2KKUU7ita

Figure 13-1:
Limiting the
number of
resources
that handle
inbound
messages.
Chapter 13: Communication and Messaging Systems
Even in large companies, there’s no reason that thousands of inbound e-mail
deliveries should be necessary within a short time period.
Some e-mail servers, especially UNIX-based servers, can be programmed to
deliver e-mails to a daemon or service for automated functions, such as create
this order on the fly when a message from this person is received. If DoS protection
isn’t built in to the system, a hacker can crash both the server and the
application that receives these messages and potentially create e-commerce
liabilities and losses. This can happen more easily on e-commerce websites
when CAPTCHA (short for Completely Automated Public Turing test to tell
Computers and Humans Apart) is not used on forms. I cover web application
security in Chapter 14.
Automated e-mail security controls
You can implement the following countermeasures as an additional layer of
security for your e-mail systems:
✓ Tarpitting: Tarpitting detects inbound messages destined for unknown
users. If your e-mail server supports tarpitting, it can help prevent spam or
DoS attacks against your server. If a predefined threshold is exceeded —
say, more than ten messages — the tarpitting function effectively shuns
traffic from the sending IP address for a period of time.
✓ E-mail firewalls: E-mail firewalls and content-filtering applications from
vendors such as Symantec and Barracuda Networks can go a long way
towards preventing various e-mail attacks. These tools protect practically
every aspect of an e-mail system.
✓ Perimeter protection: Although not e-mail-specific, many firewall and IPS
systems can detect various e-mail attacks and shut off the attacker in
real time. This can come in handy during an attack.
255