1. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Official information in email – managing the risk of leakage ● Reduce risk via protective markings ● Simplify email security for end-users ● Whole of Government approach Neville Jones November 2005

2. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Concept ● PSM rules for email ● Keep ICT Security Simple for users ● make email system do the hard stuff ● get more value out of email system

3. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED In the beginning there was...

4. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Official email ● Email as channel – big – useful ● Risks for Government

5. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Email security difficult for users ● Message path hell ● Email policy hell ● Users are not routing experts! ● Users are not security experts!

6. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Message path hell ISP Private Individual (Remote) Officer Wireless (Wireless) Officer firewall Your Agency Officer Private network Partner Agency Officer Internet Partner Agency Corporate Network Officer Fax gateway PSTN

7. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Email security can be simpler ● Let email system do the work! ● Enforce policy at email components ● Use principles of PSM ● How to put protective markings in emails?

8. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Protective markings for email RFC2822 MESSAGE RFC2822 BODY RFC2822 HEADER MIME BODY(s) MIME ATTACHMENT(s) Message-ID: Date: Wed, 230 Nov 2005 9:28:09 +1100 From: "Jane Doe" User-Agent: Microsoft Outlook X-Accept-Language: en-us, en X-Protective-Marking: [VER=2005.6, NS=gov.au, SEC=UNCLASSIFIED, ORIGIN=j.doe@example.gov.au] MIME-Version: 1.0 To: "Smith, John" Subject: Hello World [SEC=UNCLASSIFIED] Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit

9. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Creating the marking

10. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Real world problem

11. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Risk management implementation ● Email client enablement ● Encryption invoked by classification level ● End user doesn't have to click “Encrypt”

12. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Wide scope of application ● Client side rules ● Gateway flow control ● Gateway encryption/decryption ● Official email register ● Archive management ● Web headers

13. Copyright © 2005 janusNET Pty Ltd UNCLASSIFIED Gateway flow control ● Major area of Government activity ● DSD / ACSI33 & AGIMO ● Sending ● Receiving ● Agency adoption