Chapter purpose
The historical security book separates operating system, Exchange, protocol, client and administrative risks. This modern chapter turns that into a layered threat model.
Learning objectives
- Identify identity, transport, content and administration threats.
- Separate spoofing, phishing, malware, relay abuse and mailbox compromise.
- Map each threat to preventive, detective and recovery controls.
- Avoid relying on one security layer.
Why this matters in a real company
Email carries invoices, credentials, contracts and executive instructions. A compromise can become financial fraud even when no malware is involved.
1.1 Identity threats
Stolen credentials, excessive delegation and legacy authentication can give an attacker legitimate-looking access. Strong authentication and least privilege reduce the blast radius.
Mailbox compromise may look like ordinary user activity, so sign-in and audit evidence matter.
1.2 Transport threats
SMTP relay abuse, weak connector scope, certificate problems and exposed services affect how mail enters and leaves the organization.
TLS protects a connection but does not prove the human sender is trustworthy.
1.3 Content threats
Phishing, malicious links, attachments and business email compromise target user decisions and application behavior. Modern security combines sender authentication with content inspection and investigation.
1.4 Administrative threats
A legitimate administrator with excessive mailbox access can cause privacy or fraud risk. Delegated permissions must be explicit, reviewed and auditable.
1.5 Recovery matters too
Security architecture must assume prevention can fail. Preserve audit evidence, backups/retention and response runbooks so a compromised account or mailbox can be contained and recovered.
Executive account sends fraudulent bank-change instructions
The message is sent from the real mailbox after credential theft, so SPF/DKIM/DMARC all pass.
Decision: Treat this as identity compromise, not spoofing. Revoke sessions, secure the account, search message scope and investigate related activity.
What to prove: Produce sign-in/audit/message evidence and show containment completed.
Hands-on lab
Take ten hypothetical email threats and assign each to identity, transport, content, mailbox/endpoint or administration. Add at least one preventive and one detective control.
Troubleshooting exercise
- Authentication passes but message is malicious. Move beyond domain-authentication checks.
- No malware is present but payment fraud occurred. Treat BEC as social/identity attack.
- Security team has no historical logs. Fix evidence retention as a control gap.
Field checklist
- Threat categories documented.
- Identity controls defined.
- Transport boundaries inventoried.
- Content protection configured.
- Delegated mailbox access reviewed.
- Response/recovery runbook exists.
Chapter summary
Messaging security is a system of controls across identity, transport, content, administration and recovery. No single filter can cover every failure mode.
Current technical references
The supplied historical books are used as curriculum and operational context. Current implementation details are checked against current Microsoft documentation.