8 ) Email Monitoring

7問 • 9ヶ月前

問題一覧

Define and Categorize “ Email IOCs “:

- Define “ Spam “:, - This is unsolicited and unwanted junk email sent out in bulk to an indiscriminate recipient list., - Define “ Phishing “:, - The fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers., - Define “ Pretext “:, - A form of social engineering in which an individual lies and provides a false motive to obtain privileged data., - Define “ Spear Phishing “:, - An email spoofing attack targeting a specific organization or individual by seeking unauthorized access to sensitive information., - Define “ Impersonation “:, - This is an attack in which an adversary successfully assumes the identity of one of the legitimate parties in a system or in a communications protocol., - Define a “ Business Email Compromise (BEC) “:, - This is an impersonation attack in which the attacker gains control of an employee's account and uses it to convince other employees to perform fraudulent actions., - Define “ Forwarding “:, - When a phishing email is formatted to appear as if it has come as part of a reply or forward chain., - Many spoofing attempts can be detected by close examination of the Internet headers attached to a message.

Define and Categorize “ Email Header Analysis “:

- Define “ Email Internet Header “:, - A record of the email servers involved in transferring an email message from a sender to a recipient., - Attackers exploit the fact that there are actually three sender address fields in an email., - Display From:, - Support <support@diontraining.com>, - Support@diontraining.com <theft@badguy.com>, - Envelope From:, - Various labels hidden from mail client., - Received From/By:, - List of the MTAs that processed email., - Most headers are not displayed by email applications by default:, - Received: from protection2.outlook.com (2603:10a6:208:ac::18) by exchangelabs.com with HTTPS ; Tue, 24 Dec 2019 19:30:08 +0000, - Received: from protection1.outlook.com (10.152.16.53) by protection2.outlook.com (10.152.17.88) with Microsoft SMTP Server ; Tue, 24 Dec 2019 19:30:08 +0000, - Received: from openrelay.foo (w.x.y.z) by protection1.outlook.com (10.152.16.89) with Microsoft SMTP Server ; Tue, 24 Dec 2019 19:30:06 +0000, - Authentication-Results: spf=none (sender IP is w.x.y.z) smtp.mailfrom=spam.foo; hotmail.com; dkim=none (message not signed) header.d=none;hotmail.com; dmarc=none action=none header.from=spam.foo;, - Received-SPF: None (protection.outlook.com: spam.foo doesnot designate permitted sender hosts), - Received: from protection2.outlook.com (2603:10a6:208:ac::18) by exchangelabs.com with HTTPS ; Tue, 24 Dec 2019 19:30:08 +0000, - Received: from protection1.outlook.com (10.152.16.53) by protection2.outlook.com (10.152.17.88) with Microsoft SMTP Server ; Tue, 24 Dec 2019 19:30:08 +0000, - Received: from openrelay.foo (w.x.y.z) by protection1.outlook.com (10.152.16.89) with Microsoft SMTP Server ; Tue, 24 Dec 2019 19:30:06 +0000, - Authentication-Results: spf=none (sender IP is w.x.y.z) smtp.mailfrom=spam.foo; hotmail.com; dkim=none (message not signed)header.d=none;hotmail.com; dmarc=none action=none header.from=spam.foo;, - Received-SPF: None (protection.outlook.com: spam.foo does not designate permitted sender hosts), - Subject: Your account is blocked by the administrator Content-Transfer-Encoding: 7bit Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes Date: Wed, 25 Dec 2019 06:30:07 +0000 MIME-Version: 1.0 From: Gmail Accounts <spammer@spam.foo> To: recipient@hotmail.com Return-Path: spammer@spam.foo, - X-MS-Exchange-Organization-Expiration StartTime: 24 Dec 2019 19:30:07.8963 (UTC) X-MS-Office365-Filtering-Correlation-Id: ca0b527c-0b59-4085-cfc2-08d788a7af58 X-Sender-IP: w.x.y.z X-SID-PRA: SPAMMER@SPAM.FOO X-Microsoft-Antispam: BCL:8; X-MS-Exchange-Organization-SCL: 6, - X- headers indicate custom headers that are controlled by the SMTP server administrator, - - X-MS-Exchange-Organization-Expiration StartTime: 24 Dec 2019 19:30:07.8963 (UTC) X-MS-Office365-Filtering-Correlation-Id: ca0b527c-0b59-4085-cfc2-08d788a7af58 X-Sender-IP: w.x.y.z X-SID-PRA: SPAMMER@SPAM.FOO X-Microsoft-Antispam: BCL:8; X-MS-Exchange-Organization-SCL: 6, - - X-MS-Exchange-Organization-Expiration StartTime: 24 Dec 2019 19:30:07.8963 (UTC) X-MS-Office365-Filtering-Correlation-Id: ca0b527c-0b59-4085-cfc2-08d788a7af58 X-Sender-IP: w.x.y.z X-SID-PRA: SPAMMER@SPAM.FOO X-Microsoft-Antispam: BCL:8; X-MS-Exchange-Organization-SCL: 6

