming The user may receive spam mails may contain malware allowing attackers to take control of the user computer 9
Malicious Email Attachments Email attachments are major email security threats as they offers attackers easiest and most powerful ways to attack a PC Most malicious attachments install a virus, Trojan, spyware or any other kind of malware code as soon as you open them 10
Email Attachments: Caution Save and scan all email attachments before opening them Check if the email is from one of your contacts Do not open attachments with suspicious or unknown file extensions Example: *.exe, *.vbs,*.bat,*.ini, *.bin, *.com, *.pif, *.zzx Check if the email was ever received from the source Check if the subject line and name of the attachment are correlated with each other Never open an email attachment from unreliable sources 11
Spamming Unsolicited bulk messages Spamming is the use of email systems to send unsolicited bulk messages indiscriminately overloading the users inbox Attacker Spam Sources by Continent User Spam emails may contain malicious computer programs such as viruses and Trojans Europe Asia 27% 44% According to Symantec, spam makes up 89.1 % of all email traffic South America Africa 8% 18% North America 7% Oceania 3% 0 20 40 60% http://www.m86security.com 12
Spamming Countermeasures Avoid opening spam messages (classified by spam filters) Report suspicious email as spam Use the email client's spam filter and antispamming tools Do not use official email address while registering with any website Never follow the links in spam messages Use a different email address when posting messages to any public forum 13
Anti-Spamming Tool: SPAMfighter SPAMfighter protects all the email accounts on a PC against "phishing", identity theft, and other email frauds http://www.spamfighter.com 14
Hoax/Chain and Scam Emails Hoaxes are email messages warning the recipients of non existent threats Users are also warned of adverse effects if they do not forward the email to others http://www.scamletters.com A scam email asks for personal information such as bank account details, credit card numbers, password, etc. http://diamond back.com The sender of scam mails may also ask the recipient to forward the email to everyone in his/her contact list 15
Nigerian Scam A Nigerian scam is a form of advance payment of money or money transfer This scam is called a Nigerian scam because initially it started from Nigeria, but they can come in anywhere in the world Using this scam, scammers contact you by sending an email and offer you a share in a large sum of money They say they want to transfer money, which was trapped in banks during civil wars, to your account They may also cite various reasons such as massive inheritance problems, government restrictions, or taxes in the scammer s country Scammers ask you to pay money or give them your bank account details to help them transfer the money http://in.mail.yahoo.com/ From: Mr. Wong Du Seoul, South Korea. I will introduce myself I am Mr.Wong du a Banker working in a bank in south Korea Until now I am the account officer to most of the south Korea government accounts and I have since discovered that most of the account are dormant account with a lot of money in the account on further investigation I found out that one particular account belong to the former president of south Korean MR PARK CHUNG HEE, who ruled south Korean from 1963 1979 and this particular account has a deposit of $48m with no next of kin. My proposal is that since I am the account officer and the money or the account is dormant and there is no next of kin obviously the account owner the former president of South Korea has died long time ago, that you should provide an account for the money to be transferred. The money that is floating in the bank right now is $48m and this is what I want to transfer to your account for our mutual benefit. Please if this is okay by you I will advice that you contact me through my direct email address. Please this transaction should be kept confidential. For your assistance as the account owner we shall share the money on equal basis. Your reply will be appreciated, Thank you. Wong Du 16
Module Flow Introduction to Email Security Email Security Threats Email Security Procedures How to Obtain Digital Certificates? Email Security Tools 17
Email Security Control Layers Receiver Sender 18
Email Security Procedures Scan email attachments for malware Turn off the preview feature and change download settings in email clients Create junk email filter in email clients Create and use strong passwords Provide alternate email address for mail recovery Check for last logging activity Digitally sign your mail messages Use HTTPS for browser connection Avoid unwanted emails using filters Disable/unselect Keep Me Signed In/Remember Me functions 19
Creating Strong Passwords Strong passwords are difficult to crack or guess A strong password can be created by using combinations of numbers (0 9), letters in upper and lower case (a z and A Z), and special characters (!@#$% ) Create a strong but easy to remember password and do not write it anywhere 20
Alternate Email Address An alternate email address is the additional email address required at signup for most of the free email services such as Gmail and Yahoo It is used by service providers to verify the account creator s identify Alternate email addresses are used for password recovery in case you forgot the password 21
Keep Me Signed In/Remember Me Most of the popular email clients have the Keep me signed in or Remember Meoptions Checking these options allow the email client to fetch the email inbox of the user without him/her having to fill in the login details again This allows other users to access the user s email Users should check that this option is not selected when accessing email from a public computer 22
Using HTTPS Web mails such as Gmail, Yahoomail, Hotmail, AOL Mail, etc. have an option for choosing the communication protocol for browser connection Change the Browser connection setting to receive email using HTTPS (HTTPSecure) 23
Check for Last Account Activity Always check the latest email account activity if the feature is available with the email service Latest account activity includes information such as access type (browser, mobile, POP3, etc.), location (IP address), and date/time of account activities To check account activity in Gmail, scroll to the bottom of the page and click Details Immediately change your password and password hints if you observe any suspicious activity 24
