ITU-T X.1236 Security Requirements
Types of Targeted Inbound Email Attacks
Targeted Inbound Email Attacks
Security requirements for countering zero-day malware
Inspect Behavior-Based Analysis
Report Malware Behavior
Inspect Behavior-Based Analysis
Inspect Behavior-Based Analysis
Importance: Required / Reference to ITU-T X.1236 8.1.1 (1)
- Conducting behavior-based analysis inspections to detect newly discovered novel viruses is a crucial security functionality requirement. This requirement is used to identify novel malware or malicious activities that cannot be detected by traditional virus definition files.
- Behavior-based analysis involves executing viruses or malicious software in a virtual environment to detect specific behaviors or malicious activities. For example, it analyzes behaviors such as file system changes, registry modifications, network communication patterns, process execution, etc., to identify malicious activities.
- To achieve this, continuous monitoring of the characteristics and patterns of novel malware is necessary, and immediate response measures should be in place when such activities are detected.
Report Malware Behavior
Report Malware Behavior
Importance: Required / Reference to ITU-T X.1236 8.1.1 (2)
- Reporting on the behaviors of newly discovered or detected malware is a critical step for rapid response and contributing to the overall security ecosystem. This involves sharing information about the characteristics, functionalities, and behaviors of malware with other security companies or communities.
- The reported information aids in the identification and analysis of malware, enhances security updates, and improves defensive measures. It helps prevent the spread of malware, enables swift responses, and provides valuable information to other organizations and the security community.
- The reporting process should adhere to standardized procedures and protocols for accurate behavior-based analysis and information sharing.
Targeted Inbound Email Attacks
Security requirements for countering malware in email attachments
Inspect File Extension
Analyze Email Reputation
Inspect File Extension
Inspect File Extension
Importance: Required / Reference to ITU-T X.1236 8.1.2 (1)
- Inspecting various file types with potentially forged or hidden file extensions is a critical security requirement to enhance security.
- Malicious code or malicious programs often manipulate file extensions, enabling them to execute malicious code when users open or download files.
- File extension inspection involves comparing file extensions with actual file formats to detect altered extensions and identify malicious files. Detected files are then blocked from access to maintain system security.
- Examples of forged file extensions include:
- Using a .doc file extension for an executable file: Executable files typically have extensions like .exe, .dll, .bat, etc. However, attackers may use a .doc file extension to disguise an executable file.
- Using a .exe file extension for an image file: Image files typically have extensions like .jpg, .png, .gif, etc. However, attackers may use a .exe file extension to disguise an image file.
- Using an .mp3 file extension for a text file: Text files typically have extensions like .txt, .doc, .pdf, etc. However, attackers may use an .mp3 file extension to disguise a text file.
Analyze Email Reputation
Analyze Email Reputation
Importance: Recommended / Reference to ITU-T X.1236 8.1.2 (2)
- Providing email reputation analysis is an additional recommended security feature requirement. It helps verify the credibility and trustworthiness of the email’s source and sender.
- Email reputation analysis evaluates factors such as the reliability of the email server, content within the email subject and body, links and images in the email, and the domain of the email address and sender identification.
- Reputation analysis provides information about the email’s trustworthiness and assists users in determining whether an email is safe. Low-trust emails can be flagged or blocked, while trusted emails are delivered as usual. This helps prevent social engineering attacks and email spoofing, ensuring that users open emails only from trusted sources.
Targeted Inbound Email Attacks
Security requirements for countering malware in email URLs
Track Final URLs
Inspect Post-URLs
Deactivate URLs
Track Final URLs
Track Final URLs
Importance: Required / Reference to ITU-T X.1236 8.1.3 (1)
- When analyzing multi-linked URLs, it is crucial to track and verify all intermediate and final URLs. This process is a critical step in confirming whether each URL contains malicious code.
- Attackers may lead or confuse users through various intermediate URLs, so it is essential to thoroughly analyze each URL to identify the final destination URL.
