ITU-T X.1236 Security Requirements
Common Targeted Email Attacks
Common Targeted Email Attacks
Security requirements for common targeted email attacks
Synchronize Inbound and Outbound Inspections
Modify System Folder Structure of Email Security
Inspect Malware for Whitelisted Emails
Monitor Malicious ATO Attempts
Synchronize Inbound and Outbound Inspections
Synchronize Inbound and Outbound Inspections
Importance: Required / Reference to ITU-T X.1236 8.5.1 (1)
- Synchronization is necessary between inbound and outbound inspections for collected malicious files and data.
- This ensures that any malicious files or data detected in received emails are also checked for when the same files or data are part of outgoing emails.
- This synchronization prevents the transmission of malicious software or sensitive data via email when detected in received emails.
Modify System Folder Structure of Email Security
Modify System Folder Structure of Email Security
Importance: Required / Reference to ITU-T X.1236 8.5.1 (2)
- Regular changes to the folder structure make it difficult for attackers to predict or locate specific email folders, adding an additional layer of security to protect sensitive information.
Inspect Malware for Whitelisted Emails
Inspect Malware for Whitelisted Emails
Importance: Recommended / Reference to ITU-T X.1236 8.5.1 (3)
- While whitelists are a common method for allowing trusted sources, attackers may compromise trusted accounts.
- Continuously scanning for malicious code regardless of the source helps identify unusual or malicious content that bypasses initial filtering.
Monitor Malicious ATO Attempts
Monitor Malicious ATO Attempts
Importance: Recommended / Reference to ITU-T X.1236 8.5.1 (4)
- Monitoring attempts to maliciously take over user, security manager, and web accounts includes observing unauthorized access attempts to email accounts, login failures, and other signs of unauthorized access.
- Regular monitoring helps detect potential security threats early and allows for timely action to prevent unauthorized access.
Common Targeted Email Attacks
Security requirements for email diagnostic system
Provide User Reports for Secure Email Verification
Provide Diagnostic Reports Based on Email Security Status
Provide Risk Assessment for All Inbound Emails
Provide Regular Phishing Email Information
Provide Security Issue Warning Messages
Restore False-Positive Email
Provide User Reports for Secure Email Verification
Provide User Reports for Secure Email Verification
Importance: Required / Reference to ITU-T X.1236 8.5.2 (1)
- User reports for verifying the safety of received emails should be provided.
- These reports should offer information on the safety of emails received, enabling users to determine whether they can safely open the email.
- This helps users reduce the risk of exposure to malicious emails and improves overall email management security.
Provide Diagnostic Reports Based on Email Security Status
Provide Diagnostic Reports Based on Email Security Status
Importance: Required / Reference to ITU-T X.1236 8.5.2 (2)
- Diagnostic reports should be provided based on collected data to assess the email security status of an organization’s domain or servers.
- These reports should offer insights into the current security state, vulnerabilities, threats, and recommendations for improvement.
- This enables organizations to enhance email security and address vulnerabilities.
Provide Risk Assessment for All Inbound Emails
Provide Risk Assessment for All Inbound Emails
Importance: Required / Reference to ITU-T X.1236 8.5.2 (3)
- Calculated risk results for all received emails should be provided, and this information should be displayed alongside the emails.
- These results allow users to quickly assess the reliability of the emails they receive and promptly take action when necessary.
- This helps users identify malicious emails more efficiently and respond accordingly.
Provide Regular Phishing Email Information
Provide Regular Phishing Email Information
Importance: Recommended / Reference to ITU-T X.1236 8.5.2 (4)
- It is recommended to provide security administrators and users with regular information about blocked phishing emails.
- This information can serve as a warning and guide for preventive actions against malicious emails.
Provide Security Issue Warning Messages
Provide Security Issue Warning Messages
Importance: Recommended / Reference to ITU-T X.1236 8.5.2 (5)
- In cases of email deliveries with security issues, it is recommended to provide users with warning messages alongside the email subject.
- This allows users to identify malicious emails in advance and take appropriate actions.
Restore False-Positive Email
Restore False-Positive Email
Importance: Recommended / Reference to ITU-T X.1236 8.5.2 (6)
- It is recommended to offer the capability to restore incorrectly blocked emails in the security inspection process.
- This feature prevents legitimate emails from being lost when erroneously classified as blocked, providing a convenient option for email restoring.