| Lesson 6 | Securing email |
| Objective | Secure your email server. |
Securing email
Because the
simple mail transfer protocol (SMTP)[1] was formed without security in mind, securing an email server is rather difficult. Newer SMTP servers often offer security features, such as reverse
domain name system (DNS) lookup, to help
ensure that the email sender is actually who he or she claims to be. Whenever possible, use such
authentication[2] measures.
Encryption
For securing email itself, encryption is the key. Several popular tools, including the proprietary encryption methods found in Microsoft servers and common public key encryption methods, are the most useful for ensuring that the information sent through your server will be secure.
Melissa virus
An example of how a virus can take advantage of email client applications, the Melissa virus is explained in the Slide show below.
- The domain is the principal unit of organization
- Within a domain, objects can be organization
- You can create more than one domain.
- It becomes the parent domain to child it.
Securing Email
Commercial anti-virus programs can scan email attachments before a user activates an embedded virus. However, these programs operate only on individual machines.
Network-level email scanning
A relatively new security feature available in some SMTP servers is automated virus scanning at the network level. Email messages do not carry viruses. A virus may be sent only through attachments. Advanced SMTP servers can scan email transparently by placing the email messages in a temporary holding area. The server scans the files, then forwards the email as appropriate. Usually, this process takes little extra time, but is well worth the delay. You can also scan email through your firewall. However, such scanning, either by an SMTP server or by a firewall, slows performance.
SMTP access restrictions
Another security feature of newer SMTP servers is a setting that allows email to originate only from inside your network. In other words, the server can verify that mail purporting to be sent from your system actually comes from a legitimate user.
[1] Simple Mail Transfer Protocol (SMTP): The Internet standard protocol to transfer electronic mail messages from one computer to another. It specifies how two mail systems interact, as well as the format of control messages they exchange to transfer mail.
[2] Authentication: The process of identifying an individual, usually based on a username and password.