In this excerpt of Chapter 6 from Phishing: Cutting the Identity Theft Line, authors Rachael Lininger and Russell Dean Vines explain how e-mail authentication helps protect companies from phishing attacks.
E-mail authentication systems may provide an effective means of stopping
e-mail and IP spoofing. E-mail spoofing is probably one of the biggest current
Web security challenges. Without authentication, verification and traceability,
users can never know for certain if a message is legitimate or forged. E-mail
administrators continually have to make educated guesses on behalf of their
users on what to deliver, what to block and what to quarantine.
The three main contenders for authentication are Sender Policy Framework
(SPF), SenderID and DomainKeys. APWG estimates that adopting a two-step
e-mail authentication standard (say, using both SPF and DomainKeys) could
stop 85% of phishing attacks in their current form. Although all four systems
rely on changes being made to DNS, they differ in the specific part of the e-mail
that each tests:
- SPF: Checks the "envelope sender" of an e-mail message -- the domain
name of the initiating SMTP server.
- SenderID: Checks after the message data is transmitted and examines
several sender-related fields in the header of an e-mail message to identify
the "purported responsible address."
- DomainKeys: Checks a header containing a digital signature of the
message. It verifies the domain of each e-mail sender as well as the
integrity of the message.
- Cisco Identified Internet Mail: Adds two headers to the RFC 2822 message
format to confirm the authenticity of the sender's address.
You should start preparing for e-mail authentication. All e-mail will eventually
have to comply with some type of sender verification methods if you want
it to get through. Successful deployment of e-mail authentication will probably
be achieved in stages, incorporating multiple approaches and technologies.
The following sections discuss these four approaches in greater detail.
E-MAIL AUTHENTICATION
The Sender Policy Framework (SPF)
SenderID
DomainKeys
Cisco Identified Internet Mail
|
PHISHING: CUTTING THE IDENTITY THEFT LINE
By Rachael Lininger and Russel Dean Vines
334 pages; $29.99
John Wiley & Sons
Read Chapter 6, Helping your organization avoid phishing
|
|
