Advanced persistent threats make email security a necessity

Most email administrators consider security to be a large part of what they do. With so many laws and regulations governing the storage, discovery and retrieval of email messages, security has become a second job to many.

Unfortunately, many administrators either forget, or simply aren’t aware, that securing email requires much more effort than hardening the email servers against attack. In order to fully protect your organization’s email and their contents the mailbox also needs to be defended. Especially when you consider how popular Advanced Persistent Threats are becoming with large cyber crime syndicates who use email not only as a way to harvest sensitive information, but also as a method of attack through phishing and social engineering.

By implementing the following tips into your security plan you can help protect against these, and the many other threats that your organization may face:

Create email policies to regulate the communication of confidential information

Email communication has become second nature in the workplace. It is quick, easy and it gives us a record of our conversation so we can refer back to any information at a later date. However, if the conversation contains sensitive information like login credentials, financials, personal information, and the like, then it can be extremely valuable to anyone who may harvest those emails.

By simply setting up, and enforcing, policies that restrict certain information from being sent via email you can mitigate the damage done if emails are exposed. At the very least, your policy should state that user logins and passwords (and/or PINs) not be communicated via email.

Teach users to encrypt their messages

One of the best analogies I have seen to describe the need for encrypting emails is one that compares email to a postcard. Basically, anyone who comes across it can read the contents if they want. This can be stopped by encrypting emails to prevent eavesdropping.

Encryption is a hard thing for many people. It requires additional steps, training and, in some cases, third-party software (such as PGP) yet it is really the only way to keep your messages private in transit.

Encryption shouldn’t be limited to sending and receiving messages alone. Any email that is stored on a hard drive (think personal folders), a network drive, backup servers or archive systems should also be protected from any prying eyes.

Get rid of old email

A long time ago, storage space was a precious resource. Nowadays inboxes can be easily scaled to hold enormous amounts of data. Unfortunately that provides a greater possibility that an attacker will find something valuable.

Email should be moved, or deleted, when their life cycle is up. Make sure to check with any regulations regarding discovery and archiving before getting rid of the old stuff, but if you combine this with encryption you will be taking great strides to protect older emails.

Practice good network security habits

Make sure that desktops are continually scanned for malware that could possibly expose email login credentials, filter Internet content to protect against malicious websites, understand how to properly use a firewall and update server and client software as needed.

In addition to the employing technology to help secure your email systems you should also consider human factors as well. One of the ways that people first discover that their systems have been compromised is by noticing an anomaly. Be on the lookout for log-ins that just don’t seem right whether it be the IP address, the time of day or even the length of time.

This can be one of the most tedious tasks to undertake when it comes to security but it is by far the most important.

Put the right solutions in place

In many small and medium-sized enterprises, the email administrator alone cannot be as vigilant as he or she would like. Even in organizations where there is team of professionals dedicated to security use necessary security tools to help them do their jobs. Smaller companies need to understand this as well.

By employing technologies that help manage email, backup and recovery, archiving and security, you are plugging the little holes that provide that chink in the armor most attackers are looking for.

No one said that email security is going to be an easy task, but it is one that cannot be ignored just because it’s too hard or it costs too much.

Tips for Better Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

IT managers must account for many demands on their time and resources. Storage is always an issue and having to estimate the growth needs of the company and all the various departments can be a time-consuming and sometimes thankless job.

Estimating email storage needs can be started by making assumptions about the average size in bytes that attachments will require, the hours of day that the email servers will be the busiest and the number of users per email server. Those three variables multiplied together are a good starting point in estimating how much storage to allocate for email servers.

And the same computations can also be used when estimating how much storage to allocate for archiving purposes.

Archiving email messages can save an IT data center in many ways. Some of the reasons for archiving email messages include:

