Cisco Live 2018 Cap by Completing the Overall Event Evaluation and 5 Session Evaluations
Total Page:16
File Type:pdf, Size:1020Kb
Don’t Send – Deliver! Hrvoje (Harry) Dogan, Technical Marketing Engineer BRKSEC-2337 Cisco Spark Questions? Use Cisco Spark to communicate with the speaker after the session How 1. Find this session in the Cisco Live Mobile App 2. Click “Join the Discussion” 3. Install Spark or go directly to the space 4. Enter messages/questions in the space © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public Abstract In the past years, we've seen new and ingenious ways to exploit email as a threat vector. This, in turn, has brought in many new mechanisms to evaluate authenticity, content and sources of email. More than ever, senders - especially large volume senders - are struggling with getting all of their emails delivered, and keeping all of their email sources in good standing with blacklist and security intelligence providers. This session will show, through established best practices and industry examples, how to ensure that your email is deliverable. Along the way, it will make your email infrastructure, and your email traffic, more resilient, secure and Internet-friendly. We will discuss different techniques used by large email providers, and how to make sure they always like you. Basic knowledge of email operation and SMTP is required. Acquaintance with email authentication will be beneficial to understand the material. Agenda • To Send ≠ To Deliver • Different Faces of Reputation • Message Properties • Concurrency • Delivery Infrastructure • Be A Good Citizen About The Author Hrvoje (Harry) Dogan • Joined Cisco through IronPort acquisition in 2007 • SE, then CSE for Central and Eastern Europe, Europe Emerging... • Instructor Trainer for ESA/WSA, author of multiple whitepapers and Cisco Live sessions on Email and Web security • In 2011, moved to Security Business Group to join the product team • In 2015, relocated to Singapore to cover APJ+GC regions • Cisco Live Distinguished Speaker 2014, 2016, 2017 • Avid sailor, aspiring rock climber and retiring SCUBA diver • Ingress Enlightened agent and operator Presentation Theme Source: https://en.wikipedia.org/wiki/Singlish, retrieved on 12th of December, 2017 What’s Going On? You ask me I ask who? I am not the right person to answer this question Don't worry, sure can one. Don't worry; it'll work. A Piece of Mail Was Sent BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 A Piece of Mail Was Delivered BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 …And In-between? BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 “There’s a big difference between sending email and delivering email” Joe Uhl, VP of Operations, MailChimp, in https://www.wired.com/2016/07/mailchimp-sends-billion-emails-day-thats-easy-part/ BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 The Problem Is Three-Fold User experience and email delays Additional stress on your delivery infrastructure Additional stress on 3rd parties’ receiving infrastructure BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 The Internet Delivers Swift Justice To Mishandled Delivery BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 The Internet Delivers Swift Justice To Mishandled Delivery EHLO domain.com 554 IP address is blacklisted EHLO domain.com 554 Rejected due to policy restrictions EHLO domain.com 550 [RBL] Sender blocked domain.com 550 mail.server.com ESMTP Connection rejected. Your IP 10.18.3.47 is in RBL EHLO domain.com 550 OU-002 Mail rejected by Windows Live Hotmail for policy reasons. Reasons for rejection may be related to content with spam-like characteristics or IP/domain reputation problems. If you are not an email/network admin please contact your E-mail/Internet Service Provider for help. Email/network admins, please visit http://postmaster.live.com for email delivery information and support BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 There Is No Carrot! IP Blacklisting AS Blacklisting Monetary charges for delisting BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 Different Faces of Reputation Everyone Looks For Different Things In Others • Sending host reputation • Sender Domain Reputation • Reputation by Network Proximity • AS Reputation • Network Owner Reputation • … BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 What Are We To Do?!? That why asking how? The reason I'm asking the question is, how do I go about doing it? You want do