Researchers at RSA have noticed attackers using the open source tool Jigsaw in phishing schemes, with Jigsaw being...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
able to guess enterprise users' email based on four common patterns. If more phishers take advantage of this functionality, under what circumstances would it be worth the effort for enterprises to transition to email addresses based on uncommon patterns to improve email address security?
Ask the Expert
SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)
Simply put, email addresses cannot be kept secret if an organization wants to communicate with the outside world. In high-security environments, it might be easier to only allow digitally signed emails and block all unsigned emails to prevent phishing rather than changing all user email addresses. If an organization planned for email addresses and usernames to differ in the first place, it would be easier to transition to a new email address scheme based on uncommon patterns as opposed to using digitally signed email. However, note that if your company publishes email directories or employees' email addresses on its website or leverages the Jigsaw business directory, phishers would certainly be able to find and exploit those addresses.
Alternately, there are some scenarios where using email addresses based on uncommon patterns -- and changing them periodically to avoid re-use and detection -- might be reasonable. For example, using generic email addresses for people filling roles with high turnover rates might make it easier to manage these identities. In this case, not using the username as the email address could be reasonable, but the usernames can still be identified by an attacker examining a computer in use.
Constantly changing email addresses could also make e-discovery in the enterprise much more difficult if a given organization is required to save all email to and from particular users. Most times, email retention is managed based on the email address itself, so the database of email addresses would need to be updated every time an email address is changed, which can be a time-consuming task.
In my opinion, the resources an enterprise uses to obfuscate email addresses could be put to better use through security awareness training and education for employees around phishing. Changing email addresses or making email addresses more difficult to identify and track simply won't make the human factor less vulnerable.
Dig Deeper on Email and Messaging Threats (spam, phishing, instant messaging)
Related Q&A from Nick Lewis
The new Trochilus RAT can avoid detection in cyberespionage attacks. Expert Nick Lewis explains how it works, and if enterprises need to adapt their ...continue reading
The Asacub Trojan has new banking malware features. Expert Nick Lewis explains how it made this transition and what enterprises should be watching ...continue reading
BlackEnergy malware may have been part of the attacks on Ukrainian utility and media companies. Expert Nick Lewis explains how this malware works and...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.