1. Freeing up storage on email servers. Email clients and servers provide a valuable function in any corporation and employees have come to rely on them for not just sending and receiving email messages accompanied with large attachments but also now for collaboration with co-workers. Most email applications now have integrated address books, calendar functions, “to do” lists and some have also included instant messaging as part of their email package.  But with all of these newly added capabilities there has also been a corresponding growth in the storage needs of these more robust applications. IT departments can benefit by reducing their storage needs through the use of archival media.
2. Compliance regulations. Corporations must comply with many regulations within their industries as well as many governmental regulations such as the Sarbanes Oxley Act (SOX) of 2002. When companies find themselves having to provide information to various governmental agencies then they have to be able to rely on systems, policies and their IT departments to be able to retrieve the necessary data such as email messages in a timely manner. So IT departments have to stay current and be a part of all corporate discussions involving regulations and industry standards related to communications particularly related to email communications. In addition to SOX there are other government regulations to be made aware of such as: GLBA, SEC, FINRA, HIPAA, BASEL II, FOI, etc
3. Electronic discovery. As of December 1, 2006, Federal amendments went into effect which mandated that companies must be prepared to locate, retrieve, respond to data requests and be able to filter out data not necessary for a litigation action. Such data includes email messages, attachments and calendar entries. These amendments are known as the Federal Rules of Civil Procedure and apply to any organization that can be subject to litigation.
4. Disaster recovery. An added benefit of having email messages that are archived is that messages can be retrieved in the event that your primary server goes down and backups are not current. If your archival systems have been set up to replicate data continuously from the primary mail server then your loss of email messages can be almost eliminated.
5. Improved email management. An automated email archival system can improve the management of emails through the use of rules and policies that can be customized for any organization. The time it takes to store, search and retrieve email messages can be greatly improved when performed automatically as opposed to a manual process. Documents which are methodically saved and stored can expeditiously be retrieved and help to avoid potential lawsuits when time constraints are critical particularly in litigious matters.
6. Increased employee productivity. Most employees spend a lot of time managing their email folders and moving data from folders to local storage. All this time managing their email can and would be better spent working on company projects.
7. Reporting and monitoring of email. HR departments cannot enforce the corporate policies without knowing that all communications that occur in an organization are within the proper guidelines as mandated by company policy. Searches can be conducted that look for suspicious patterns within company emails which can be exposed through pattern recognition software and various monitoring tools that are offered as additional services by archival management systems.

An email archival system can help many businesses with their management and storage of all email messages both incoming and outgoing. Storage space savings, increased productivity, regulatory compliance, satisfaction of discovery mandates and guaranteed retrieval are all benefits of a well maintained and administered email archival system.

7 Reasons for Email Archiving

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Last week, Governor Schwarzenegger of California signed the state’s Electronic Discovery Act, which is effective immediately. An earlier version had been vetoed for what was said to be budgetary reasons. The Act lays out procedures for discovery of electronically stored information in California. As is the case with any piece of legislation, especially legislation from California, the actual text is quite lengthy, but it’s similar to the most recent revisions of the Federal Rules of Civil Procedure. For most data centers, there is no big cause for alarm, since the law doesn’t deviate much from the Federal e-discovery standard.

Under the new legislation, when somebody requests electronically stored information (ESI), they may specify the format they would like to receive it in. If the party doesn’t specify a format, then the data should be produced in the same format that it was originally created, or in another format that is “reasonably usable.” It’s only necessary to produce the documentation in a single format.

If the data is not what the Act terms “reasonably accessible,” it is possible to refuse the request if it causes undue burden or high cost. But it’s not enough to just say “I can’t get to it”–if you want to claim that the data is inaccessible, you have to state specifically why, and you have to identify the sources and types of data that can’t be accessed. The burden of proof that the data is not accessible falls on the party from which the data is being requested. This is of course a very subjective rule, and an email admin managing archives should be prepared to produce in any event. So long as the requesting party has a more expensive lawyer, the point of whether it is “reasonably accessible” could be debated endlessly, or until your company runs out of money, whichever comes first.

California governor signs new e-discovery act

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The administrator may appropriately be tasked with administering, or at least overseeing, the process of email archiving, if for no other reason than the fact that end-users are not likely to do it themselves. The process of archiving emails, if left to individual end-users, would be chaotic at best. Uniform standards must apply, and archiving needs to be done according to a rule-based procedure; without such a rule-based procedure, the enterprise risks falling out of compliance with one or more legislative mandates.

But there are two pieces to the archiving puzzle: Putting things into it, and taking things out of it. The first part can be largely automated and done according to a set of rules that specify that emails get archived after a certain period of time. But as for the other end—searching the archives—that’s another story entirely.

The process of e-discovery for example, can be a nightmare, and lawyers have been known to cast a very wide net. The results can easily be tens of thousands of emails or more. Ultimately, this needs to be the domain of the legal department, who will be better equipped than IT staff to conduct a search designed to yield usable results.

