Once the network analyzer is set up, it can capture everything that travels through your network. To capture e-mail...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
packets, ensure that the analyzer is logging traffic to and from your mail server. When you review the packets, check the e-mail headers to see if the content-type is application/x-pkcs7-mime. If it is, the e-mail is encrypted, which means you will not be able to read the message. If the content-type is text/plain or multipart/alternative the message is not encrypted, which means you will be able to read the message.
Many analyzers have built-in filters that alert you when specific conditions are met, which is useful when analyzing random events that have no explanation. Also, if your network analyzer supports the logical node name mapping feature, it will be easier to determine which machines are doing what on your network. Your network switches may also support port spanning, which enables port monitored traffic to be simultaneously sent to a network analyzer connected to another port.
You should be concerned if your sensitive messages aren't encrypted, as e-mail headers and content are transmitted via the clear text if encryption is not used. As a result, the message can be read or altered in transit. The header can be modified to hide or change the sender, or to redirect the message. Remember, confidential information can reside in two states on your network: physical storage media, such as a hard drive, memory, data-at-rest, or packets, data-in-motion. In both cases, data that is sensitive should be encrypted. When it comes to data-in-motion here are some information types that should always be encrypted:
- Sensitive HTTP traffic
- SQL queries
- Enterprise resource planning (ERP) queries
You can use your network analyzer to investigate whether this traffic is being encrypted according to your security policy.
Dig Deeper on Email Security Guidelines, Encryption and Appliances
Related Q&A from Mike Chapple
Vulnerability scanning tools are necessary to be fully compliant with PCI DSS, but the tools need to come from a PCI DSS Approved Scanning Vendor. ...continue reading
Healthcare clearinghouses like Mass HIway are a new trend in health IT, but what are the security implications? Expert Mike Chapple explains what you...continue reading
The FFIEC Cybersecurity Assessment Tool has faced harsh criticism since its 2015 release. Expert Mike Chapple reviews the tool and how it can be ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.