Email Security Analyst

This roadmap prepares you to defend email — the most common way attacks begin. You'll learn how email works, how to authenticate it, and how to analyze and respond to phishing. Basic networking knowledge helps.

• Have access to a mailbox where you can view raw headers
• Understand DNS basics
• Plan your study time

• CyberA4U Academy — courses

Email travels between mail servers using SMTP, passing through MX records, relays and filters before reaching a mailbox.

• Explain SMTP, MX records and mail relays
• Understand where filtering happens
• Trace the path of a message

الأدوات والتقنيات: Email

• RFC 5321 — Simple Mail Transfer Protocol

Email headers record every server a message passed through and the results of authentication checks. They're the first thing to read when a message looks suspicious.

• Read Received headers from bottom to top
• Find SPF, DKIM and DMARC results
• Spot mismatched From and Return-Path

الأدوات والتقنيات: Email

• RFC 5322 — Internet Message Format

SPF lists which servers may send for a domain, DKIM signs messages, and DMARC tells receivers what to do when checks fail. Together they fight spoofing.

• Read and write SPF records
• Explain DKIM signing
• Roll out DMARC from p=none to p=reject

الأدوات والتقنيات: Email

• RFC 7208 — Sender Policy Framework (SPF)
• RFC 6376 — DomainKeys Identified Mail (DKIM)
• RFC 7489 — DMARC

Phishing campaigns use look-alike domains, cloned login pages and urgent messages to steal credentials. Understanding their structure helps you detect and block them.

• Recognize common phishing lures and look-alike domains
• Understand credential-harvesting pages at a high level
• Identify indicators to block

الأدوات والتقنيات: Email

• CISA — Phishing Guidance: Stopping the Attack Cycle at Phase One

Analysts must check links and attachments without infecting themselves: expand URLs, check reputation, and detonate only in sandboxes.

• Inspect URLs safely without clicking
• Use reputation and sandbox services
• Recognize risky attachment types

الأدوات والتقنيات: Email

• CAPE Sandbox documentation

BEC scams impersonate executives or suppliers to trick staff into paying invoices or sending data. They often contain no links or malware at all.

• Recognize BEC red flags
• Understand vendor and CEO impersonation
• Know verification procedures for payment changes

الأدوات والتقنيات: Email

Defenses against impersonation include DMARC, external-sender banners, look-alike domain monitoring and display-name checks.

• Configure external sender tagging
• Monitor look-alike domains
• Enforce DMARC on your domains

الأدوات والتقنيات: Email

تعلّمها على CyberA4U:Module 11: Human-Focused Attack Techniques

• DMARC.org — Overview

Email security gateways and built-in cloud filters scan for spam, malware and phishing, rewrite links and quarantine suspicious messages.

• Understand filtering layers and quarantine
• Tune policies without blocking business mail
• Review what gets through

الأدوات والتقنيات: Email

• Microsoft Defender for Office 365 — Overview

Users are an early-warning system when reporting is easy and they get quick feedback. Reported emails also feed detections.

• Provide a one-click report button
• Triage reports quickly
• Tell users the outcome

الأدوات والتقنيات: Email

A compromised mailbox is used to send phishing internally and to steal data. Fast response means resetting credentials, revoking sessions and removing malicious rules.

• Detect signs of mailbox compromise
• Contain the account
• Check forwarding rules and sent items

الأدوات والتقنيات: Email

• Microsoft — Responding to a compromised email account

Indicators from phishing campaigns — sender domains, URLs, attachment hashes — can be shared and blocked across organizations.

• Extract indicators from phishing emails
• Share them in structured formats
• Block and hunt for them

الأدوات والتقنيات: Email

• OASIS — STIX and TAXII documentation

Track phishing reports, time to remove malicious emails, false positives and DMARC alignment to tune defenses.

• Measure report rates and response times
• Track filter misses and false positives
• Review DMARC reports

الأدوات والتقنيات: Email

Check that you can authenticate a domain's email, analyze a phishing message and respond to a compromised mailbox.

• Configure SPF, DKIM and DMARC
• Analyze headers, links and attachments safely
• Run the mailbox compromise playbook

• CyberA4U CTF Arena — practice challenges

You can now defend email effectively. Continue with SOC Analyst, Incident Response or Social Engineering.

• Keep your DMARC reports monitored
• Choose your next roadmap
• Share a phishing analysis

• CyberA4U CTF Arena — practice challenges