Does Your Email Reputation System Have a Bad Rep?

Written by CipherTrust

The recent spike inrepparttar volume of spam traveling acrossrepparttar 109518 Internet, combined withrepparttar 109519 dangers of phishing and virus attacks that frequently accompany these messages, has forced enterprises to reconsider how they determine which messages will be allowed into their network. The latest advances in anti-spam technology have been enabled in part byrepparttar 109520 use of reputation services which determinerepparttar 109521 “good” and “bad” senders. There are several approaches to determining a sender’s reputation; some more effective than others.

In order to determine whether senders are “good” or “bad”, organizations must haverepparttar 109522 ability to accurately identifyrepparttar 109523 sender of an email. Spammers and their ilk would prefer to hide their identities – especially for those that are engaged in open fraud such as phishing attacks. They modify email headers in an attempt to fool recipients into thinkingrepparttar 109524 email is coming from a legitimate source. This practice, called “spoofing”, is a common tactic used by spammers to obfuscate their true identities.

To confront this issue, Microsoft, CipherTrust and other industry leaders have worked to create standards that allow organizations to determine whether an email is coming from a legitimate sender. To date, there continues to be debate as to which technology will prevail. Microsoft’s Caller ID (now dubbedrepparttar 109525 Sender ID Framework or SIDF) has emerged as a front-runner along with Meng Weng’s Sender Policy Framework (SPF) .

Unfortunately, merely knowing who is sending an email doesn’t necessarily stop spam. As it turns out, spammers have been early adopters ofrepparttar 109526 new standards, they are better about applying for sender authentication technologies than normal corporations, and they are eager to participate!

Regardless of how many spammers adopt “honest” emailing practices,repparttar 109527 technology to identify email senders is quickly being adopted by major ISPs and corporations. Armed with that knowledge, reputation-based filtering can have a significant impact onrepparttar 109528 level of spam in everyone’s inbox.

There are a number of methods companies use to determine whether a given email sender has a “good” reputation. Some ofrepparttar 109529 most common tactics are:

By farrepparttar 109530 most costly method in terms of human resources, In-house lists require IT staff to maintain whitelists and blacklists in order to cut down onrepparttar 109531 spam problem. The difficulty with these programs is that they require thatrepparttar 109532 IT staff become knowledgeable about a host of email security and spam issues, andrepparttar 109533 investment is rarely sufficient to overcomerepparttar 109534 thousands of variations of nuisances and threats posed by spammers, phishers, and other dubious email senders. Byrepparttar 109535 timerepparttar 109536 administrator becomes aware of a new spam attack,repparttar 109537 spam has already gotten ontorepparttar 109538 network, and into users inboxes.

These whitelists and blacklists are built and maintained by third party organizations forrepparttar 109539 benefit of subscribers. These lists are subject to many ofrepparttar 109540 same problems faced by in-house administrators. In addition, some blacklists are maintained by vigilante groups that are quick to penalize an organization for spam; sometimes without due diligence and without giving that organization time to respond to spam charges. There is also a time-lag between when a spammer starts sending spam from a particular IP address and whenrepparttar 109541 address gets added torepparttar 109542 blacklist. Byrepparttar 109543 timerepparttar 109544 services become aware of a spammers activities,repparttar 109545 spammer has already sent millions of messages.

E-mail Security Governance: E-mail Encryption and Authentication as a Business Enabler

Written by CipherTrust

How to Easily Secure Your E-mail System and Comply with HIPAA, Sarbanes-Oxley, and GLBA Regulations

While recent government regulations vary in scope and purpose,repparttar need to protect and ensurerepparttar 109517 integrity of information is universal. Much ofrepparttar 109518 information germane to business today is assimilated and communicated over messaging platforms such as e-mail. As a result,repparttar 109519 need for a comprehensive approach torepparttar 109520 secure delivery of e-mail affects almost all organizations, regardless of industry or size. As with many management challenges,repparttar 109521 unknown isrepparttar 109522 most significant cause for concern. Inrepparttar 109523 case of e-mail and messaging security,repparttar 109524 most ominous threat is oftenrepparttar 109525 lack of ability to measure information flowing in and out ofrepparttar 109526 corporate e-mail network.

E-mail has traditionally been sent “in-the-clear,” meaning that e-mail headers and contents have been readily accessible to anyone withrepparttar 109527 ability to monitor network traffic. Traditionally, encryption technologies have been sufficiently difficult to implement that many businesses chose to sacrifice security inrepparttar 109528 name of user-friendliness given an application as mission-critical as e-mail. For example, some encryption and authentication technologies require ubiquitous adoption by each entity attempting to communicate, and few have ever agreed on which technologies are best or most efficient. Many businesses, committees and users have been attempting to standardize such use for well over a decade.

