◇ OpenCyber Academy
Technologist · Chapter 17 · English

Chapter 17 — Email security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 17 — Email security

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Filtering"]
  N2["17.2 Domain authentication"]
  N3["17.3 Reported phishing"]
  N4["17.4 Payment fraud"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Filtering"]
  N2["17.2 Domain authentication"]
  N3["17.3 Reported phishing"]
  N4["17.4 Payment fraud"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Filtering]
    |
    v
[17.2 Domain authentication]
    |
    v
[17.3 Reported phishing]
    |
    v
[17.4 Payment fraud]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) configure email filtering and authentication; (2) handle reported phishing; (3) protect against payment fraud.

17.1 Filtering

Riverbend's email provider filters spam and malware. Jamal reviews the settings and enables additional protections: warnings on external emails, blocking of risky attachment types and checking links when clicked. He tests the settings with harmless test messages in the laboratory. Ms. Grant explains that filtering catches most attacks, but the remainder reach staff, so other controls are needed as well. He measures the effect over a month and finds that the number of suspicious emails reaching staff falls noticeably. He records the settings in the documentation, so they can be checked after any change made by the email provider.

17.2 Domain authentication

Jamal learns how email authentication records let receiving systems check whether a message claiming to come from Riverbend really did. He finds that Riverbend's records are incomplete, so fake messages using its domain may be delivered to members. He works with the IT manager to complete the records, starting in monitoring mode and moving to rejection once legitimate sending services are all listed. He lists every service that sends email for Riverbend, including the booking system and a newsletter service, before moving to rejection. This prevents genuine messages being blocked.

17.3 Reported phishing

Jamal sets up a report button so staff can forward suspicious emails easily. He reviews reports each morning, removes confirmed phishing from all mailboxes and thanks reporters. In one week, a receptionist reports a message asking for gift card purchases, apparently from a centre manager. Jamal finds the same message sent to five centres and removes it everywhere. He learns that one report can protect many staff. He records each report, its outcome and how quickly it was handled, and shares a monthly summary with the IT manager.

17.4 Payment fraud

Fraudsters often impersonate suppliers to change bank details. Jamal helps finance write a rule: any bank detail change must be confirmed by phone using a number already on file, never one from the email. He also adds a warning in the finance system when bank details change. Ms. Grant notes that process controls are essential against fraud, because a well-crafted fraudulent email may pass every technical filter. The finance manager adds the rule to the finance procedures and briefs her team. Within a month, a fake supplier request is caught by the call-back.

Worked example

Jamal tightens filtering, completes email authentication records, runs a report button that stops a gift card scam across five centres and adds a bank detail call-back rule.

Synthetic case. Messages are synthetic.

Errors and limits

Technical filters alone cannot stop well-crafted payment fraud.

Exercises

Continue studying — lesson 17 (chapter 17 of 30)

← Chapter 16 · Course chapter index · Chapter 18 →

Continue to the next authored lesson.