Researchers at RSA have noticed attackers using the open source tool Jigsaw in phishing schemes, with Jigsaw being...
able to guess enterprise users' email based on four common patterns. If more phishers take advantage of this functionality, under what circumstances would it be worth the effort for enterprises to transition to email addresses based on uncommon patterns to improve email address security?
Ask the Expert
SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)
Simply put, email addresses cannot be kept secret if an organization wants to communicate with the outside world. In high-security environments, it might be easier to only allow digitally signed emails and block all unsigned emails to prevent phishing rather than changing all user email addresses. If an organization planned for email addresses and usernames to differ in the first place, it would be easier to transition to a new email address scheme based on uncommon patterns as opposed to using digitally signed email. However, note that if your company publishes email directories or employees' email addresses on its website or leverages the Jigsaw business directory, phishers would certainly be able to find and exploit those addresses.
Alternately, there are some scenarios where using email addresses based on uncommon patterns -- and changing them periodically to avoid re-use and detection -- might be reasonable. For example, using generic email addresses for people filling roles with high turnover rates might make it easier to manage these identities. In this case, not using the username as the email address could be reasonable, but the usernames can still be identified by an attacker examining a computer in use.
Constantly changing email addresses could also make e-discovery in the enterprise much more difficult if a given organization is required to save all email to and from particular users. Most times, email retention is managed based on the email address itself, so the database of email addresses would need to be updated every time an email address is changed, which can be a time-consuming task.
In my opinion, the resources an enterprise uses to obfuscate email addresses could be put to better use through security awareness training and education for employees around phishing. Changing email addresses or making email addresses more difficult to identify and track simply won't make the human factor less vulnerable.
Related Q&A from Nick Lewis
As the Angler exploit kit evolves and adopts new functionality, it's becoming harder to detect and defend against. Enterprise threats expert Nick ...continue reading
A proof-of-concept attack on Apple's Siri allowed researchers to steal data from iOS. Learn more about the iStegSiri attack and how to defend against...continue reading
A new global email scam has cost enterprises millions. Expert Nick Lewis explains how to defend against man-in-the-email attacks with proper training...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.