Domain Name Systems-Based Electronic Mail Security Nist Sp 1800-6

Includes an excerpt from "Cyber-Physical Attack Defenses: Preventing Damage to Buildings and Utilities" by Luis Ayala

Both public and private sector business operations are heavily reliant on email exchanges, leading to concerns about email security and the use of email as an attack vector. Organizations are motivated by the need to protect the integrity of transactions containing financial and other proprietary information, and to protect the privacy of employees and clients. Cryptographic functions are usually employed to perform services such as authentication of the source of an email message, assurance that the message has not been altered by an unauthorized party, and to ensure message confidentiality. Most organizations rely on mail servers to provide security at an enterprise level in order to provide scalability and uniformity. However, many server-based email security mechanisms are vulnerable to attacks involving faked or fraudulent digital certificates, otherwise invalid certificates, and failure to actually invoke a security process as a result of connection to (or through) a fraudulent server.

Even if there are protections in place, some attacks have been able to subvert email communication by attacking the underlying support protocols such as Domain Name Systems (DNS). Attackers can spoof DNS responses to redirect email servers and alter email delivery. DNS Security Extensions (DNSSEC) was developed to prevent this. DNSSEC protects against unauthorized modifications to network management information and host IP addresses. DNSSEC can also be used to provide an alternative publication and trust infrastructure for service certificates using the DNS-based Authentication of Named Entities (DANE) resource records. SP 1800-6 describes several demonstrated security platforms using DNS, DNSSEC, and DANE for trustworthy email exchanges across organizational boundaries. The security platforms described provide reliable authentication of mail servers, digital signature and encryption of email, and reliable binding of cryptographic key certificates to sources and servers. The example solutions and architectures presented are based upon standards-based open-source and commercially available products.

Why buy a book you can download for free?

First you gotta find it and make sure it's the latest version, not always easy. Then you gotta print it using a network printer you share with 100 other people - and its outta paper - and the toner is low (take out the toner cartridge, shake it, then put it back). If it's just 10 pages, no problem, but if it's a 250-page book, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. An engineer that's paid $75 an hour has to do this himself (who has assistant's anymore?).

If you are paid more than $10 an hour and use an ink jet printer, buying this book will save you money.

It's much more cost-effective to just order the latest version from Amazon.com

This public domain material is published by 4th Watch Books. We publish tightly-bound, full-size books at 8 1/2 by 11 inches, with glossy covers. 4th Watch Books is a Service Disabled Veteran Owned Small Business (SDVOSB) and is not affiliated with the National Institute of Standards and Technology.

For more titles published by 4th Watch, please visit: cybah.webplus.net

GSA P-120 Cost and Schedule Management Policy Requirements

GSA Standard Level Features and Finishes for U.S. Courts Facilities

GSA Courtroom Technology Manual

NIST SP 500-299NIST Cloud Computing Security Reference Architecture

NIST SP 500-291NIST Cloud Computing Standards Roadmap Version 2

NIST SP 500-293US Government Cloud Computing Technology Roadmap Volume 1 & 2

NIST SP 500-293US Government Cloud Computing Technology Roadmap Volume 3 DRAFT