Q

Email address security: Can email addresses thwart phishing schemes?

Email addresses are prime targets of phishing schemes. Uncover how to mitigate these risks and learn tips for ensuring email address security.

Researchers at RSA have noticed attackers using the open source tool Jigsaw in phishing schemes, with Jigsaw being

able to guess enterprise users' email based on four common patterns. If more phishers take advantage of this functionality, under what circumstances would it be worth the effort for enterprises to transition to email addresses based on uncommon patterns to improve email address security?

Ask the Expert

SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)

Simply put, email addresses cannot be kept secret if an organization wants to communicate with the outside world. In high-security environments, it might be easier to only allow digitally signed emails and block all unsigned emails to prevent phishing rather than changing all user email addresses. If an organization planned for email addresses and usernames to differ in the first place, it would be easier to transition to a new email address scheme based on uncommon patterns as opposed to using digitally signed email. However, note that if your company publishes email directories or employees' email addresses on its website or leverages the Jigsaw business directory, phishers would certainly be able to find and exploit those addresses.

Alternately, there are some scenarios where using email addresses based on uncommon patterns -- and changing them periodically to avoid re-use and detection -- might be reasonable. For example, using generic email addresses for people filling roles with high turnover rates might make it easier to manage these identities. In this case, not using the username as the email address could be reasonable, but the usernames can still be identified by an attacker examining a computer in use.

Constantly changing email addresses could also make e-discovery in the enterprise much more difficult if a given organization is required to save all email to and from particular users. Most times, email retention is managed based on the email address itself, so the database of email addresses would need to be updated every time an email address is changed, which can be a time-consuming task.

In my opinion, the resources an enterprise uses to obfuscate email addresses could be put to better use through security awareness training and education for employees around phishing. Changing email addresses or making email addresses more difficult to identify and track simply won't make the human factor less vulnerable.

This was first published in March 2014

Dig deeper on Email and Messaging Threats (spam, phishing, instant messaging)

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close