But besides legal e-discovery, nearly every department will have a need for retrieval at some point. It is simply a waste of resources to require the IT department to conduct these retrievals. In the old days, it was necessary. Archives were kept on tape, on a shelf in a back room. The tape had to be physically retrieved and then loaded and read. But we’ve gone beyond that (hopefully) today.

Retrieval can take one of many different forms. Of course, when end users store their own emails locally in folders or PST files, they can do it themselves, but the process is decidedly clunky and inefficient and may be error-prone. The process instead needs to be rules-based, centralized, and automated. Exchange allows for easy integration with third-party services that allow for this.

In establishing a search and retrieval function, the IT department should implement a solution that gives end-users easy access, but access that is controlled with authentication and authorization to guarantee continued compliance with security requirements. Furthermore, the end-user interface should be web-based so that access can be gained from any browser, and lastly, the search function should be made efficient by allowing searches to be conducted not only from the subject header, but from the content as well. From a compliance perspective, most regulations will require an audit trail as well, and it will also be necessary to choose a solution that will log access.

Self-service retrieval

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The benefits associated with archiving Microsoft Exchange email and associated data, creates many cost effective solutions. Archiving facilitates government regulatory or civil litigation searches for ediscovery requests. It also allows for more complete archive journaling, and provides storage benefits for both mailbox growth and the various storage devices that can be utilized.

Although lowering storage reduction costs is a common denominator for email archiving, compliance requirements are moving more companies to implementing archiving strategies. Depending on the motivation factors, cost savings on storage are subject to interpretation by different people.  For some people, compressing email could reduce licensing, as well as storage hardware costs.  For others it may mean creating a mailbox for end users, which has virtually unlimited space.

The majority of Microsoft Exchange Server archiving solutions have some form of compression that reduces the size of overall archived emails.  For an Exchange email administrator, an unlimited space mailbox really just means eliminating the user responsibility of being concerned about having to archive their email. This allows mailboxes to grow as long as there is more than adequate disk space real estate available to allow seamless expansion.  The limitations of unlimited mailboxes are usually determined by the archiving options provided by the archiving solution. According to the Ferris Research blog, Microsoft recommends against using stubbing techniques.  Microsoft further recommends using 3rd party email archiving solutions that allow configurations to move email messages completely out of the mailbox without leaving stubbing foot prints  inside the mailbox.

6 different stubbing techniques are provided below only for informational purposes, but are not best practices recommended by Microsoft.

1. Substitute body and attachment with a plain text Stub
2. Substitute body attachment with HTML Stub
3. Maintain plain text body only with deleted attachment
4. Maintain HTML message body only, with deleted attachment
5. Maintain HTML body and image with deleted attachment
6. Message attachment residing in the archives

Will your current archiving procedures or planned archiving solution meet all future email storage requirements?

Archive Stubbing Techniques Not Recommended

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Started in 2005, the Electronic Discovery Reference Model (EDRM) Project was created to address the lack of standards and guidelines in the electronic discovery market.  EDRM is a great reference tool to develop guidelines and standards for ediscovery consumers and service providers.  EDRM helps reduce the cost, time and manual work associated with ediscovery.

Referencing the  accompanying EDRM diagram on their web site, the 8 areas lay out a structured foundation for facilitating the implementation of an archiving software solution.  This makes life easier with providing all the players standard guidelines, as part of the archiving and information retrieval process related to legal and government requests.

We will cover a cursory overview of EDRM.

Information Management
Getting your electronic house in order to mitigate risk and expenses should electronic discovery become an issue. This covers the initial creation of electronically stored information all the way through its final disposition.

Identification
This refers to the process of learning the location of all data which a company has a duty to preserve and potentially disclose in an upcoming  legal proceeding.

Preservation
Preservation for electronic discovery has become a complicated, multi-faceted, steadily-changing concept in recent years.  Certain suggested standards and guidelines have been emerging to provide checklists for those preparing to respond to electronic requests for production.

Collection
The acquisition of electronic information, which is  tagged as potentially relevant in the identification phase.

Processing
Electronic discovery processing must accommodate a wide variety of unstructured data, handle each form in a manner appropriate to its file type, and generate output that is structured in accordance with review requirements that often vary from one law firm to the next.