Overrepparttar 109529 last few years, however, regulations have been enacted that requirerepparttar 109530 business and technology communities to generate and implement secure e-mail solutions. Easy-to-use encryption and authentication are now readily available. The new challenge forrepparttar 109531 enterprise is to determine where and how to implement these new solutions to ensure compliance with new regulations. Understanding how each regulation affects e-mail security and delivery is important to understandingrepparttar 109532 pressures all IT managers will be under inrepparttar 109533 months and years to come.

E-mail Security Issues for Sarbanes-Oxley

The Sarbanes-Oxley Act of 2002 took effect in June of 2004 and requires CEOs, CFOs, independent auditors and audit committees to certifyrepparttar 109534 accuracy, confidentiality, privacy and integrity of financial statements -- andrepparttar 109535 effectiveness of internal controls and procedures for financial reporting and disclosures. The most relevant sections of Sarbanes-Oxley to e-mail security are sections 404 and 802.

  • Section 404 deals with internal controls, and requires organizations to implement controls overrepparttar 109536 release of information to individuals or organizations outsiderepparttar 109537 company’s network.
  • Section 802 addresses records management, and how long and in what manner documents (including e-mail) should be retained.

Sarbanes-Oxley does not detail specific steps organizations should take to comply with these regulations. Rather, it requires that companies implement programs that ensurerepparttar 109538 secure flow of information, and then to be able to documentrepparttar 109539 success and deficiencies of those programs. There exist some programs that are commonly used as a basis for implementation.

Corporations and business partners of companies affected by Sarbanes-Oxley, are required to ensure that sensitive information remains secure. Similar to HIPAA solutions, “Insider information” should not be accessible outside ofrepparttar 109540 perimeter of a company’s network. Encryption policies should be enforced whether a busy executive remembers to encrypt a message or not. Rogue employees should not be capable of transmitting sensitive financial information outsiderepparttar 109541 network. Detailed reports should be available to auditors showing howrepparttar 109542 system has successfully protectedrepparttar 109543 network and archived relevant communications. All of this can be handled swiftly with an e-mail governance policy and a central implementation mechanism. Without a mechanism in place, these requirements create a tangled web of complicated transactions and increased risk.

Unlike HIPAA, however, Sarbanes-Oxley often creates a need for organizations to prevent end-user encryption of information because encrypted information cannot be filtered for inappropriate content or trade secrets as it moves throughrepparttar 109544 e-mail servers and ontorepparttar 109545 Internet. E-mails should be sent torepparttar 109546 server as clear-text, and only oncerepparttar 109547 content has been cleared for release should it be encrypted according torepparttar 109548 organization’s policies.

The need to enforce centralized content policies, as well asrepparttar 109549 need to provide detailed reports to audit committees, requires server-level control and administration. The servers should be flexible in terms of encryption technology in order to maximizerepparttar 109550 utility of e-mail, while atrepparttar 109551 same timerepparttar 109552 network should be defended from external attacks

E-mail Security Issues for HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) came into effect on April 21, 2003. The act is designed to protectrepparttar 109553 confidentiality, integrity, and availability of Protected Health Information (PHI) for individuals. PHI is defined as information that includes any individually identifiable health information. Healthcare organizations that must comply with HIPAA regulations are known as Covered Entities (CEs). CE’s include hospitals, insurance providers, employer health plans, physicians, business partners, and contractors working with healthcare providers.

The primary rule within HIPAA that affects e-mail isrepparttar 109554 Security Rule. Exposed PHI within e-mail is considered a risk that will surface during a HIPAA risk assessment. Covered Entities are required to perform a HIPAA risk assessment and then to adopt appropriate safeguards depending uponrepparttar 109555 outcome ofrepparttar 109556 assessments they perform.

Healthcare organizations have reacted torepparttar 109557 new rule in a variety of ways, and with varying degrees of effectiveness. The efficiency of e-mail offers an attractive means to transmit healthcare information from one organization to another; howeverrepparttar 109558 need to secure each transmission of PHI has created complications as secure e-mail solutions are new and not fully implemented at many sites that transmit and store PHI.

Many encryption technologies requirerepparttar 109559 user to become familiar withrepparttar 109560 use of plug-ins and other specialized “client-side” encryption software. Encryption keys must be securely traded between partners, patients, providers, and other network members. More and more employees are involved in transmitting PHI overrepparttar 109561 internet now than ever before. The increase inrepparttar 109562 number of employees transmitting PHI has caused administrative costs to increase asrepparttar 109563 need to train employees in proper use of encryption technologies also increases.

Cont'd on page 2 ==> © 2005
Terms of Use