how you do how. You can do it any way you like. Message Properties Overall considerations Correct Encoding Correct MIME Message Format Correct Time What Are You Sending?? BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Text Can Be Encoded In Many Ways! Sender’s Computer Encoding: BIG5 Receiver’s Computer Encoding: BIG5 BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 Text Can Be Encoded In Many Ways! Exchange Encoding: GB2312 Sender’s Computer Encoding:-- BIG5Boundary_(ID_nI+mPHhd2wki+0PBonlpeA) Receiver’s Computer Encoding: BIG5 Content-type: text/plain; charset=gb2312 Content-transfer-encoding: 8BIT FYR ________________________________ èƒ: Íê÷¡…∆ ºƒº˛»’∆⁄: 2014ƒÍ4‘¬23»’ œ¬ŒÁ 04:29 ÷¡: ≈̺∞ªÕ; Ñ¢∂°À…; Íê÷¡…∆; ÕıÔwòÂ; óÓçã∫¿; ¡÷è©–¢ ∏±±æ: ¡÷±˛›x; «Òø°Œƒ ÷˜÷º: RE: LCS1-üo∑®å¶ë™7/15ñ|‘£≤øΩY≤ø∆∑÷≥ˆ Ω®◊h: ¨F뙑쓗flM»ÎAPQP-3ÎA∂Œ BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Setting a Default Encoding on the ESA esa1> scanconfig Configure encoding to use when none is There are currently 5 attachment type specified for plain body text oranything mappings configured to be SKIPPED. with MIME type plain/text or plain/html. 1. US-ASCII Choose the operation you want to perform: 2. Unicode (UTF-8) - NEW - Add a new entry. 3. Unicode (UTF-16) - DELETE - Remove an entry. 4. Western European/Latin-1 (ISO 8859-1) - SETUP - Configure scanning behavior. 5. Western European/Latin-1 (Windows CP1252) - IMPORT - Load mappings from a file. 6. Traditional Chinese (Big 5) - EXPORT - Save mappings to a file. 7. Simplified Chinese (GB 2312) - PRINT - Display the list. 8. Simplified Chinese (HZ GB 2312) - CLEAR - Remove all entries. 9. Korean (ISO 2022-KR) - SMIME - Configure S/MIME unpacking. 10. Korean (KS-C-5601/EUC-KR) - CLUSTERSET - Set how scanconfig is 11. Japanese (Shift-JIS (X0123)) configured in a cluster. 12. Japanese (ISO-2022-JP)13. Japanese - CLUSTERSHOW - Display how scanconfig is (EUC)[1]> 2 configured in a cluster. []> setup Setting default encoding will NOT help if encoding is specified in the message, but is incorrect! BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Encoding Makes A Difference! • Text can be encoded in many ways • Headers have encoding, too! • RFC2047: Message Header Extensions for Non-ASCII Text Subject: [MARKETING] Merry Christmas BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 Encoding Makes A Difference! • Text can be encoded in many ways • Headers have encoding, too! • RFC2047: Message Header Extensions for Non-ASCII Text Subject: [MARKETING] Merry=?utf -8?Q?Merry=20Christmas=C2=A0=F0=9F=8E=84?=Christmas BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 MIME-Version: 1.0 Content-type: multipart/mixed; boundary="B_3597992599_406827548" > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3597992599_406827548 Content-type: multipart/alternative; boundary="B_3597992599_1713911382" --B_3597992599_1713911382 Content-type: text/plain; charset="UTF-8” Content-transfer-encoding: 7bit […] --B_3597992599_1713911382 Content-type: text/html; charset="UTF-8” Content-transfer-encoding: quoted-printable <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org=/TR/xhtml1/DTD/xhtml1- strict.dtd"> <html xmlns=3D"http://www.w3.org/1999/xhtml"> […] </html> --B_3597992599_1713911382-- --B_3597992599_406827548 Content-type: application/pdf; name="4854861.pdf"; x-mac-creator="4F50494D"; x-mac-type="50444620” Content-ID: [email protected] Content-disposition: attachment; filename="4854861.pdf” Content-transfer-encoding: base64 […] --B_3597992599_406827548-- BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 A MIME Is A Terrible Thing To Waste! • Make sure that ALL of your MIME is done right! • All enclosures and containers properly formatted and closed • All attachments properly named, encoded and with proper disposition • All text parts properly encoded • No duplicates! BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 Message Format RFC5322 Anyone? Proper PRA Headers Proper Message-ID (From/Sender/Resent-From…) Proper Return-Path Obey Line Length Fold, Fold, Fold!!! BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 Determining PRA RFC4407 0 Select first non-empty Resent-Sender 1 Found MULTIPLE ? header Select all Message Found Y From ? PRA Malformed headers N 0 Select first non-empty 1 Found MULTIPLE Resent-From ? header Select all Impossible to Found Y Sender determine PRA ? headers BRKSEC-2337 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 Message Format RFC5322 Anyone? From:Proper