- Examine whether each URL originates from a trusted source, has a security certificate, and does not contain strange strings or obfuscated code to ensure its integrity.
Inspect Post-URLs
Inspect Post-URLs
Importance: Required / Reference to ITU-T X.1236 8.1.3 (2)
- To prevent malicious code attacks even after email users receive and execute URLs, post-URL inspection is essential.
- When a user clicks on a URL and accesses a web page, the content of that web page should be monitored periodically. If malicious activity is detected, the user should be alerted or access should be blocked.
- This ensures that URLs, initially deemed safe, do not later transform into malicious websites that harm users.
- Regular URL inspection allows for continuous user security and enables swift detection and response to malicious activities.
Deactivate URLs
Deactivate URLs
Importance: Recommended / Reference to ITU-T X.1236 8.1.3 (3)
- Deactivating URL links to prevent users from accidentally opening malicious URLs is a recommended additional security measure.
- This minimizes the likelihood of users being exposed to malicious URLs and helps prevent malicious code attacks.
- Such functionality reduces security threats stemming from user mistakes or carelessness and encourages careful judgment before clicking on URLs.
Targeted Inbound Email Attacks
Security requirements for countering forged headers
Detect Reply-to Email Address Change
Verify Mail Communication Protocol Compliance
Detect Reply-to Email Address Change
Detect Reply-to Email Address Change
Importance: Required / Reference to ITU-T X.1236 8.1.4 (1)
- When replying to an email, it is necessary to compare the reply email address with the sender’s address in the original email and alert or block the user if they differ.
- This helps prevent attackers from tampering with the original email to confuse users.
- Users receive a warning about any changes in email addresses before sending a reply, preventing fraudulent activities and maintaining trusted communication.
Verify Mail Communication Protocol Compliance
Verify Mail Communication Protocol Compliance
Importance: Recommended / Reference to ITU-T Standard: 8.1.4 (2)
- It is crucial to analyze the headers of received emails to confirm compliance with mail communication protocols. Commonly used mail communication protocols include SMTP (Simple Mail Transfer Protocol) and IMAP (Internet Message Access Protocol) or POP3 (Post Office Protocol).
- If an email’s header is found not to comply with mail communication protocols or uses abnormal protocols, it should be blocked.
- Ensuring protocol compliance allows for the secure transmission and reception of email traffic, preventing third parties from attempting to manipulate data in transit.
- Protocol compliance is essential for email security and integrity, and it is important to install the latest versions and security updates for email client and server software to adhere to these protocols.
Targeted Inbound Email Attacks
Security requirements for countering look-alike domains
Notify Risk Similarity Level
Detect Differences in Email Address Character Count
Register Suspicious Similar Email Addresses
Manage Similar Email Addresses with Different TLDs Separately
Notify Risk Similarity Level
Notify Risk Similarity Level
Importance: Required / Reference to ITU-T X.1236 8.2.2 (1)
- Analyze the sender’s email address or domain of the received email and collect the cumulative email history of that sender to determine the Risk Similarity Level if the sender’s email address or domain is considered a similar domain. If a similarity is detected, alert the user and, if necessary, block the email.
- For example, if a user has received malicious emails from similar domains in the past, the system should detect similarities and warn the user or block the email accordingly.
- Risk Similarity Level Notification is a crucial feature in email security systems that informs users of potential risks when the sender’s email address or domain is identified as a similar domain.
- The Risk Similarity Level is determined based on algorithms and policies embedded in the email security system.
- The Risk Similarity Level is typically categorized as follows:
- Low: Similar domains are detected, but significant risks are not identified.
- Medium: Similarities in some emails are detected.
- High: High similarity is detected in the email.
- Once the Risk Similarity Level is determined, it should be communicated to the user. Users should be able to see that the received email has been categorized as a similar domain and check the Risk Similarity Level associated with that domain.
Detect Differences in Email Address Character Count
Detect Differences in Email Address Character Count
Importance: Required / Reference to ITU-T X.1236 8.2.2 (2)
- Apply criteria for detecting fraudulent similar email addresses based on the character count difference in email addresses.
