{"id":11859,"date":"2017-08-24T14:20:18","date_gmt":"2017-08-24T14:20:18","guid":{"rendered":"https:\/\/www.process.st\/templates\/email-server-security\/"},"modified":"2024-02-28T20:45:51","modified_gmt":"2024-02-28T20:45:51","slug":"email-server-security","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/email-server-security\/","title":{"rendered":"Email Server Security"},"content":{"rendered":"<section id=\"introduction-to-email-server-security\">\n<h2> Introduction to Email Server Security: <\/h2>\n<div class=\"image-content\">\n<figure>\n   <a href=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/g6nHQtYd5NzvRxPKPRpOjg.png\" alt=\"Email Server Security - Process Street\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/g6nHQtYd5NzvRxPKPRpOjg.png\" \/> <\/a><figcaption>\n     Email Server Security - Process Street<br \/>\n   <\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>This <a href=\"https:\/\/www.process.st\" rel=\"nofollow noopener\" target=\"_blank\">Process Street<\/a> email server security checklist is engineered to help you <strong>set up an email server and to do so with the highest levels of security<\/strong>.<\/p>\n<p>An email server is a vital part of any company's infrastructure and it would be very difficult to be a successful business without one. However, as a result of phishing attacks and a range of other dangerous practices, emails and the networks they operate on present a <strong>potential point of entry to crackers<\/strong> looking to exploit the vulnerabilities of your system.&nbsp;<\/p>\n<p>In this checklist, we try to cover as many security steps as we can in order to give you as many defensive options as possible. Some of these steps are technical in nature, such as enabling DKIM or DMARC. However, human error is one of the greatest threats to any network.<\/p>\n<p>Each employee is a trojan horse waiting to happen. As a result, we have also included steps for you to <strong>make sure that employees throughout the company are trained<\/strong> in basic security practices. At the very least, we hope to see them use strong passwords.&nbsp;<\/p>\n<p>This Process Street template is fully editable and you can adapt it to suit your personal needs. There may be steps you feel are overkill and want to remove, or you may have further steps you want to add in which you feel we've missed. You can edit the template to change tasks or the content of tasks as you wish.<\/p>\n<p>Throughout this checklist, you will find opportunities to add information into form fields. The information entered here is stored within the <a href=\"https:\/\/www.process.st\/help\/docs\/template-overview\/\" rel=\"nofollow noopener\" target=\"_blank\">template overview<\/a> tab each time a checklist is run. This allows you to review what occurred in each process over time. You can export this data to a CSV file if you wish to keep your own copy.<\/p>\n<p>If you want to know more about email server security <strong>check out the video below<\/strong>:<\/p>\n<\/p><\/div>\n<div class=\"video-content\">\n<div class=\"iframe-container\">\n   <iframe src=\"https:\/\/www.youtube.com\/embed\/y78J0yuWZgU?modestbranding=1&amp;showinfo=0\" frameborder=\"0\" allowfullscreen=\"true\"> <\/iframe>\n  <\/div>\n<div class=\"description\">\n    Email Security: How Secure Email Works in the Cloud - BlazeVideo\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"record-checklist-details\">\n<h2> Record checklist details <\/h2>\n<div class=\"text-content\">\n<p><strong>Use the form fields below<\/strong> to record information relevant to the process.<\/p>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Who is setting up the server? <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled=\"disabled\" class=\"form-control\" \/>\n  <\/div>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> For what reason is the email server being created? <\/label><br \/>\n   <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled=\"disabled\" class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"date-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> What date will the secure server be live? <\/label> <\/p>\n<div class=\"date-container\">\n    <button type=\"button\" disabled=\"disabled\" class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"enable-spf-to-prevent-forgery\">\n<h2> Enable SPF to prevent forgery <\/h2>\n<div class=\"text-content\">\n<p>SPF or&nbsp;Sender Policy Framework (SPF) is a security mechanism created to <strong>prevent other people from sending emails on your behalf<\/strong>.<\/p>\n<p>SPF works by allowing DNS servers to communicate with each other to check authorized IPs. This stops someone else sending mail from your network while working from a different IP.&nbsp;<\/p>\n<p>If you were using Google to send your mail, you could find their recommended steps for setting this up <a href=\"https:\/\/support.google.com\/a\/answer\/178723?hl=en\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a>.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"make-emails-trustworthy-by-enabling-dkim\">\n<h2> Make emails trustworthy by enabling DKIM <\/h2>\n<div class=\"text-content\">\n<p>DKIM or&nbsp;DomainKeys Identified Mail is similar to SPF.&nbsp;<\/p>\n<p>This works by creating two keys, a public one and a private one. These are <strong>encrypted signatures in the header of your email<\/strong> which demonstrate the sender is really you.