Page 877 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

email.

Email is a common delivery mechanism for viruses, worms, Trojan
horses, documents with destructive macros, and other malicious code.

The proliferation of support for various scripting languages,
autodownload capabilities, and autoexecute features has transformed
hyperlinks within the content of email and attachments into a serious
threat to every system.

Email offers little in the way of source verification. Spoofing the source
address of email is a simple process for even a novice attacker. Email
headers can be modified at their source or at any point during transit.

Furthermore, it is also possible to deliver email directly to a user’s
inbox on an email server by directly connecting to the email server’s
SMTP port. And speaking of in-transit modification, there are no
native integrity checks to ensure that a message was not altered
between its source and destination.

In addition, email itself can be used as an attack mechanism. When

sufficient numbers of messages are directed to a single user’s inbox or
through a specific STMP server, a denial-of-service (DoS) attack can
result. This attack is often called mail-bombing and is simply a DoS
performed by inundating a system with messages. The DoS can be the
result of storage capacity consumption or processing capability
utilization. Either way, the result is the same: Legitimate messages

cannot be delivered.

Like email flooding and malicious code attachments, unwanted email
can be considered an attack. Sending unwanted, inappropriate, or
irrelevant messages is called spamming. Spamming is often little more
than a nuisance, but it does waste system resources both locally and
over the internet. It is often difficult to stop spam because the source
of the messages is usually spoofed.

Email Security Solutions

Imposing security on email is possible, but the efforts should be in
tune with the value and confidentiality of the messages being
exchanged. You can use several protocols, services, and solutions to
add security to email without requiring a complete overhaul of the