2KKUU7ita

Chapter 13: Communication and Messaging Systems
In addition to testing your antivirus software, you can attack e-mail systems
using other tools I cover in this book. Metasploit (www.metasploit.com)
enables you to discover missing patches in Exchange and other servers that
hackers could exploit. Brutus (www.hoobie.net/brutus/) enables you to
test the cracking of web and POP3/IMAP passwords.
General best practices for minimizing
e-mail security risks
The following countermeasures help keep messages as secure as possible.
Software solutions
The right software can neutralize many threats:
✓ Use malware-protection software on the e-mail server — better, the
e-mail gateway — to prevent malware from reaching e-mail clients. Using
malware protection on your clients is a given.
✓ Apply the latest operating system and e-mail application security
patches consistently and after any security alerts are released.
✓ Encrypt (where’s it reasonable). You can use S/MIME or PGP to encrypt
sensitive messages or use e-mail encryption at the desktop level or
the server or e-mail gateway. You can also use SSL/TLS via the POP3S,
IMAPS, and SMTPS protocols. A better option may be to use an e-mail
security appliance or cloud service that supports the sending and
receiving of encrypted e-mails via a web browser over HTTPS.
Don’t depend on your users to encrypt messages. Use an enterprise
solution to encrypt messages automatically instead.
Make sure that encrypted files and e-mails can be protected against
malware.
• Encryption doesn’t keep malware out of files or e-mails. You just
have encrypted malware within the files or e-mails.
• Encryption keeps your server or gateway antivirus from detecting
the malware until it reaches the desktop.
✓ Make it policy for users not to open unsolicited e-mails or any attachments,
especially those from unknown senders, and create ongoing
awareness sessions and other reminders.
✓ Plan for users who ignore or forget about the policy of leaving unsolicited
e-mails and attachments unopened. It will happen!
267