SHASHANK MASHETTY security

Introduction Electronic mail most commonly referred to as or e- mail. Electronic mail is one of the most commonly used services on the Internet allowing people to send messages to one or more recipients. Modern operates across the internet and computer networks. The messages can be notes entered from the keyboard or electronic files stored on the disk.

Why do we need secure ?  Protect sensitive data  Prove authenticity to recipients  Send attachments that are normally filtered  Avoid the junk folder

security enhancements  Authentication  Confidentiality  Confidentiality and authentication  Message intigrity

Threats enabled by  Spam  Spoofing  Phishing  Disclosure of sensitive information  Exposure of systems to malicious code  Denial-of-service(dos)  Un authorized access

threats  Spam  spam is the scourge of around the world  it makes as 95% of all on the internet  spammers get address from new groups, un scrupulous web site operators  A large proportion of spam contains malware or links to web sites that contain malware

threats  Spoofing  spoofing occurs when an attacker sends you an pretending to be some one to you  spoofing is easy to do and very difficult to trace the real sender.  Phishing  Phishing s appear very authentic and often include graphics or logos that are actually from your bank.

based attacks  Active content attack - clean up at the server  Buffer over-flow attack - fix the code  Shell script attack - scan before send to the shell  Trojan horse attack - use do not automatically use the macro option

Choices available in the secure  PGP ( pretty good policy )  S/MIME  Special providers  SSL/TLS web browser based  SSL/TLS POP/SMPS

PGP  Functionality: -encryption for confidentiality -signature for non repudiation/authenticity  Requires key exchange and key management  Not scalable  Small industry support  Can only exchange secure with other PGP users

S/MIME  Similar to PGP, requires administrator installation and configuration support intensive  User must download and install software  Many installations have failed due to complexity  Can only exchange s with other S/MIME users

Special providers  Managed services using S/MIME with PKI key exchange  Appliance based services with special hardware requires integration  expensive

Secure web mail  Nothing to download or install, no support issues beyond typical .  Works with any web browser  Uses SSL/TLS security, same system used by banks, visa, etc  Easy to add, manage users  No training is needed it is simple

POP/SMTP Secure Mail  Works with all programs  Uses SSL/TLS security same system used by banks, visa, etc  Easy to set up, no download or installation, same issues as traditional

Steps to secure mail  Generate an identity  Configure secure software  Get public keys for recipients  Start sending secured messages

Tips to be secure  Never click on a suspect .  Never reply to a suspect with personal information  Look at the grammatical errors in the  Contact your bank via telephone ( get the telephone number from the website rather than the you received ) if you suspect a fraud  Watch for the small changes on your financial statements to avoid detection

Questions?