TIP OF THE WEEK: How misdirected email can harm your business (and bottom line)

Too often when conducting security assessments we make some rather telling discoveries. Many times businesses are not even aware that they have problems and by then it may be too late. As part of our annual security training we are taught to use the resources at our disposal to maintain efficiency. We have come to rely on technology to speed up the processing of medical claims, to place orders online and to maintain required records for business use. Corporations create policies to try and give guidance to employees and contractors in safe data handling as well as enforcing strong passwords, policies on data storage and handling as well as regulatory assistance in regards to Sarbanes Oxley, HIPAA and Classified data handling. All of these measures are in place to limit the liability of the company and ensure that information does not end up in the wrong hands.

In this article we will focus on email and the typical use in business. I will cover some of the issues with email systems in use today and we will go over some of the ways in which you may be able to protect your company from costly mistakes.

In this article I will focus in on 5 key areas:
1. Verification of Identity
2. Encryption
3. Storage for Auditing Purposes
4. Misdirected Email
5. Detection of the Insider Threat

Verification of Identity
It goes without saying that you should go without saying that when you leave your workstation you should ensure that you lock it with a password. Often times when performing security audits we note upwards of over half of the employees in the organization fail to perform this simple step to ensure that nobody can look at your email or see what documents and other sensitive information that you may have open that they may not have a requirement to see or read. What is to stop someone from sending an email on your behalf? What is to stop them from deleting the message from your sent folder and deleting your trash? If this were to occur at your organization could you recover the sent message if there were a legal issue or requirement to do so?

We seriously doubt it as we have only seen a handful of companies in the 20 years we have been doing security auditing that actually could reproduce the sent email message after it was deleted from the senders mailbox. You remember the IRS scandal that has been all over the news. Lois Lerner claimed that she had a hard drive crash and that the IRS could not recover her email messages. This brought about many hours of Senate inquiries, investigations and it's still in the news today. The problem here is two fold.
Due to sunshine laws and other Federal regulations public officials must maintain records of their email for a period usually of 2 years at minimum. The IRS claimed that the backups were unavailable at first and then claimed that they did not exist even though there are rules and laws that require this information to be archived. We will use this example in this section to talk about some of the reasons having access to old email is critical for businesses.

What were to happen if an employee were to accidentally delete a contract received through email. The person that executed the contract has a copy of the contract but your only copy was deleted accidentally. Then as part of the services being provided said second party cannot produce the contract that was executed. An unethical company may alter their copy of the contract to include terms different than the original but if you cannot produce the contract it may be hard to prove that the terms of the contract have been modified so you are putting your companies assets and resources at risk because an employee made a simple error.

What would happen if a threatening email was sent out of your organization to a third party and the action was reported to law enforcement. Do you have a definitive way to ensure that the sender was the actual person that sent the message? If the message was a spoofed email do you have proof that the employee was not the source of the message? Do you have a written policy that is signed stating that the employee will be responsible for the use of your email infrastructure solely? Do you have a disclaimer on your email messages stating that the organization may not hold the same views as the sender? Just a few things to think about.
Partial Solution: Smart card email authentication is a very good way to verify the sender is who they claim to be. Two factor authentication will prevent the unauthorized sending and unauthorized reception of email not intended for the intended individual.

Encryption:
Encryption is a good tool for maintaining organizational security. The use of encryption can prevent unauthorized access to information in the event that a laptop is stolen or a communication is intercepted. It can also be used to verify the identity of the sender and receiver. When using encryption however the organization MUST maintain the master key to be able to decrypt any communications in the event of a court order or legal requirement. Encryption of email allows you to ensure that messages are not being intercepted in transit and also ensure that only persons with the appropriate keys can decrypt the message. Encryption is not 100% effective every because there may be remnants of decrypted messages on a laptop, computer or smart phone depending on the product being used. Encryption should be viewed as a safeguard and not a final line of defense. Given enough time and hardware encryption can be defeated rather easily with the advent of powerful GPU cards that are not all that expensive today.

Storage for Auditing Purposes:
It should be said first off that in business things happen. Too often businesses are in a reactive mode when it comes to liabilities and security and they only become proactive when it could cost them reputation points or financially. One common recommendation that we make to many of our customers is to ensure that you have email archival in place and verify frequently that messages can be recovered from the archives.

There are commercial solutions and inexpensive open source programs designed to intercept and store email in archives for long term accountability. If you can't confirm or deny that an email originated from your company you may be in trouble if a problem arises.

What are some of the downsides to the archival of email?

Misdirected Email:
In the event that an address is transposed you must ensure that you notify the recipient and request that the message be deleted. Keep in mind that you have lost control of the information in the email and it could now be shared out by the untrusted third party. While there is nothing to prevent that if you keep your email you have proof that you have notified the recipient and requested that the information be deleted. If that information shows up down the road as a compromise or helps a hacker to compromise a system you have done all that you can do. You have to evaluate the value of the message and take the appropriate actions to minimize the risk to your organization after you discover that a message went to the wrong party.

In some instances you may not even realize that it went to the wrong address so that is why disclaimers on ALL email messages are really helpful in showing due diligence on the part of the sending organization. Mistakes happen and email gets misdirected due to typo's, email accounts not being present on the receiving system (in which case the postmaster of the receiving organization receives the message in most cases), DNS errors or many other situations which may be out of your control.

There may be reporting requirements if there is financial, confidential or if you are a HIPAA covered entity. Check with your compliance department to ensure what steps must be taken immediately to ensure that you are in compliance with State and Federal regulations even if you think you know what steps must be taken.

Insider Threats:
Every year over 80 Billion USD is lost by US Corporations due to insider threats that may consist of Corporate Spies, Governments, Terrorist, Hackers and your Employees. Yes you heard that right. Your trusted employees are a huge threat to your organization and misuse of communications systems and email may cost your organization profits, embarrassment and legal issues. There are many areas of our security auditing that address the technical aspects of protecting your resources but it's difficult without the right systems in place to electronically detect when proprietary information is leaving your company often times without your knowledge or approval.

Do you allow thumb drives in your company?

Do you allow employees to print out documents and check to ensure they are accounted for?

Do you allow personal cell phones in the business and at computer terminals?

Do you have public printers and faxes in common areas?

These are some of the warning signs that information may be leaving without your knowledge. It's easy these days to take a picture of a computer screen or screenshot and email or upload a document to a cloud provider or similar service.

Mitigating the Insider Threat: There are some things you can do to ensure documents, sensitive proprietary information or PHI is not leaving your organization. Having the right training, technical controls, monitoring and auditing in place will help to alleviate the threat but not completely prevent it as nothing is 100% fail safe in the digital age.

The goal in bringing up these topics is to educate and provide guidance and assistance to companies that are at a high risk for disclosures, data breaches or leaks of information by unauthorized personnel and to provide the training, technical safeguards and training needed to keep your company in compliance and as secure as possible without affecting employees ability to do their jobs in an efficient manner. Security is always a balance between available funding and risk management and it's a tightrope act to maintain security while not wasting profits on safeguards that you may not truly need. The only way to be sure is to have an audit done and assume the risk that you choose not to secure and document the gaps in such as manner as to show that you have done as much as you can to prevent possible future disclosures while realizing that nothing is 100% secure and nobody expects it to be.

You must be able to hold individuals responsible for actions and minimize your corporate risk when dealing with technology use in the workplace.