CND (312-38) Network Defense Simulation
Network Scenario
Your organization acts as a clearinghouse for Electronic Data Interchange (EDI) transactions. To reduce costs, the organization has moved from a private Value Added Network (VAN) to sending EDI documents over the internet via standard email infrastructure. As a Network Defender, you must ensure that these sensitive business documents remain confidential and tamper-proof while in transit through untrusted mail relays.
Traffic & Logs
A partial SMTP packet capture reveals the following headers for an outbound transmission:
RCPT TO:<vendor-ops@partner.net>
DATA
Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7m"
MIAGCSqGSIb3DQEHA6CAMIACAQAxggG8MIIBuAIBADCBjDCBgzELMAkGA1UEBhMCVVM...
[... Encrypted Binary Stream ...]
Analysis Note: The application/pkcs7-mime content type indicates a specific security wrapper is being applied to the payload.
Question
Which of the following protocols is used to exchange encrypted EDI messages via email?
Expert Analysis
1. Network Activity: The organization is transmitting EDI (Electronic Data Interchange) data over a public email infrastructure (SMTP). Without protection, this data is vulnerable to sniffing and unauthorized modification.
2. Identifying the Behavior: The provided log shows a Content-Type: application/pkcs7-mime. This is the hallmark of a secure email envelope. The base64-encoded binary stream smime.p7m confirms that the content is not plain text but a cryptographic structure.
3. Why Correct Answer is Correct: S/MIME (Secure/Multipurpose Internet Mail Extensions) is specifically designed to provide cryptographic security services for electronic messaging. It uses Public Key Infrastructure (PKI) to provide authentication, integrity, non-repudiation, and confidentiality (encryption). When EDI messages are sent via email (AS2/SMTPS), S/MIME is the standard choice for the payload encryption.
4. Why Others are Wrong:
- MIME: Only allows for the transport of non-text attachments (images, documents) but provides NO inherent security or encryption.
- HTTP/HTTPS: These are web transfer protocols. While HTTPS provides encryption for the transport layer, the question specifically asks about exchanging messages via email.
5. Defensive Action: As a defender, you must ensure the gateway mail server validates the S/MIME certificates and that the organization’s Private Key is stored securely (HSM or encrypted storage) to prevent unauthorized decryption of incoming EDI traffic.
- SMTP: The "truck" that delivers the mail.
- MIME: The "packaging" that allows different items (PDF, EDI, JPG) in the truck.
- S/MIME: The "locked safe" inside the packaging that only the recipient can open.
Ready for more challenges?
Explore more CND simulations