User:David MacQuigg/Sandbox/Email security

This article on Email security provides a brief overview of the ways in which email systems may be abused, and the techniques that are most effective in fighting that abuse. We classify the vulnerabilities according to their locality in Figure 1 of Email system, repeated here for convenience. We assume the reader is familiar with that article.

(CC) Image: David MacQuigg
Figure 1 Actors (Users and Agents) and their roles in an ideal email system.

Client vulnerabilities

After running a malicious program, perhaps from a phony website or attached to an email, the user's computer may become infected with a zombie program controlled by a remote criminal system. This can result in stolen passwords or the loss of other personal and financial data, or the sending of spam from the user's computer.

Users should be:
1) trained to not run any programs that may infect their computer.
2) required to maintain secure passwords.

Note: These requirements are only guidelines. The same level of security may be provided in some other way. For example, there is no need for passwords if every user can be authenticated by their address on a local network, secure from any outside intruder.

MSA vulnerabilites

An MSA may be tricked into relaying mail from an unauthorized source, or from an authorized source that has been compromised. Some large mail services, eager to get new accounts, may allow criminals to sign up for free accounts.

MSA agents should:
1) authenticate any user attempting to submit an email.
2) require their users to maintain secure passwords.
3) treat new accounts with special caution, ensuring that the benefits of abuse are less than the cost of establishing new accounts.

Transmitter vulnerabilites

The Transmitter is the weakest link in the passage of email from Author to Recipient. This may be inevitable, given the necessity for a communications link between unrelated parties across the open Internet. All other links in Figure 1 are between parties that have at least an indirect relationship with each other.

The Internet link is uniquely vulnerable to criminal intrusion. It is very easy to set up an exact replica of a legitimate transmitter relay, duplicating everything from message headers, to the envelope Return Address, to the name of the legitimate transmitter, everything but the transmitter's IP address. That has to be the actual transmitter address, or there is no TCP connection.

Criminals never use their own names in malicious transmissions. They will either make up a new name, or forge the name of a trusted domain. Criminal use of a trusted domain name provides better access to victim systems, and damages the reputation of the trusted name.

Domain owners who care about their reputation should publish authentication records protecting that name. Agents who operate transmitters on behalf of another domain (as opposed to transmitting under their own name) should work closely with the other domain to ensure that the domain's authentication records are kept up to date.

Domain owners should:
1) publish a list of IP addresses for their authorized transmitters (outgoing Border MTAs of their authorized Transmitter agent).

Transmitter agents should:
1) publish a list of IP addresses for their authorized transmitters (outgoing Border MTAs).
1a) work with their MSA agents to publish additional authentication information helpful in their business situation. This could include public keys used in digital signatures or information used to authenticate specific message headers.
2) implement rate limits on outgoing mail from each user account.
2a) work with their MSA agents to provide additional security as needed in their situation. This could include analyzing the content of messages, or providing alerts to anyone who might be an innocent source of abuse.
3) respond promptly to reports of abuse, even if their transmitters are not responsible.
4) maintain a good reputation for the identities used by their transmitters.
5) comply with all standards relating to their operations, thus allowing receivers to avoid mistakes affecting security.
6) handle bounce messages (Delivery Status Notifications) in a way that provides maximum reliability while avoiding abuse. This could include adding validation codes to the Return Address on every outgoing message.