2 cissp ® Official Study Guide Eighth Edition

Understand Email Security Issues
The first step in deploying email security is to recognize the vulnerabilities specific to email. 
The standard protocols used to support email (i.e., SMTP, POP, and IMAP) do not employ 
encryption natively. Thus, all messages are transmitted in the form in which they are sub-
mitted to the email server, which is often plain text. This makes interception and eaves-
dropping easy. However, the lack of native encryption is one of the least important security 
issues related to email.
Email is a common delivery mechanism for viruses, worms, Trojan horses, documents 
with destructive macros, and other malicious code. The proliferation of support for various 
scripting languages, autodownload capabilities, and autoexecute features has transformed 
hyperlinks within the content of email and attachments into a serious threat to every 
system.
Email offers little in the way of source verification. Spoofing the source address of email 
is a simple process for even a novice attacker. Email headers can be modified at their source 
or at any point during transit. Furthermore, it is also possible to deliver email directly to 
a user’s inbox on an email server by directly connecting to the email server’s SMTP port. 
And speaking of in-transit modification, there are no native integrity checks to ensure that 
a message was not altered between its source and destination.

---

Manage Email Security 
533
In addition, email itself can be used as an attack mechanism. When sufficient numbers 
of messages are directed to a single user’s inbox or through a specific STMP server, a 
denial-of-service (DoS) attack can result. This attack is often called mail-bombing and is 
simply a DoS performed by inundating a system with messages. The DoS can be the result 
of storage capacity consumption or processing capability utilization. Either way, the result 
is the same: Legitimate messages cannot be delivered.
Like email flooding and malicious code attachments, unwanted email can be considered 
an attack. Sending unwanted, inappropriate, or irrelevant messages is called spamming. 
Spamming is often little more than a nuisance, but it does waste system resources both 
locally and over the internet. It is often difficult to stop spam because the source of the 
messages is usually spoofed.