&nbsp;<\/p>\n<p>The receiver then takes the public key and checks your DNS records with it in order to be able to encrypt the private key. This is how they know whether it is a legitimate email or not.&nbsp;<\/p>\n<p>You can normally enable the public key from your email provider's admin console. For Google users, there's <a href=\"https:\/\/support.google.com\/a\/answer\/174124?hl=en\" rel=\"nofollow noopener\" target=\"_blank\">this set of instructions<\/a> for reference.<\/p>\n<p>Once you have the public key, you can add the generated txt record to your DNS records and then turn on email signing within your provider.&nbsp;<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"enable-dmarc\">\n<h2> Enable DMARC <\/h2>\n<div class=\"text-content\">\n<p>DMARC or&nbsp;Domain-based Message Authentication Reporting and Conformance is a further level of security which requires you already have SPF and DKIM enabled.&nbsp;<\/p>\n<p>You can find a 15-minute DMARC setup process to follow <a href=\"https:\/\/blog.returnpath.com\/build-your-dmarc-record-in-15-minutes-v2\/\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a>.<\/p>\n<p><strong>Use the form field below<\/strong> to leave any notes on your DMARC creation process.<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Notes on DMARC <\/label><br \/>\n   <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled=\"disabled\" class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"set-up-a-spam-filter\">\n<h2> Set up a spam filter <\/h2>\n<div class=\"text-content\">\n<p>Most email providers have an easy way of setting up spam filters within their admin dashboard.&nbsp;<\/p>\n<p>Check out this process <a href=\"https:\/\/mediatemple.net\/community\/products\/dv\/204643830\/how-do-i-set-up-spam-filtering-for-my-server\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a> to see how easy these steps can be.&nbsp;<\/p>\n<p>Spam filters are effective at stopping clutter in inboxes as well as fighting back against security threats.&nbsp;<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"create-and-implement-a-throttling-policy\">\n<h2> Create and implement a throttling policy <\/h2>\n<div class=\"text-content\">\n<p>When establishing a throttling policy, there are three main areas to consider.&nbsp;<\/p>\n<p><strong>Use the form fields below<\/strong> to record the parameters you set for each variable.<\/p>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Number of recipients per sender per day <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled=\"disabled\" class=\"form-control\" \/>\n  <\/div>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Number of emails per sender per hour <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled=\"disabled\" class=\"form-control\" \/>\n  <\/div>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Number of recipients per email <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled=\"disabled\" class=\"form-control\" \/>\n  <\/div>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>Setting these figures will help make sure that even if your account is compromised, this <strong>won't cause any lasting damage to your reputation<\/strong>.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"implement-local-email-domain-restrictions\">\n<h2> Implement local email domain restrictions <\/h2>\n<div class=\"text-content\">\n<p>To stop internal phishing emails, you can<strong>&nbsp;restrict emails that come from your domain to only be allowed from your email system<\/strong>.<\/p>\n<p>However, this comes with some considerations. There may be legitimate emails coming from your domain but not your system. These might be:<\/p>\n<ol>\n<li>Using a remailer service (mail goes from your users to the third party internet remailer, then back to your organization)&nbsp;<\/li>\n<li>Cloud services set to send as domain users&nbsp;<\/li>\n<li>Web application forms that trigger emails sent from an internet web server with a domain email address<\/li>\n<\/ol><\/div>\n<\/section>\n<section id=\"provide-visible-and-trackable-logs\">\n<h2> Provide visible and trackable logs <\/h2>\n<div class=\"text-content\">\n<p>To help yourself maintain effective logs, <strong>consider these three approaches<\/strong>:<\/p>\n<ol>\n<li>Create a policy for how long you maintain logs for.&nbsp;<\/li>\n<li>Make sure you always have enough disk space for your logs.<\/li>\n<li>Explore log visualization tools to make your records easier to interpret.&nbsp;<\/li>\n<\/ol>\n<p><strong>Use the form field<\/strong> to leave notes on how you have adapted your approach to logging.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\">\n   <label> Logging notes <\/label><br \/>\n   <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled=\"disabled\" class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"enable-dnssec\">\n<h2> Enable DNSSEC <\/h2>\n<div class=\"text-content\">\n<p>Your DNS records have so far been the cornerstone of your email defense strategy.&nbsp;<\/p>\n<p>However, you must <strong>make sure you keep your DNS records themselves secure<\/strong>.&nbsp;<\/p>\n<p><a href=\"http:\/\/www.dnssec.net\/\" rel=\"nofollow noopener\" target=\"_blank\">DNSSEC<\/a> works by signing the DNS response using public key cryptography. This prevents people from posing as your DNS and intercepting information.&nbsp;<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"create-an-effective-staff-training-policy\">\n<h2> Create an effective staff training policy <\/h2>\n<div class=\"text-content\">\n<p>As we mentioned in the introduction, human error is one of the biggest challenges to overcome when designing security systems.