|
The Internet Revolution has changed the way people communicate with each other. Letters, couriers, registered post, etc have been replaced by the ubiquitous email large volumes of documents can be immediately transferred via emails at a click of a button. Free or paid mail services have become a warehouse of personal information where everything from personal and professional mails, chats, contacts etc are stored. While an email address is necessary to log in to almost every popular social media forum – from Facebook, Twitter to LinkedIn, business transactions including proposals, RFP’s, financial details, etc., are frequently transferred on mails as well. A mail account today has become one of the most important IT assets of an individual, literally defining one’s identity on the internet. In such a situation, unauthorized access to one’s mail accounts can have unforeseeable ramifications not just for an individual but also for a complete organization – leakage of financial and marketing data, R&D papers, IP of a company, HR policies, and other such confidential information ensures that more than one organization gets affected by an unauthorized access to an account of a key personnel. This has led to unfortunate set of circumstances where rival companies hire groups of cyber criminals to target digital information of key personnel’s on the opposite side. Phishing, Social Engineering, customized malware to capture users mail credentials are rampantly being used to hack into mail ID’s. Over the last few years stealing digital information from user’s accounts has evolved from local ad-hoc hacking attacks into an internationally co-ordinated fraud on a massive scale. With thousands of people in an organization unaware of the security implications or know how of protecting their mail accounts, it becomes important for the organizations involved to protect their digital identity. (India is specifically targeted in roughly 10 percent of the world's phishing scams designed to lure online users to look-alike Web sites, where they are tricked into providing their personal mail accounts passwords, bank account numbers and more.) Securing Mail ID’s with Two Factor Authentication While most of the free mail services such as Gmail, Hotmail (Microsoft has just joined the bandwagon), and others provide users with a chance to login using 2FA. Corporates usually deploy mail exchange servers within their premises. Some of the popular mail exchange servers include Microsoft Exchange server, Zimbr and Oracle communications messaging server, among others. Users log into their corporate mails either using GUI or download their mails using one of the desktop agents such as Microsoft Outlook or Thunderbird. While most corporates usually have policies to restrict sharing of passwords and changing passwords after every ‘x’ number of days, these policies are human dependent and as a result prone to errors. Most corporate prefer to integrate their mail ID’s with Two Factor Authentication where the One Time Password is generated and sent to the user via SMS or generated using a Hard Token (A small key which generates a new password after specific intervals of time. The password is shown to the user on a LCD display screen), or a Mobile Token (An application to generate an OTP is installed on the phone itself) RSA, VASCO, Innefu etc are some of the popular companies providing Two Factor Authentication to companies to protect their Mail infrastructure. The integration is different for different scenarios but usually an agent is installed on the client’s application server to prompt the user to enter a One Time Password. The OTP is then validated by the authentication server, while the user name and password are validated as usual. For desktop mail clients such as Microsoft Outlook, a separate agent is installed which checks for all authentication requests. The user is required to enter his normal password followed by the OTP. The agent breaks the requests in two parts, gets the OTP validated by the Authentication server while the password is validated as normal. If you are one of the organizations which haven’t integrated 2 Factor Authentication with your mail architecture – and most organizations are yet to do that, you may be a potential target for a kid yet to complete his high school to a cyber criminal making money working for your rivals.
Related Articles -
Two Factor Authentication, 2 factor authentication, Hard Token, dual factor authentication,
| 
