The Data & Identity Protection Journey
Janet Jones (Microsoft Corporation)• M3AAWG Vice-Chair• M3AAWG Data & Identity Protection Co-Chair

Thursday, November 8, 2018
Tokyo, JapanJP AAWG 1st General Meeting | Tokyo | November 2018

Agenda Introduction to M3AAWG working groups
 Data & Identity Protection
 The Journey Travelled The Road Ahead

JP AAWG 1st General Meeting | Tokyo | November 2018

Knowledge to Solutions - What Working Groups DoCommittees / SIGs
Technical• Messaging• Malware• Mobile• DDoS SIG• Internet of Things SIG
Collaboration Committee

Two Primary Activities
ProgrammingInformative presentations to the community

Deliverables

Best common practices documents, position
papers, white papers

Three Types of Groups
Birds of Feather (BoFs)

Opportunity to explore a set of problems andsolutions that can evolve into SIG, Committee, or
document champions

Special Interest Groups(SIGs)

A sustained group developing solutions welldefined problems: Info Sharing, Identity
Management and Pervasive Monitoring, etc.

Committees

Long standing topical areas such as Technical,
Public Policy, and Collaboration. These core issue
areas cross-cut many other areas.

Abuse Desk Committee
Public Policy CommitteeSenders Committee
Data & Identity Protection
Committee
Mobile/VTA SIG
Brand SIG
DNS Abuse SIG
JP AAWG 1st General Meeting | Tokyo | November 2018

2013 - SNOWDEN DISCLOSURESJP AAWG 1st General Meeting | Tokyo | November 20182013

https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order
JP AAWG 1st General Meeting | Tokyo | November 20182013

https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

JP AAWG 1st General Meeting | Tokyo | November 2018

2014 – M3AAWG TAKES ACTION

JP AAWG 1st General Meeting | Tokyo | November 2018

2014 – M3AAWG Tackles Pervasive Monitoring M3AAWG creates Pervasive Monitoring Special Interest Group (SIG) M3AAWG Senior Technical Advisor (Stephen Farrell – Trinity College Dublin) coauthors IETF Best Current Practice declaring “Pervasive Monitoring is an Attack” thatshould be mitigated in the design of IETF protocols, where possible.
 As you might expect, given that email is a core area of M3AAWG, the first Boardapproved anti-pervasive-monitoring recommendation was around "TLS for Mail:
M3AAWG Initial Recommendations“ This M3AAWG Board-approved document is short, providing basic recommendations:– Protect mail flows between providers with opportunistic TLS– Protect intracompany network traffic from eavesdropping– Protect user passwords from eavesdropping (IMAPS/POPS/SMTP Submit/webemail interface)

JP AAWG 1st General Meeting | Tokyo | November 2018

Opportunistic TLS

JP AAWG 1st General Meeting | Tokyo | November 2018

Opportunistic TLS Deployment Push
• As Facebook Messaging Integrity Engineer and M3AAWG Co-Vice
Chairman Mike Adkins reported on August 19th, there was “MassiveGrowth in SMTP STARTTLS Deployment” in a few months
timeframe from May 2014 – August 2014 as large providers madeprogress to deploy Opportunistic TLS.
•

https://www.facebook.com/notes/protect-the-graph/massive-growth-in-smtp-starttlsdeployment/1491049534468526

JP AAWG 1st General Meeting | Tokyo | November 2018

2015 - IS OPPORTUNISTIC TLS ENOUGH?

JP AAWG 1st General Meeting | Tokyo | November 2018

Man-in-the-Middle Threat

https://elie.net/blog/understanding-how-tls-downgrade-attacks-prevent-email-encryption

July 2015 M3AAWG Publication• M3AAWG Initial Recommendations for Addressing a Potential Man-in-the-Middle Threat

JP AAWG 1st General Meeting | Tokyo | November 2018

Using Perfect Forward Secrecy with TLS

https://www.expressvpn.com/blog/perfect-forward-secrecy/January 2016 M3AAWG Publication
M3AAWG Initial Recommendations for Using Forward Secrecy to Secure Data–“Enabling forward secrecy in conjunction with TLS assists in protecting captured traffic
against any possibility of eventual decryption.”
JP AAWG 1st General Meeting | Tokyo | November 2018

“Keys Under Doormats”
August 2015
“The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) supports the useof effective, end-to-end encryption. Mechanisms that intentionally compromise encryption putthat effectiveness at risk. Therefore M3AAWG endorses the recommendations in the recentpaper "Keys Under Doormats: Mandating insecurity by requiring government access to all dataand communications" written by 15 noted security experts. The widely recognized authors
include cryptography expert Bruce Schneier and researchers from MIT, Stanford University,
Columbia University, Cambridge University, Johns Hopkins University, Microsoft Research, SRI
Worldwide and Worcester Polytechnic Institute.”