Define and Categorize “ Email Content Analysis “:

- An attacker must also craft some sort of payload to complete the exploit when a victim opens a message., - Define “ Multipurpose Internet Mail Extensions (MIME) “:, - This allows a body of an email to support different formats, such as HTML, rich text format (RTF), binary data encoded as Base64 ASCII characters, and attachments., - Define “ Malicious Payload “:, - An exploit or attachment that contains some sort of malicious code implemented within the message body., - Define “ Exploit “:, - A Message data contains scripts or objects that target some vulnerability in the mail client., - Define “ Attachment “:, - Message contains a file attachment in the hope that the user will execute or open it., - Define “ Embedded Link “:, - This a link can be composed of a friendly string plus the URL or a shortened URL to hide the identity of the real target., - Never click links from email messages., - WARNING: , - A missing or poorly formatted email signature block is an indicator for a phishing messagem)

Define and Categorize “ Email Server Security “:

- Spoofing attacks can be mitigated by configuring authentication for email server systems., - Define “ Sender Policy Framework (SPF) “:, - DNS record identifying hosts authorized to send mail for the domain with only one being allowed per domain., - TXT @ v=spf1 mx include:_spf.google.com include:email.freshdesk.com -all., - Define” DomainKeys Identified Mail (DKIM) “:, - Provides a cryptographic authentication mechanism for mail utilizing a public key published as a DNS record., - Define “ Domain-Based Message Authentication, Reporting, and Conformance (DMARC) “:, - A framework for ensuring proper application of SPF and DKIM utilizing a policy published as a DNS record., - DMARC can use either SPF or DKIM or both., - SPF, DKIM, and DMARC do not solve the problem of cousin domains., - Define “ Cousin Domains “:, - A Domain Name System (DNS) domain that looks similar to another name when rendered by a Mail User Agent (MUA)

Define and Categorize “ SMTP Log Analysis “:

- SMTP logs are typically formatted in request/response fashion:, - Time of request/response, - Address of recipient, - Size of message, - Status code, - Status Codes to know:, - Code 220:, - indicates the server is ready., - Code 250:, - indicates the message is accepted., - Code 421:, - indicates the service is not available., - Code 450:, - indicates that the server cannot access the mailbox to deliver a message., - Code 451: , - indicates the local server aborted the action due to a processing error., - Code 452:, - indicates the local server has insufficient storage space available.

Define and Categorize “ Email Message Security “:

- Define and Categorize “ Secure/Multipurpose Internet Mail Extensions (S/MIME) “:, - This is an email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications., - Jason sends Mary his digital certificate, containing his public key and validated digital ID (distinguished subject name and email address), and signs this message using his private key., - Mary uses the public key in the certificate to decode his signature and the signature of the CA (or chain of CAs) validating his digital certificate and digital ID and decides that she can trust Jason’s email address., - Mary responds with her digital certificate and public key and Jason, following the same process, decides to trust Mary., - Both Jason and Mary now have each another's certificates in their trusted certificate stores., - Using Public Key Cryptography to ensure integrity and non-repudiation., - A digital signature encrypts a hash of the message to provide integrity and nonrepudiation., - Encrypting the message with the receiver’s public key ensures confidentiality., - The email client will determine if the digital signature is valid and display an icon.