Review
At its most basic level the document review is used to sort out documents the company will actually provide and privileged documents that will be withheld.

Analysis
During this process, important knowledge for a case can be discerned from the large body of collected documents and email messages.

Production
With the unprecedented increase in the amount of electronic data that is being created and stored in the corporate environment, there has been a corresponding increase in focus on how that data that has been collected and reviewed is ultimately produced in civil litigation and regulatory investigation

Presentation
Displaying electronic information in front of audiences (i.e. depositions, hearings, trials, etc.), especially in native or near native file formats.

For more details on EDRM visit the Electronic Discovery Reference Model Project web site.

EDRM Guides Archive Strategy

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Let’s eliminate the confusion by understanding the difference between archiving and eDiscovery. Both are tied together, but serve two (2) distinct functions. The everyday operations performed with software processes that maintain historical email correspondence is that component referred to as archiving.  eDiscovery enters the business picure as an official legal or regulatory compliance request. eDiscovery requests ask for specific documentation which may be attached to an email or may contain relevant verbiage within the body of an email.

Let’s focus on those companies that perform eDiscovery. These companies are very different and unrelated to companies that provide archiving software solutions. You will find in your research that archiving software is referred to as “eDiscovery software”. The interchangeability of terms is semantical, at best.

The e-discovery 2.0 blog provides Gartner’s published eDiscovery MarketScope for 2009. Written by Debra Logan, John Bace, and Whit Andrews, it may very well be THE “buyers guide” available for companies interested in using electronic discovery technology to lower costs.

The eDiscovery MarketScope analyzes about 20 software companies focused on electronic data discovery. Based on extensive interviews with end customers and data from the companies themselves, Gartner rates the companies using criteria similar to those used in its famous Magic Quadrant reports. It also identifies market trends, and makes predictions for 2009 and beyond.

This report is required reading for anyone considering an investment in eDiscovery, known as archiving software.

Gartner’s investigation found that many of its corporate clients are saving large amounts of money by using eDiscovery software to reduce the amount spent on lawyers and legal service providers. It reports that customers typically recover their investment from buying eDiscovery software within 3-6 months of implementation.

Gartner addresses what is probably the most common question I get asked by corporate counsels and litigation support managers – namely, “Isn’t there a single product I can buy that will do end-to-end eDiscovery, covering all aspects of the EDRM?” The answer, of course, is “no” and Gartner goes further by predicting that the answer will remain “no” until at least 2011. For the immediate future, companies will need to buy “best of breed” archiving products from different vendors for the various stages of the EDRM model. This ensures they integrate smoothly.

Email Archiving Facilitates eDiscovery Processes

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

eDiscovery is fast becoming one of the hottest areas in law. This isn’t something that is yet taught in law schools. Many firms are just now starting separate departments for e-discovery.  This new course is really going to rachet up the need for implementing archiving systems.

According to Barry Murphy, formerly  of Forrester Research, the challenges are similar for all organizations, whether a bank, a consulting company or a biotech firm. The only difference is that banks are under more government regulation (e.g., SEC) than some other industries and often do discovery specifically for regulatory requests.

Barry also states “the Federal Rules of Civil Procedure (FRCP) amendments really affect organizations in three ways. First, they require a framework for early attention. Organizations not ready to address issues when litigation or regulatory requests hit will immediately be behind. Second, they give a safe harbor for data destruction, meaning there are no penalties for deleting electronically stored information in keeping with routine operation of IT systems if the party took reasonable steps to preserve it. However, this means that organizations must have granular retention policies in place, and technology to enforce those policies and audit the enforcement as well. Finally, there is the requirement for native file production. Organizations must be able to produce electronically stored information in its native format with its metadata intact and prove a valid chain of custody. Again, this spotlights the need for technology to manage the full life cycle of information.”

In November 2008 some 300 attorneys attended a conference at the David L. Lawrence Convention Center that explored how technology is changing legal practice. Pittsburgh attorney David Cohen, a partner in the Pittsburgh office of K&L Gates, co-chaired that conference, and is on the forefront of e-discovery, the gathering of electronically stored information like e-mail, databases and other computer files for civil and criminal cases.

As a co-chair of the firms’ e-Discovery Analysis & Technology Group, Cohen travels the country helping to bring organizations up to speed on e-discovery tactics.

