Company

Deploying Email Defenses

« Back

Author: Christian Perry
Source: Processor.com

May 4, 2007

With the help of email, many of history’s most notorious online attacks spread through enterprises like wildfire, instantaneously bringing servers to their knees, and production to a standstill. Although it’s been years since headline-grabbing viruses such as I Love You and Melissa wreaked havoc on email systems worldwide, IT managers remain on guard against email threats.

And it’s not just malware that poses a threat to enterprise security but also the behavior of employees themselves. A 2006 study conducted by Forrester Consulting for Proofpoint revealed that 34% of U.S. companies investigated a suspected email leak of confidential or proprietary information in the past 12 months. Further, nearly one in three U.S. companies had terminated an employee for violating email policies in that same timeframe.

“Email has evolved to become much more than a communications medium in the enterprise,” says Andres Kohn, vice president for product management at Proofpoint (www.Processor.com/Proofpt). “In many cases, it’s also the de facto filing system for many employees and, as such, the email system becomes a repository for a huge volume of valuable, sensitive, or even regulatory-controlled content. Even though email is mission critical, it continues to be one of the least-controlled systems in the enterprise.”

Be Inquisitive

As IT infrastructures grow increasingly complex, the challenge to secure email from both external and internal threats can quickly become overwhelming for even the most seasoned security experts. As a result, the process of developing an effective email security policy should not be limited to just one administrator or even one department because a team effort can more adequately address the potentially wide-ranging problems spawned by email threats.

"Email is now the primary means of business communication and affects almost all components of an organization," says Christine Drake, product marketing manager, Trend Micro (www.Processor.com/TrendMicro). “Different departments will have different email requirements.”

For example, Drake explains that human resources will likely want to restrict confidential employee information; the legal department might require disclaimers at the bottom of email messages; engineering will look to protect intellectual property; and marketing might want a less-aggressive spam filter to allow receipt of newsletters and advertisements. Yet the company as a whole, she says, might seek to implement policies that restrict attachment types and message sizes to protect the network.

An important first step when investigating potential email policies is asking questions. Drake says that the company should ask itself how it wants to restrict and permit information, and the answers should be communicated to IT. Proofpoint’s Kohn agrees: “Start by asking: ‘When is it OK to send information outside the enterprise via email? When is it not? What types of information are prohibited in the email system? What types of procedures will be necessary to discourage risky behavior and enforce established policies? What is our process for reviewing and revising policies in the event that changes occur or policies fail to work as expected?’”

Michael Dodson, director of security strategy at Mirapoint (www.Processor.com/Mirapoint-Inc), recommends that after enterprises determine the value of the information they’re protecting, they should establish a budget for providing protection against the risks. After the budget is created, they should purchase solutions and implement them with high-level objectives in mind to ensure the solutions meet the intended purpose.

Finding Solutions

In a perfect world, a single technology or product would stringently address these concerns, regardless of the infrastructure in which it’s deployed. But reality rules that no such solution exists, meaning that enterprises are often best served with a mix of forward-thinking policies and best-of-breed security products.

“There are no ‘silver bullets’ for email security,” says David Troup, CEO and founder of MailFoundry (www.Processor.com/MailFoundry). "At best, the total solution is a multilayered defensive and offensive set of point solutions and practices that provide the desired level of protection without handicapping the usefulness of email as a priority communications tool.”

From a general standpoint, targeted solutions should handle all standalone email threats, including spam, phishing, and malware, as well as provide protection against blended threats, Drake says. Certain solutions also include reputation services that can detect zombies and botnets when they first emerge. Similarly, predictive techniques such as zero-day protection, advanced heuristics, and behavior analysis can work to build a defense against sophisticated threats.

“Layered messaging security is important to achieving complete email protection, including both gateway and mail server protection,” Drake says. “The gateway is the only place where the bulk of email threats can be kept completely off the network, stopping spam as well as directory harvest, distributed denial of service, and bounced mail attacks.”

For internal email threats, Drake suggests that enterprises address them at the only central inspection point for interoffice communications: the mail server. This is the location that provides the first opportunity to inspect outgoing email and handle elements such as storage, archiving, and regulatory requirements. "Mail server security also provides the ability to continue inspecting incoming messages and routinely scan the mail store,” she says.

Reports Are Key

The final step, according to Dodson, requires individuals or departments in charge of implementing the policy and related technologies to report the solution’s effectiveness on a regular basis to the business leader whose requirement is being addressed because if enterprises fail to measure what the solution is doing, they’ll be unable to determine how well it’s working.

Dodson suggests using automated reports that not only relay the overall effectiveness of the solution but also enumerate every attempted policy violation. Further, reports of attempted violations should be distributed to the appropriate individual or department, depending on the policy.

Says Troup: “Some may say that you can’t go too far in terms of securing email, but the most important issue to keep in mind is that the end result must maintain email as an effective, trusted, and timely communications tool for the enterprise both internally and externally.”

by Christian Perry


Cover The Bases

MailFoundry’s (www.Processor.com/MailFoundry) David Troup offers the following tips for enterprises looking to secure their email.

• Provide physical security for the email server.

• Create strong passwords on account access.

• Require periodic password changes.

• Use SSL for SMTP access (POP3, IMAP, etc.).

• Use email encryption tools for email payloads.

• Use inbound and outbound email filtering.

• Use real-time email storage archiving.

Processor.com Article »