For instance if the email system uses POP3 legacy protocol and SMTP but is not encrypted, yet the business continues to use it for daily purposes both internally and externally, what could be the potential security risks for the organisation regarding this matter?
closed as too broad by Eric G, Xander, TildalWave, Iszi, Adi Apr 30 '14 at 5:57
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
When users connect to a mail server via the public internet, all emails and their content are transfered in plaintext. The employees username and password for their mail account are also transfered in plaintext, unless the mail server uses APOP authentication. Anyone who is able to eavesdrop on the connection could easily obtain this information.
An eavesdropper could obtain the following information:
- Confidential content of emails and their attachments
- Names and email addresses of correspondence partners
- When the server uses plain authentication, they can also sniff the employees username and password
- Which allows the attacker to convincingly write emails in their name
- Which the employee might also use for different systems which belong to the company
The following parties could perform such an attack, for example:
- Anyone controlling a WLAN access point used by the employee
- Anyone on the same unsecured WLAN as the employee
- Any VPN or other anonymization service the employee uses, when it is used to access the email service
- The employees internet service provider
- Any internet backend providers between the employees ISP and the mail server
All except the last two are irrelevant when the access happens only from the network of the company and not from employees at home or on business trips. The last two are only relevant for organizations with very high security needs, because ISPs can usually be trusted to keep their users traffic confidential as long as it is not a matter of national security/interest (keep in mind that industrial espionage is part of the job description of many national secret services around the world, sometimes even officially).
How much of a risk this is depends on what the company is actually doing and how confidential their correspondence is.
One of the most serious consequences of a compromised email account is that the attacker can use it to reset the login credentials to a lot of online services, where that email address is used to log in.
An example attack could follow this process:
- While the employee is using their WiFi connected laptop in a cafe, an attacker monitors their network traffic
- The employee's email client performs a send/receive, which transmits their email username and password in plain text (as it is not encrypted)
- The attacker is now able to access the email account as if it is their own, by using the credentials that have been obtained
- The attacker goes to a website such as Paypal.com, enters the compromised email address and follows the procedure to reset the password
- They receive the link by email to change the password
- They quickly delete this email from the server before the employee downloads it, to avoid suspicion
- The attacker now has control of the employee's account on the website