“E-discovery is one of the hottest areas in law,” says Cohen, who counsels companies and presents training seminars on records management, e-mail sensitivity and e-discovery readiness. “This isn’t something that is yet taught in law schools. Many firms are just now starting separate departments for e-discovery.”

Is your company making preparations for eDiscovery? The writing is on the wall. Now is the time to be prepared before you have to, by implementing an archiving solution.

eDiscovery fast becoming the hottest area in law

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

According to Christopher S. Rugaber of The Associated Press, companies that help businesses track and search their e-mails and other electronic data are experiencing a surge of interest in the wake of a 2006 federal rule changes that clarify requirements to produce such evidence in lawsuits.

Companies used to be focused on how they store information. Now they’re focusing on how to retrieve it.

The new rules require U.S. companies to keep better track of their employees’ emails, instant messages and other electronic documents in the event the companies are sued, legal experts say. They are part of amendments to federal rules governing civil litigation and were approved by the Supreme Court’s administrative arm in April after a five-year review.

Amendments to the Federal Rules of Civil Procedure (FRCP) PRIMER
The Federal Rules of Civil Procedure (FRCP) govern civil procedure in the United States district courts. New amendments to the Federal Rules of Civil Procedure address the discovery of electronically stored information. On April 12, 2006, the Supreme Court of the United States approved and forwarded these amendments to Congress. Certain revisions to the Federal Rules of Civil Procedure address the preservation and discovery of data in electronic media, also known as e-Discovery.

Electronic discovery (e-Discovery or ediscovery) refers to “any process in which electronic data is sought, located, secured and searched with the intent of using it as evidence in a civil or criminal legal case.”

In regards to ECM and ERM, the two rules to focus on are FRCP 26(b)(5) and FRCP 34(b). FCRP 26(b)5 deals with General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; and Claims of Privilege or Protection of Trial Preparation Materials. FRCP 34(b) focuses on the Production of Documents, Electronically Stored Information and Things. These amendments to FRCP address a common corporate problem: the volume of electronically stored information and its maintenance.

During an electronic discovery process, all types of data serve as evidence such as text, images, calendar files, databases, spreadsheets, audio files, animation, websites and computer programs. Because of lax corporate management, email is often the most valuable source of evidence in civil or criminal litigation.

“All organizations should proactively prepare for the amendments,” warns AIIM President John Mancini. “The new rules will require businesses to have continuous, ready access to, and control of, all electronically stored information that may be relevant to the discovery phase of the litigation process.”

U.S. Rules favour Email Storage and Retrieval

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

More businesses are becoming subject to regulatory compliance. This could be either very formal stringent regulations such as the Sarbanes-Oxley Act or less strict regulations, such as the  Federal Rules on Civil Procedure (FRCP).   Exchange Server administrators should be educated on what levels of regulations their businesses are mandated to follow.  Email administrators should also be aware of what their responsibilities and deliverables might be if asked to provide current or historical information during an investigation. Organizations may direct that the human resources (HR) department, legal or the regulatory representatives lead this investigation.

The main purpose of implementing an archiving solution is to have the ability to secure email for search and discovery purposes. Archiving and store reduction is an additional bonus.  So how should an email administrator and information technology (IT) department proactively prepare for search and e-discovery requests?

Although it appears to be a natural process for IT departments to maintain control over the email archiving application, this should be avoided. Providing the appropriate administrative and investigative teams with individual access to the system will take significant pressure off overworked IT departments.  Each department should develop their own data protection guidelines to guard against random and frivolous searches - for obvious reasons. This ensures that searches are fully audited to prevent accusations of erroneous probing being directed at the IT department and therefore archive rolerelated training should be provided to those conducting searches. Also, the search interface must be reasonably easy to use for non-technology professionals.

To maintain objectivity, an important consideration is management assigning someone outside the IT department to conduct e-discovery tasks. So it should not be the Exchange Server administrator. The email administrator should not be involved in preparing data to be searched and should not be sifting through email for relevant messages resulting from specific search criteria. The retrieval component of the archive application should allow designated departments, such as human resources or legal to have access to performing email searches. The email administrator can recover the raw data for the requesting departments. The business should  provide the administrator with data criteria, but once that information is available, the departments manage the details of searches they choose.

Remove the IT Department from the e-Discovery Process

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators