Email Security and Availability inside Government

By Stacey McDaniel

Email has become an essential information tool inside the government for transporting vital information. That's why protecting email from internal and external threats and ensuring its availability 24x7 is crucial. In this article we will discuss ways to protect email data and systems from abuse and attack, make them available for authorized government purposes, including internal investigations, and help meet requirements for regulatory compliance and legal discovery.
 
Security and availability conundrum
Government agencies depend on email for employee, inter-agency, and constituent communications. The important, yet sensitive nature of such communications requires fail safe security and optimum availability for the email infrastructure and its contents. Beyond merely being secure, the information that flows in and out of the email system must be archived and kept readily available so that it can be retrieved if need be. Maintaining email security and availability simultaneously can be difficult as they are interdependent but inextricably tied goals where trade offs are often difficult to decide, but necessary to make. The good news is that that trade-off is no longer necessary.
 
Sparking the need
As email technology continues to evolve and become more ubiquitous, certain issues have sparked the need to maintain email security and availability. Some of those issues, bolstered by statistics drawn from the latest Internet Security Threat Report, are:

• Increasing volume of spam Spam made up 50% of all monitored email traffic in the last six months of 2005.
• Rise in phishing One in 119 emails sent in the last half of 2005 was determined to be a phishing attempt, up from one in 125 in the beginning of 2005.
• Web application vulnerabilities 69% of the vulnerabilities documented in the second half of 2005 affected Web applications, which include Web-based email.
• Constant mass-mailer threats Mass-mailing worms and viruses pose a continuing threat. One example is Sober.X, the most widely reported malicious code sample of the last six months of 2005.
• Email as a legal document The United States, Europe, and other countries recognize email as a legal business record that must be preserved.
• Email as evidence More legal cases are requiring the discovery of email, also leading to the need to preserve and store it.
• Regulatory climate New regulations are making organizations accountable for retaining, auditing, and supervising internal and external email communications.

Email security and availability starts by controlling and managing the flow of email information to minimize the agency's risks, and to ensure that normal daily operations are uninterrupted. To achieve this control, organizations need a layered approach that starts at the point of entry onto the network, working through to the end user and beyond to archiving and storage systems recognizing the threats and risks at client, gateway and server. Here is some more insight into that approach:

Email security
Securing the email environment involves avoiding receipt of unwanted content, preventing unwanted Internet email from reaching downstream servers, and inspecting internal mail traffic.

• Reduce email volume First, educate users regarding email usage policies and best practices. For example, all users should be aware of basic policies and procedures such as not replying to spam messages, not using unsubscribe links, not following links in suspicious emails, and not opening email attachments from an unknown source. Second, technology designed to block spam and other unwanted mails should be implemented.
• Protect the perimeter The two primary email-borne threats are viruses and spam. Gateway-based antivirus scanners should be used to identify mass-mailer worms so they can be removed. Also recommended is attachment filtering via a policy designed to delete messages when the presence of a suspect extension type, such as .scr and .pif, is detected. Finally, an integrated antispam solution that comes equipped with a frequently updated response mechanism with highly accurate spam definitions and techniques is also important.

Archiving
Housing the seemingly endless influx of emails is a challenge that almost all administrators face. A storage management solution allows administrators to minimize the size of primary storage and leverage more cost-effective secondary storage without burdening the user or losing critical data and optimizing access to content. It's not just a storage concern -- these days, archiving is viewed as a best practice in IT management -- it's a way to preserve critical company information based upon business needs. Effective archive policies and procedures are also a part of good governance as mandated by OMB Circular A-123. Therefore, when considering a storage management solution, accessibility to archived emails is also important.
 
Resiliency
Equally important to maintaining the security and availability of email information is the need to build the email infrastructure on a resilient foundation -- one that is robust in its ability to meet growing demands, is resistant to failure, and can quickly recover when failure occurs.

• Backup and recovery To reduce the impact on critical systems, organizations need to consider online database and application-aware backup and recovery for their specific email messaging system.
• Scalable storage Another key is to build a highly scalable storage management environment. Rather than relying on traditional, time -- consuming, and expensive methods of scaling, it's important to view the email environment more holistically as a system of unified and available resources that can be leveraged and shared across the entire messaging network.

Conclusion
The task of maintaining email security and availability at the same time used to be almost impossible, but thankfully this is no longer the case. Integrated solutions that enable email security, resiliency, and storage are now available to help ensure that only relevant email gets through and all email is housed in a secure and accessible location. That's good news for IT administrators, who have had to come up with piecemeal ways to house and secure exploding amounts of email over the years.

Stacey McDaniel has been writing about high-tech issues for more than six years.