Download Hacking For Dummies

Chapter 15: Messaging Systems
E-mail is one of the best ways for malware to propagate. Chapter 14
covers malware.
Hackers often compromise systems by running e-mail services that
aren’t being used or that need to be updated.
General best practices for minimizing
e-mail security risks
The following countermeasures help keep messages as secure as possible.
Software solutions
The right software can neutralize many threats:
Use malware-protection software on the e-mail server — better, the e-mail
gateway — to prevent malware from reaching e-mail clients.
Apply the latest operating system and e-mail application security patches
consistently and after any security alerts are released.
If it makes good business sense, encrypt messages. You can use S/MIME
or PGP to encrypt sensitive messages or use e-mail encryption at the
desktop level or the server or e-mail gateway. (You can use SSL/TLS
between your e-mail client and server via POP3S or IMAPS or between
your e-mail gateway and remote e-mail gateways. I prefer to implement
encryption between gateways so that the user doesn’t have to be
involved.)
It’s best not to depend on your users to encrypt messages. Use an enterprise solution to encrypt messages.
Operating guidelines
Some simple operating rules can keep your walls high:
Put your e-mail server behind a firewall, preferably in a DMZ that’s on a
different network segment from the Internet and from your internal LAN.
Disable unused protocols and services on your e-mail server.
Run your e-mail server on a dedicated server, if possible, to help keep
hackers out of other servers and information if the server is hacked.
Log all transactions with the server in case you need to investigate malicious use in the future.
271