Scanning Email Attachments Be cautious when opening any email attachment Save all the attachments and scan them properly for malware using an antivirus before opening Enable the antivirus to automatically scan all the emails and downloads 25
Turn Off Preview Feature Email clients have an option to show a preview of the email Turn off this feature in email clients Turning on this feature may execute script code without you explicitly opening the message To turn off the preview feature in Microsoft Outlook: Go to View menu and select Reading Pane Click the Off option To turn off the preview feature in Mozilla Thunderbird: Go to View menu and select Layout Uncheck the option Message Pane 26
Email Filtering: Avoiding Unwanted Emails Email filtering is the process of organizing emails according to a specified criteria Email filters are generally used to identify and categorize spam mails To avoid unwanted emails in Outlook 2010, go to the Delete group on the Home tab, click Junk and Junk E mail Options, On the Blocked Sender tab, click Add Enter an email address or domain name, click OK 27
Module Flow Introduction to Email Security Email Security Threats Email Security Procedures How to Obtain Digital Certificates? Email Security Tools 28
Digitally Sign Your Emails Digital signatures are used to authenticate the sender of a message or the signer of a document They can also be used to ensure that the original content of the message is not changed Users require an email certificate to digitally sign emails You can obtain digital signatures from certification authorities Example of Certification Authorities: VeriSign (http://www.verisign.com) Comodo (http://www.comodo.com) Entrust (http://www.entrust.com) Thwate (http://www.thawte.com) 29
How to Obtain Digital Certificates? Go to the Certificate Authorities website Purchase and download a digital certificate Some certificate authorities offer a free personal email security certificate such as Comodo Provide personal details to download the certificate Login to the email account that you have provided while downloading the certificate Check your inbox for an installation link 30
Installing a Digital Certificate Click on the installation link to install the digital certificate In Internet Explorer go to Tools Internet Options Content tab In the content tab, click Certificates button Select the certificate and click the Export button Click on Next Check the Yes, export the private key option Click on Next Protect the private key by giving a password and confirming it Specify the file you want to export and save it to a particular location 31
SigningYour Emails Go to the Microsoft Outlook File Options Click on Trust Center Trust Center Settings Email Security Encrypt the mail by selecting the appropriate check boxes under the Encrypted e mail section Click the Import/Export button Browse to find the file to open and give the password and digital ID name Click the OK button Click New Mail to write a message After clicking on the Send button, it will prompt to encrypt the message Click the Send Unencrypted button (if the recipients do not have private key) Click on the Continue button if the recipient have private key 32
SigningYour Emails 33
Microsoft Outlook Download Settings Choose the Automatic Download option from the Trust Center and select the options as shown in the figure 34
Module Flow Introduction to Email Security Email Security Threats Email Security Procedures How to Obtain Digital Certificates? Email Security Tools 35
Online Email Encryption Service: Lockbin Lockbin is a free service for sending private email messages It is used for sending confidential information such as credit card details and business information https://www.lockbin.com 36
Email Security Tools Comodo AntiSpam http://www.comodoantispam.com McAfee SpamKiller http://us.mcafee.com Netcraft Toolbar http://toolbar.netcraft.com Comodo Email Certificate http://www.comodo.com PhishTank SiteChecker https://addons.mozilla.org Mirramail Secure Email http://www.mirrasoft.com Spamihilator http://www.spamihilator.com Encryptomatic MessageLock http://www.encryptomatic.com 37
Module Summary Email (electronic mail) is a method of exchanging digital messages from a sender to one or more recipients Attachments can contain malicious programs; opening such attachments can infect the computer Spamming is the process of populating the user s inbox with unsolicited or junk emails Hoaxes are false alarms claiming reports about a nonexistent virus Do not forget to delete browser cache, passwords, and history Consider setting mobile phones to download only headers of emails, not the full email Digital signatures are used to authenticate the sender of a message or the signer of a document Email security tools protect passwords and automatically log off email accounts 38
Email Communication Checklist DON T USE just one email account for all purposes DON T CLOSE the browser without properly logging out DON T FORGET to delete browser cache, passwords, and history DON T SEND personal and financial information via email DON T TRUST the emails from your friends to be secure DON T DELETE spam instead of blacklisting it DON T FAIL to scan all email attachments and to enable the email spam filter DON T USE simple and easy to guess passwords 39
Email Security Checklist Create strong passwords for logging into mail accounts Enable https for secure communications/transactions Be diligent while opening email attachments Do not click on links provided in email messages Follow email etiquette when forwarding messages Do not forward or reply to spam and suspicious emails; delete them Avoid accessing email via unsecured public wireless connection Avoid accessing the email accounts on shared computers and sending large attachments in emails 40
Email Security Checklist Use Bcc: option when sending mail to bulk recipients Never save your password on the web browser Sort messages by priority, subject, date, sender, and other options (Helps in searching email) Avoid sending confidential, sensitive, personal, and classified information in emails Clean your Inbox regularly Create folders and move email accordingly (Family, Friends, Work, etc.) Digitally sign your outgoing mails Send attachments in PDF form rather than Word or Excel formats 41
Security Checklist for Checking Emails on Mobile Consider setting mobile phones to download only headers of emails, not the full email Configure to check only attachment notifications, but not attachments Do not open/send large attachments from mobile Do not follow links sent in email or text messages Install mobile antivirus and keep it up to date Turn off Show Pictures in your Mobile Browser To reduce the size of email, send them in plain text Zip and send any important files 42