There needs to be a change to email security if we want to stop seeing high profile security breeches such as the ones that hit Hotmail and Google in 2009, and the America law firm Gipson Hoffman & Pancione more recently.
The pattern of the attacks is simple enough.
The attacker sends you an email which looks like it’s from a contact, someone you trust, which prompts you to open the email which contains a link, which, when clicked on, will lead you to a malicious program which could infect your computer or network and steal your personal or corporate data.
The problem is, most email filtering systems will trust the email address and therefore allow it through.
What’s needed is a new approach to preventing spam. We need intelligent systems that can learn the behavior of the sender and the recipient and predict behavior.
In short, as the attacks get more sophisticated, so must the defense.
In 2009 Network Box released a system called ‘eMail Relationship Manager’, which tracks the features of the sender by envelope analysis to provide additional identifiers like source IP address and country of origin.
So, a fake email would be automatically blocked because the IP address of the sender would not be the same as the one stored in the system.
eMail Relationship Manager analyses and learns from the behavior of the sender and recipient of an email, and gives a score to the email which is applied in addition to traditional anti-spam filter analysis. It works by:
1. Maintaining a central database to store existing email accounts managed by Network Box on behalf of the email recipient (so genuine email from addresses kept in a users address book will be white-listed, assuming their content passes the traditional filter analysis which naturally includes the reputation of the sender).
This records and analyses historical information about the relationship in order to judge the likelihood of that email containing malware or unwanted content.
The database can be queried and adjusted at any time by Network Box, the organisation’s administrator, or the user.
It’s continually updated with every email passing through the system, and will challenge new behaviour, flagging up when a white-listed email address changes its shape – e.g. if a contact in Hong Kong suddenly starts sending emails from Russia.
2. All relationships are defined using a score based on sender + recipient + type analysis, and given a score based on the trust and strength of the relationship.
3. The system learns from user behaviour. For example, if the email user A sends an email to email user B, then the system understands that user A trusts user B, and therefore will strengthen the score of trust in that relationship.
4. If an email relationship is scored as low, then there are number of options open to the system, depending on its configuration. It can quarantine the email and notify the recipient (it can be released with a single click from the recipient if required); challenge the sender to confirm their identity; or defer the email.
To discover more about ‘eMail Relationship Manager’ or for more information about other Network Box products and services, please visit the Network Box website.
* * *
Stay Informed With ISR News Feeds and Email Alerts Here:
Simon Heron has over 19 years experience in the IT industry, including nine years experience in Internet security. During this time he has developed and designed technologies ranging from firewalls, anti-virus, LANs and WANs. Simon has an MSc (attained with Distinction) in Microprocessor Technology and Applications, and a BSc (Hons) in Naval Architecture and Shipbuilding and is a CISSP (Certified Information Systems Security Professional). Prior to Net Caboose, Simon co-founded Network Box Corporation (UK) Ltd and was Managing Director, finally merging this franchise with the parent company in 2006. Before Network Box, Simon joined the British Antarctic Survey (B.A.S.) as science project leader, and spent two Antarctic winters at the research station Halley in the Antarctic, developing and enhancing graphical technologies in the harshest of conditions. Simon also has a company called Net Caboose which deals with Identity and Access Management and is also development house.
Network Box Limited (NBL) is an international managed security services company, specialising in unified threat management (UTM). It continuously defends the networks of its customers using PUSH technology to instantaneously update protection, from 12 Security Operations Centres spread around the globe. NBL’s customers in Asia, Australia, North America and Europe include companies such as BMW, Nintendo and Toyota, as well as banks, utilities companies and government organisations.
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
