Security in Email
-SMIME
-PGP
Security in Web
-SSL
-SSH
-SET
-HTTPS
-SFTP
What is Email?
What is “Email Services”?
*Hosted Email: Lets you offer email service to your customers without the hassle. As the name implies, we host and maintain the email server, while you manage email accounts via a web interface or API. We take care of the headaches of running the system, so you can concentrate on taking care of your customers.
*Email Defense: Our anti-spam/anti-virus service, which you can use in conjuction with either our hosted email service or any other email service out there. As with hosted email, we run the system and maintain it, you provision the service and focus on customer service
What is Hosted Exchange?
-To stay competitive in today’s business environment, you need sophisticated messaging tools that provide rich and efficient access to email, calendars, contacts, and tasks. Now you can enjoy the benefits of business-class email in a pay-as-you-go model that enables you to scale up or down as needed, minimizing your financial risk.
-myhosting.com Hosted Exchange Email can help you free up valuable capital, IT staff, and other costly resources for more effective, strategic use within your organization.
-At myhosting.com, we operate your email server so you don’t have to. Based on Microsoft® Solution for Hosted Messaging and Collaboration, our infrastructure and provisioning systems enable us to offer our customers rich email, mobility, collaboration, and messaging services.
Security provided in E-mail
-Confidentiality -Data origin authentication
-Message integrity
-Non-repudiation of origin
-Key management
MIME
**MIME = Multipurpose Internet Mail Extensions
-Extends the capabilities of RFC 822 to allow e-mail to carry non-textual content, non-ASCII character sets, long messages.
-Uses extra header fields in RFC 822 e-mails to specify form and content of extensions.
-Supports a variety of content types, but e-mail still ASCII-coded for compatibility.
-Specified in RFCs 2045-2049.
MIME Message
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="frontier"
This is a message with multiple parts in MIME format.
--frontier
Content-Type: text/plain
This is the body of the message.
--frontier
Content-Type: application/octet-stream
Content-Transfer-Encoding: base64
PGh0bWw+CiAgPGhlYWQ+CiAgPC9oZWFkPgogIDxib2R5PgogICAgPHA+VGhpcyBpcyB0aGUg
Ym9keSBvZiB0aGUgbWVzc2FnZS48L3A+CiAgPC9ib2R5Pgo8L2h0bWw+Cg==
--frontier--
E-mail Security Threats
*Two main group:
-Threats to the security of e-mail itself
-Threats to an organisation that are enabled by the use of e-mail.
*Loss of confidentiality.
-E-mails are sent in clear over open networks.
-E-mails stored on potentially insecure clients and mail servers.
-Ensuring confidentiality may be important for e-mails sent within an organisation.
*Loss of integrity.
-No integrity protection on e-mails; body can be altered in transit or on mail server.
*Lack of data origin authentication.
-Is this e-mail really from the person named in the From: field?
-How many Kenny.Paterson’s are there?
-Recall SMTP directly over telnet allows forgery of all e-mail fields!
-E-mail could also be altered in transit.
-Even if the From: field looks fine, who was logged in as Kenny.Paterson when the e-mail was composed?
-Sharing of e-mail passwords common.
S/MIME
-(Secure / Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of e-mail encapsulated in MIME.
-S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFCs. S/MIME was originally developed by RSA Data Security Inc. The original specification used the recently developed IETF MIME specification with the de facto industry standard PKCS #7 secure message format.-Change control to S/MIME has since been vested in the IETF and the specification is now layered on Cryptographic Message Syntax, an IETF specification that is identical in most respects with PKCS #7.
S/MIME support
*Enveloped Data-Encrypted content
*Signed Data-Digital signature
*Clear Signed Data-Can view content but signature must have the S/MIME capacbility
*Signed and Enveloped Data-Used both
Pretty Good Privacy
-Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was originally created by Philip Zimmermann in 1991.
-PGP and other similar products follow the OpenPGP standard (RFC 4880) for encrypting and decrypting data.
-One level of processing only, so less flexible than S/MIME.
-Sign before encrypt, so signatures on unencrypted data.:-Sigs can be detached and stored separately.
PGP-processed data is base64 encoded and carried inside RFC822 message body
Web Security
-Web security includes:
*Security of server
*Security of client
*Network traffic security between a browser and a server
-SSL/TLS
#SSL/TLS widely used in Web browsers and servers to support ‘secure e-commerce’ over HTTP.
--Built into Microsoft IE, Netscape, Mozilla, Apache, IIS
--The (in)famous browser lock.
#SSL architecture provides two layers:
--SSL Record Protocol
-Provides secure, reliable channel to upper layer.
--Upper layer carrying:
-SSL Handshake Protocol, Change Cipher Spec. Protocol, Alert Protocol, HTTP, any other application protocols.
SSL/TLS Applications
*Secure e-commerce using SSL/TLS.
*Client authentication not needed until client decides to buy something.
*SSL provides secure channel for sending credit card information, personal details, etc.
*Client authenticated using credit card information, merchant bears (most of) risk.
*Very successful (amazon.com, on-line supermarkets, airlines,…)
-SSH
*SSH = Secure Shell.
--Initially designed to replace insecure rsh, telnet utilities.
--Secure remote administration (mostly of Unix systems).
--Extended to support secure file transfer and e-mail.
--Latterly, provide a general secure channel for network applications.
*SSH-1 flawed, SSH-2 better security (and different architecture).
--SSH provides security at Application layer.
--Only covers traffic explicitly protected.
--Applications need modification, but port-forwarding eases some of this (see later).
--Built on top of TCP, reliable transport layer protocol.
SSH Applications
*Anonymous ftp for software updates, patches...
-No client authentication needed, but clients want to be sure of origin and integrity of software.
*Secure ftp.
-E.g.upload of webpages to webserver using sftp.
-Server now needs to authenticate clients.
-Username and password may be sufficient, transmitted over secure SSH transport layer protocol.
*Secure remote administration.
-SysAdmin (client) sets up terminal on remote machine.
-SysAdmin password protected by SSH transport layer protocol.
-SysAdmin commands protected by SSH connection protocol.
*Guerilla Virtual Private Network.
-E.g. use SSH + port forwarding to secure e-mail communications.
-SET
*SET = an open encryption and security specification designed to protect credit card transactions on the internet
*Use SSL to secure the communication links
*Main requirements
-Confidentiality of payment and ordering information
-Integrity of all transmitted data
-Authentication of cardholder
-Authentication of merchant
How to secure the web
*Authentication:
-Basic (username, password):-Can be used along with cookie
-Digest
*Access control via addresses
*Multi-layered:
-S-http (secure http), just for http:-Proposed by CommerceNet, pretty much dead
-SSL (TLS), generic for TCP :-https: http over SSL
-IPSec
Secure File Transfer Protocol (S/FTP)
*S/FTP is an interactive file transfer program
*Similar to ftp
*Performs all operations over an encrypted ssh transport
*Use many features of ssh such as public key authentication and compression
*S/FTP connects and logs into the specified host, then enters an interactive command mode
0 comments:
Post a Comment