Researchers at RSA have noticed attackers using the open source tool Jigsaw in phishing schemes, with Jigsaw being...
able to guess enterprise users' email based on four common patterns. If more phishers take advantage of this functionality, under what circumstances would it be worth the effort for enterprises to transition to email addresses based on uncommon patterns to improve email address security?
Ask the Expert
SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)
Simply put, email addresses cannot be kept secret if an organization wants to communicate with the outside world. In high-security environments, it might be easier to only allow digitally signed emails and block all unsigned emails to prevent phishing rather than changing all user email addresses. If an organization planned for email addresses and usernames to differ in the first place, it would be easier to transition to a new email address scheme based on uncommon patterns as opposed to using digitally signed email. However, note that if your company publishes email directories or employees' email addresses on its website or leverages the Jigsaw business directory, phishers would certainly be able to find and exploit those addresses.
Alternately, there are some scenarios where using email addresses based on uncommon patterns -- and changing them periodically to avoid re-use and detection -- might be reasonable. For example, using generic email addresses for people filling roles with high turnover rates might make it easier to manage these identities. In this case, not using the username as the email address could be reasonable, but the usernames can still be identified by an attacker examining a computer in use.
Constantly changing email addresses could also make e-discovery in the enterprise much more difficult if a given organization is required to save all email to and from particular users. Most times, email retention is managed based on the email address itself, so the database of email addresses would need to be updated every time an email address is changed, which can be a time-consuming task.
In my opinion, the resources an enterprise uses to obfuscate email addresses could be put to better use through security awareness training and education for employees around phishing. Changing email addresses or making email addresses more difficult to identify and track simply won't make the human factor less vulnerable.
Dig Deeper on Email and Messaging Threats (spam, phishing, instant messaging)
Related Q&A from Nick Lewis
A malware tool that helped to compile the Zeus Trojan has been leaked on the Web. Expert Nick Lewis explains what this means for enterprise security ...continue reading
When it comes to state-sponsored attacks infecting mobile devices, do users have any chance of tracing the attack? Expert Nick Lewis offers some ...continue reading
Microsoft won't patch certain ASLR bypass flaws, but enterprises still need to protect against them. Expert Nick Lewis explains the threat and how to...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.