What is the best solution to prevent directory harvest attacks?

Question

Options

• ACreate an access list as a content dictionary and match this resource, with a content filter, against
• BSpecify all of the legitimate mailbox addresses in the RAT.
• CEnable LDAP Accept.
• DCreate an access list as a content dictionary and match this resource, with a message filter, against

• B
  2% (1)
• C
  95% (40)
• D
  2% (1)

Explanation

Enabling LDAP Accept is the correct defense because it validates recipient addresses against your organization's LDAP directory in real-time during the SMTP conversation - if an address doesn't exist, the connection is rejected before a bounce message is generated, giving attackers no feedback to harvest valid addresses from.

Options A and D (content dictionaries with content/message filters) operate after a message is already accepted into the pipeline, meaning the SMTP transaction has already completed and the attacker has already received a delivery confirmation or NDR to exploit. Option B (listing addresses in the RAT) is theoretically possible but operationally impractical - maintaining a static list of every valid mailbox is error-prone and doesn't scale, whereas LDAP Accept dynamically queries the live directory.

Memory tip: Think "LDAP = Live Directory Address Protection." The key to stopping directory harvesting is rejecting unknown recipients at the door (SMTP layer), and LDAP Accept is the mechanism that checks the guest list in real time before letting anyone in.

No community discussion yet for this question.