2KKUU7ita

268
Part V: Hacking Applications
Operating guidelines
Some simple operating rules can keep your walls high and the attackers out
of your e-mail systems:
✓ Put your e-mail server behind a firewall on a different network segment
from the Internet and from your internal LAN — ideally in a demilitarized
zone (DMZ).
✓ Harden by disabling unused protocols and services on your e-mail
server.
✓ Run your e-mail server and malware scanning on dedicated servers if
possible (potentially even separating inbound and outbound messages).
Doing so can keep malicious attacks out of other servers and information
in the event the e-mail server is hacked.
✓ Log all transactions with the server in case you need to investigate malicious
use. Be sure to monitor these logs as well! If you cannot justify
monitoring, consider outsourcing this function to a managed security
services provider.
✓ If your server doesn’t need certain e-mail services running (SMTP, POP3,
and IMAP), disable them — immediately.
✓ For web-based e-mail, such as Microsoft’s Outlook Web Access (OWA),
properly test and secure your web server application and operating
system by using the testing techniques and hardening resources I mention
throughout this book.
✓ Require strong passwords. Be it standalone accounts or domain-level
Exchange or similar accounts, any password weaknesses on the network
will trickle over to e-mail and surely be exploited by someone via
Outlook Web Access or POP3. I cover password hacking in Chapter 7.
✓ If you’re running sendmail — especially an older version — consider
running a secure alternative, such as Postfix (www.postfix.org) or
qmail (www.qmail.org).
Understanding Voice over IP
One of the hottest technologies blowing through town these days is undoubtedly
Voice over IP (VoIP). Whether it’s in-house VoIP systems or systems
for remote users, VoIP servers, soft phones, and other related components
have a slew of vulnerabilities. Like most things security-related, many people