Researchers at RSA have noticed attackers using the open source tool Jigsaw in phishing schemes, with Jigsaw being...
able to guess enterprise users' email based on four common patterns. If more phishers take advantage of this functionality, under what circumstances would it be worth the effort for enterprises to transition to email addresses based on uncommon patterns to improve email address security?
Ask the Expert
SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)
Simply put, email addresses cannot be kept secret if an organization wants to communicate with the outside world. In high-security environments, it might be easier to only allow digitally signed emails and block all unsigned emails to prevent phishing rather than changing all user email addresses. If an organization planned for email addresses and usernames to differ in the first place, it would be easier to transition to a new email address scheme based on uncommon patterns as opposed to using digitally signed email. However, note that if your company publishes email directories or employees' email addresses on its website or leverages the Jigsaw business directory, phishers would certainly be able to find and exploit those addresses.
Alternately, there are some scenarios where using email addresses based on uncommon patterns -- and changing them periodically to avoid re-use and detection -- might be reasonable. For example, using generic email addresses for people filling roles with high turnover rates might make it easier to manage these identities. In this case, not using the username as the email address could be reasonable, but the usernames can still be identified by an attacker examining a computer in use.
Constantly changing email addresses could also make e-discovery in the enterprise much more difficult if a given organization is required to save all email to and from particular users. Most times, email retention is managed based on the email address itself, so the database of email addresses would need to be updated every time an email address is changed, which can be a time-consuming task.
In my opinion, the resources an enterprise uses to obfuscate email addresses could be put to better use through security awareness training and education for employees around phishing. Changing email addresses or making email addresses more difficult to identify and track simply won't make the human factor less vulnerable.
Dig Deeper on Email and Messaging Threats (spam, phishing, instant messaging)
Related Q&A from Nick Lewis
Vonteera adware has the ability to disable antimalware software on endpoint devices. Expert Nick Lewis explains how enterprises can prevent this ...continue reading
ModPOS, a new POS malware, compromised millions of credit card accounts in 2015. Expert Nick Lewis explains how cybercriminals use this malware and ...continue reading
Amex cards have been discovered to be vulnerable to credit card hacking. Expert Nick Lewis explains how this happens, and what can be done about Chip...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.