- For example, if the character count difference compared to the genuine email address exceeds a specific threshold (usually within 1-3 characters), consider it as a suspicious similar domain and alert or block the email accordingly.
- This approach ensures sensitive detection of even minor character count differences, enabling more accurate detection of similar domains.
Register Suspicious Similar Email Addresses
Register Suspicious Similar Email Addresses
Importance: Recommended / Reference to ITU-T X.1236 8.2.2 (3)
- It is recommended to provide email security administrators with the capability to manually register suspicious similar email addresses.
- This allows administrators to promptly respond to new threats and monitor similar domains to protect users.
- The administrator registration feature offers flexibility to security teams, aiding in the rapid response and discovery of new attack patterns.
Manage Similar Email Addresses with Different TLDs Separately
Manage Similar Email Addresses with Different TLDs Separately
Importance: Recommended / Reference to ITU-T X.1236 8.2.2 (4)
- It is recommended to implement separate management for cases where email addresses are similar but have different top-level domains (TLDs).
- For instance, if the original TLD is “example.com” and an attacker uses the “example.net” domain to send emails, these two domains should be identified and monitored separately, with appropriate security measures applied.
- This approach allows users to distinguish between emails received from different domains and prevents attackers from bypassing email security by using similar domains.
Targeted Inbound Email Attacks
Security requirements for countering account take-over (ATO)
Detect Sender's Location (IP) Changes
Detect Mail Server IP Address Changes
Detect Changes in Email Delivery Paths
Detect Sender's Location (IP) Changes
Detect Sender’s Location (IP) Changes
Importance: Required / Reference to ITU-T X.1236 8.2.3 (1)
- When receiving an email, it’s essential to verify the sender’s IP address, and if it differs from previous received emails, the user should be alerted or the email should be blocked.
- This verification helps validate the source of the email and is a critical security measure to protect against potential threats.
- For example, if a user’s account is accessed from a different location or using a different IP address than before, detecting and alerting the user can help prevent illegal access or account intrusion attempts.
- Attackers may attempt to deceive users by changing IP addresses, so detecting differences from previous emails is crucial.
Detect Mail Server IP Address Changes
Detect Mail Server IP Address Changes
Importance: Required / Reference to ITU-T X.1236 8.2.3 (2)
- It’s vital to verify the sending mail server’s IP address and, if it differs from previous received emails, alert or block the email.
- This verification ensures the reliability of the mail server and allows for the rapid identification of emails coming from different servers to ensure user safety.
- Attackers may use different mail servers to send malicious emails, so detecting changes in mail server IPs and responding is necessary.
- This approach helps detect emails from mail servers different from those used before, maintaining the integrity of email traffic.
Detect Changes in Email Delivery Paths
Detect Changes in Email Delivery Paths
Importance: Recommended / Reference to ITU-T X.1236 8.2.3 (3)
- It is recommended to verify the delivery path of the email and, if it differs from previous received emails, alert or block the email.
- This is an important measure to prevent data tampering or intermediary attacks.
- Therefore, tracking the email’s path and detecting changes in the middle can help maintain the integrity of email delivery.
- Changes in the email delivery path may indicate significant alterations in email traffic, and monitoring such changes helps protect users.
- For instance, if an email is delivered through an unexpected route or does not pass through important mail servers, detecting and alerting the user can prepare them for security threats.
Targeted Inbound Email Attacks
Security requirements for countering URL phishing
Track Final Destination of URLs
Track Final Destination of URLs
Track Final Destination of URLs
Importance: Required / Reference to ITU-T X.1236 8.2.4
- Analyzing the URL or link clicked by the user to track and verify the ultimate destination of that URL is crucial.
- URL redirection is one of the attack techniques that can lead users through multiple stages to a phishing web page.
- Therefore, it is necessary to trace all URL redirections that occur in between in a chain to understand where the user will ultimately land and prevent malicious activities on web pages designed to induce personal information input.