ITU-T X.1236 Security Requirements
Types of Targeted Outbound Email Attacks
Targeted Outbound Email Attacks
Security requirements for countering intentional information leakage
Hold Email Sending
Delay Email Sending
Hold Email Sending
Hold Email Sending
Importance: Required / Reference to ITU-T X.1236 8.3.1 (1)
- It is recommended that, if specific conditions set by the security administrator are met, email sending should be put on hold or blocked. This is an important security requirement to enhance the protection of emails containing confidential or sensitive data.
- For example, conditions may relate to the email’s recipients, attachment types, email subject, content, or the trustworthiness of the sender. When these conditions are met, the email is automatically held or blocked, allowing the security administrator to take additional actions.
- Email holding or blocking enables organizations to protect against potential security threats and prevent sensitive information from being leaked to external sources.
Delay Email Sending
Delay Email Sending
Importance: Required / Reference to ITU-T X.1236 8.3.1 (2)
- It is recommended that users can set a delay for email sending if specific conditions are met when sending an email. This is another crucial security requirement to provide additional protection for sensitive information.
- These conditions typically pertain to the processing time of sensitive documents or data attached to the email. For example, an email with sensitive documents could be configured to undergo security review and only be sent after approval.
- By implementing such delay settings, organizations can prevent inadvertent information leakage due to sending emails to the wrong recipients or containing inappropriate content, giving the sender an opportunity to carefully review and approve the email content.
Targeted Outbound Email Attacks
Security requirements for countering unintentional information leakage
Block Replies to Categorized Phishing Emails
Convert Large Attachments for Safe Delivery
Retrieve Safely Converted Large Attachments
Recall Email
Encrypt Conditional Email Content
Block Replies to Categorized Phishing Emails
Block Replies to Categorized Phishing Emails
Importance: Required / Reference to ITU-T X.1236 8.3.2 (1)
- When an incoming email is identified as originating from a malicious email address, the system should issue a warning to the recipient or automatically block the email.
- This helps prevent users from engaging with potentially harmful or phishing emails, reducing the risk of data leakage and security breaches.
Convert Large Attachments for Safe Delivery
Convert Large Attachments for Safe Delivery
Importance: Required / Reference to ITU-T X.1236 8.3.2 (2)
- Securely converting large attachments from an isolated internal network to the external network is crucial to prevent data leaks.
- The system should provide a secure method for converting and sending large attachments, ensuring that sensitive information remains protected during transit.
Retrieve Safely Converted Large Attachments
Retrieve Safely Converted Large Attachments
Importance: Required / Reference to ITU-T X.1236 8.3.2 (3)
- After converting and safely delivering emails with large attachments to the external network, it is essential to have a secure retrieval mechanism in place.
- This mechanism is crucial to ensure that users can securely access these emails, with a guarantee that no data is lost or leaked in the process.
Recall Email
Recall Email
Importance: Required / Reference to ITU-T X.1236 8.3.2 (4)
- Implementing an email recall feature is vital for preventing data leakage.
- Users should have the ability to recall sent emails, especially when they contain sensitive information that should not be accessible to unintended recipients.
Encrypt Conditional Email Content
Encrypt Conditional Email Content
Importance: Recommended / Reference to ITU-T X.1236 8.3.2 (5)
- Implementing email content encryption based on specific conditions, such as checking the sender’s IP address or monitoring the number of times an email is opened, is recommended.
- Encrypting outbound emails adds an extra layer of security, especially for sensitive communications
Targeted Outbound Email Attacks
Security requirements for countering attacks using account take-over (ATO)
Restrict Access for Specific IP Addresses and Countries
Detect Malware Identical to Inbound Email
Restrict Access for Specific IP Addresses and Countries
Restrict Access for Specific IP Addresses and Countries
Importance: Recommended / Reference to ITU-T X.1236 8.4.1 (1)
- It is recommended to provide administrators and users with the ability to manage access to email accounts based on specific IP address ranges and countries. Both administrators and users should have control over the security of their accounts.
- IP Address Restriction Setting: Provide email service administrators and users with the ability to specify specific IP addresses or IP address ranges to allow access. This allows access to the account only from specific geographic locations or network environments.
- Country Restriction Setting: Allow the configuration of countries or regions from which account access is allowed. This helps prevent account abuse from specific countries or regions.
- The system should log access attempts to email accounts and provide warning notifications to administrators and users for access attempts from IP addresses or countries outside the configured settings. This allows for the rapid identification and response to unauthorized access attempts to email accounts.
Detect Malware Identical to Inbound Email
Detect Malware Identical to Inbound Email
Importance: Recommended / Reference to ITU-T X.1236 8.4.1 (2)
- When sending emails, it is recommended to implement malware detection using the same methods as for incoming emails to protect against security threats. This includes cases where the sender’s account has been compromised, and malicious code is being sent via email.
- The email system should scan the contents of outgoing emails and apply filtering to detect malware. It should analyze attachments and links in emails to identify signs of malicious code.
- Implementing malware detection and blocking when sending emails is an important step in compliance with security regulations and standards. This ensures that malware is detected and prevented from being sent via email, even if the sender’s account has been compromised.
Targeted Outbound Email Attacks
Security requirements for countering unauthorized email server access
Block Unregistered SMTP and Country Access
Identify Details of Unauthorized Mail Server Attack
Verify Matching SMTP Information Between the Sender and Recipient
Block Unregistered SMTP and Country Access
Block Unregistered SMTP and Country Access
Importance: Required / Reference to ITU-T X.1236 8.4.2 (1)
- To enhance the security of email services, unregistered SMTP servers and access from specific countries must be blocked.
- Allowing only registered SMTP servers ensures a secure path for accessing the email server, preventing access from malicious email servers or other illicit servers.
- Blocking access from specific countries helps defend against attacks at a national level and controls geographically restricted access.
Identify Details of Unauthorized Mail Server Attack
Identify Details of Unauthorized Mail Server Attack
Importance: Required / Reference to ITU-T X.1236 8.4.2 (2)
- To detect and respond to unauthorized email server attacks, detailed information about email server access attempts must be identified.
- This information may include the original source IP address of the access attempt, the type of email server request, the number of attempts, access time, and more.
- Identifying such information allows for swift detection of illegal email server attacks and prevents forwarding this information to the email server.
Verify Matching SMTP Information Between the Sender and Recipient
Verify Matching SMTP Information Between the Sender and Recipient
Importance: Required / Reference to ITU-T X.1236 8.4.2 (3)
- When sending emails, the sender’s SMTP information should be compared with the recipient’s SMTP information, and if they do not match, email transmission should be blocked.
- This step is crucial for preventing spoofing attacks and verifying the source of emails.
- If the SMTP information of the sender and recipient does not match, the email server should identify this and enhance email security by blocking the email.