What are the controls in I.S.O 27001:2022 that cover Email Monitoring?

- Here are the key controls in ISO 27001:2022 that cover aspects of email monitoring:, - Technological Controls (Most Directly Applicable):, - A.8.15 Logging and Monitoring:, - This control is crucial for email monitoring. It requires the organization to log and monitor relevant activities on its communication systems, which includes email. , - This can involve logging email traffic metadata (sender, recipient, subject, timestamps), security events (spam detection, malware blocking), and potentially the content of emails where permissible and necessary for specific security or compliance reasons., - Example:, - Logging details of emails flagged as phishing attempts or emails containing attachments blocked due to malware., - A.8.16 Monitoring activities:, - This control emphasizes the continuous monitoring of systems and applications for unusual or suspicious behavior. , - In the context of email, this includes deploying and monitoring the effectiveness of email security solutions like anti-spam filters, anti-malware scanners, and data loss prevention (DLP) tools. , - Monitoring the alerts and logs generated by these systems is essential., - Example:, - Monitoring the quarantine logs of the email gateway to identify trends in phishing attacks or DLP alerts indicating potential data exfiltration via email., - A.8.12 Data leakage prevention:, - DLP tools often include email monitoring capabilities to detect and prevent sensitive information from being transmitted outside the organization via email. , - Monitoring for policy violations and potential data leaks through email falls under this control., - Example:, - Configuring DLP rules to identify emails containing confidential project names or customer financial data and monitoring for instances where these rules are triggered., - Organizational Controls (Supporting Email Monitoring):, - A.5.18 Information security policies for topics specific to ICT:, - This allows for the creation of specific policies regarding the acceptable use of email, security guidelines, and the organization's approach to email monitoring. , - These policies should clearly define what is monitored and the reasons for monitoring., - Example:, - An "Email Usage Policy" might state that email communications are subject to monitoring for security, compliance, and business continuity purposes., - A.6.2 Mobile device policy:, - If employees access email on mobile devices, this policy should address the security aspects of mobile email usage, which might include monitoring capabilities or restrictions to prevent data leakage., - Example:, - Implementing controls that prevent the copying of sensitive email content to personal apps on mobile devices and monitoring for policy violations., - A.5.36 Compliance with legal and contractual requirements:, - Certain regulations or contractual obligations might necessitate email monitoring for compliance purposes (e.g., monitoring for insider trading or adherence to industry-specific communication standards). , - This control ensures that such requirements are identified and addressed through appropriate monitoring activities., - Example:, - Financial institutions might be required to monitor employee email communications for regulatory compliance., - Important Considerations:, - Privacy:, - Email monitoring must be conducted with careful consideration for employee privacy and in accordance with applicable laws and regulations. , - Transparency about the extent and purpose of monitoring is crucial., - Purpose:, - The purpose of email monitoring should be clearly defined (e.g., security, compliance, preventing data leakage). , - Monitoring should be proportionate to the identified risks and objectives., - Legal and Ethical Implications:, - Organizations must be aware of the legal and ethical implications of email monitoring in their jurisdiction and ensure their practices are lawful and ethical., - General Information:, - While ISO 27001:2022 doesn't have a dedicated "Email Monitoring" control, the principles and requirements for securing and overseeing email communications are addressed through the controls related to :, - logging, monitoring, data leakage prevention, and organizational policies. , - Organizations seeking certification need to demonstrate that they have implemented appropriate measures to monitor email activity in line with their risk assessment, security objectives, and legal obligations.

THE P.T: 1 CHRONICLE: ( ex.9 )

The R.S.S.H Delivery Company · 90問 · 6ヶ月前

THE P.T: 1 CHRONICLE: ( ex.9 )