&nbsp;<\/p>\n<p>The best chance you have of making sure your systems are secure is by providing sufficient training to staff members within the company.&nbsp;<\/p>\n<p><strong>Here are the basics which should be covered by this training<\/strong>:<\/p>\n<ul>\n<li>How to identify and avoid phishing scams and similar threats<\/li>\n<li>Alternatives to email for transferring files<\/li>\n<li>How to avoid malware and malicious links<\/li>\n<li>What social engineering in hacking is and how to know what information is appropriate to give out.&nbsp;<\/li>\n<\/ul>\n<p>You could use Process Street to build the outline of this course. Link to the template for the training process in <strong>the form field below<\/strong>:<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"establish-a-process-for-continual-testing\">\n<h2> Establish a process for continual testing <\/h2>\n<div class=\"text-content\">\n<p>The final step to securing your email is to construct a process to regularly test and assess your system against your specific requirements.&nbsp;<\/p>\n<p>You can <strong>use Process Street for regularly occurring checklists<\/strong> to make sure this assessment isn't overlooked.&nbsp;<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"sources\">\n<h2> Sources: <\/h2>\n<div class=\"text-content\">\n<ul>\n<li><a href=\"https:\/\/community.f-secure.com\/t5\/Business\/E-mail-and-Server-Security\/ta-p\/61499\" rel=\"nofollow noopener\" target=\"_blank\">Email and Server Security Services and Processes - F-Secure<\/a><\/li>\n<li><a href=\"https:\/\/www.apriorit.com\/qa-blog\/428-mail-server-security-testing\" rel=\"nofollow noopener\" target=\"_blank\">Mail Server Security - Apriorit<\/a><\/li>\n<li><a href=\"https:\/\/www.vircom.com\/blog\/top-10-tips-to-secure-your-email-server\/\" rel=\"nofollow noopener\" target=\"_blank\">Top 10 Tips to Secure Your Email Server - Vircom<\/a><\/li>\n<li><a href=\"https:\/\/www.upguard.com\/blog\/the-email-security-checklist\" rel=\"nofollow noopener\" target=\"_blank\">The Email Security Checklist - UpGuard<\/a><\/li>\n<li><a href=\"https:\/\/www.f-secure.com\/en\/web\/business_global\/email-and-server-security\" rel=\"nofollow noopener\" target=\"_blank\">Secure Email and Protection for Servers - F-Secure<\/a><\/li>\n<\/ul><\/div>\n<\/section>\n<section id=\"related-checklists\">\n<h2> Related Checklists: <\/h2>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Introduction to Email Server Security: Email Server Security - Process Street This Process Street email server security checklist is engineered to help you set up an email server and to do so with the highest levels of security. An email server is a vital part of any company's infrastructure and it would be very difficult [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":11860,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"","cover_icon_url":"","tasks_count":"14","template_description":"Run this email server security process when you need to set up a new secure email server.","template_id":"vKDSZ2ZjNkb8TWuRr9BGUA","task_0":"Introduction to Email Server Security:","task_slug_0":"introduction-to-email-server-security","task_1":"Record checklist details","task_slug_1":"record-checklist-details","task_2":"Enable SPF to prevent forgery","task_slug_2":"enable-spf-to-prevent-forgery","task_3":"Make emails trustworthy by enabling DKIM","task_slug_3":"make-emails-trustworthy-by-enabling-dkim","task_4":"Enable DMARC","task_slug_4":"enable-dmarc","task_5":"Set up a spam filter","task_slug_5":"set-up-a-spam-filter","task_6":"Create and implement a throttling policy","task_slug_6":"create-and-implement-a-throttling-policy","task_7":"Implement local email domain restrictions","task_slug_7":"implement-local-email-domain-restrictions","task_8":"Provide visible and trackable logs","task_slug_8":"provide-visible-and-trackable-logs","task_9":"Enable DNSSEC","task_slug_9":"enable-dnssec","task_10":"Create an effective staff training policy","task_slug_10":"create-an-effective-staff-training-policy","task_11":"Establish a process for continual testing","task_slug_11":"establish-a-process-for-continual-testing","task_12":"Sources:","task_slug_12":"sources","task_13":"Related Checklists:","task_slug_13":"related-checklists","task_14":"","task_slug_14":"","task_15":"","task_slug_15":"","task_16":"","task_slug_16":"","task_17":"","task_slug_17":"","task_18":"","task_slug_18":"","task_19":"","task_slug_19":"","task_20":"","task_slug_20":"","task_21":"","task_slug_21":"","task_22":"","task_slug_22":"","task_23":"","task_slug_23":"","task_24":"","task_slug_24":"","task_25":"","task_slug_25":"","task_26":"","task_slug_26":"","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[42,7,1],"tags":[],"class_list":["post-11859","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internal-audit","category-miscellaneous","category-uncategorized"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/11859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=11859"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/11859\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media\/11860"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=11859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=11859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=11859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}