JP AAWG 1st General Meeting | Tokyo | November 2018

2016 - M3AAWG DRAFTS NEW IETF PROTOCOLSJP AAWG 1st General Meeting | Tokyo | November 2018

SMTP Strict Transport Security/TLSPRT“Devised by engineers from Google, Microsoft, Yahoo, Comcast,LinkedIn and 1&1 Mail & Media Development & Technology, the SMTP
Strict Transport Security is a new mechanism that allows email
providers to define policies and rules for establishing encrypted emailcommunications.”
https://www.pcworld.com/article/3046484/security/google-microsoft-yahoo-and-others-publish-new-email-security-standard.html

JP AAWG 1st General Meeting | Tokyo | November 2018

2017 – IDENTITY MANAGEMENT / CRYPTO COSTS

JP AAWG 1st General Meeting | Tokyo | November 2018

Identity ManagementFebruary 2017 M3AAWG Publications• M3AAWG Multifactor Authentication Recommendations“M3AAWG urges providers not to wait for the rest of the industry to deploy
multifactor authentication before doing so themselves. A critical mass ofinstitutions needs to take a leadership role and set the example for theirindustry peers—otherwise, deadlocks may result.”• M3AAWG Password Recommendations for Account Providers“M3AAWG recommendations for ISPs and other providers who continue torely on passwords. It briefly describes the risk model arising from the use ofpasswords to provide authorized or secure access to resources. It isintended to improve end-user security by encouraging strong passwords.”
JP AAWG 1st General Meeting | Tokyo | November 2018

Cryptography Costs
March 2017 M3AAWG Publication• M3AAWG Describes Costs Associated with Using Crypto“While there are "costs" to doing anything and everything, theMessaging, Malware and Mobile Anti-Abuse Working Group
believes the "costs" associated with deploying encryption should
not be a "show stopper," that is, should not be a barrier toemploying encryption.”

JP AAWG 1st General Meeting | Tokyo | November 2018

2018 – 5 YEARS POST SNOWDEN DISCLOSURESJP AAWG 1st General Meeting | Tokyo | November 2018

https://www.theguardian.com/us-news/2018/jun/04/edward-snowden-people-still-powerless-but-aware

JP AAWG 1st General Meeting | Tokyo | November 2018

2018 – NEW IETF EMAIL SECURITY STANDARDS PUBLISHEDJP AAWG 1st General Meeting | Tokyo | November 2018

Adoption of New Email Security Standards

https://www.hardenize.com/blog/mta-sts

JP AAWG 1st General Meeting | Tokyo | November 2018

Sample MTA-STS Policy

https://www.hardenize.com/blog/mta-sts

JP AAWG 1st General Meeting | Tokyo | November 2018

MTA-STS Deployment Steps

https://www.hardenize.com/blog/mta-sts

JP AAWG 1st General Meeting | Tokyo | November 2018

2018 – M3AAWG PERVASIVE MONITORING SIG
BECOMESDATA AND IDENTITY PROTECTION COMMITTEEJP AAWG 1st General Meeting | Tokyo | November 2018

The Road Ahead

JP AAWG 1st General Meeting | Tokyo | November 2018

Upcoming Focus• Continue working with industry partners on implementation SMTP MTA
Strict Transport Security (MTA-STS) and SMTP TLS Reporting• Working across the member community to understand impact for theupcoming Transport Layer Security (TLS) Protocol Version 1.3 release• Working with M3AAWG’s IEFT liaison to evaluate the Deprecating
TLSv1.0 and TLSv1.1 and Messaging Layer Security (MLS) Protocol todetermine how the member community should contribute• Upcoming focus on Identity Management and non-email messaging
security

JP AAWG 1st General Meeting | Tokyo | November 2018

How can JP AAWG help?

• Partner on implementation of SMTP MTA Strict Transport
Security (MTA-STS) and SMTP TLS Reporting standards• Participate in future M3AAWG meetings• Submit topics for upcoming meetings• Engage with M3AAWG Committee Chairs to collaborate oninitiatives

JP AAWG 1st General Meeting | Tokyo | November 2018

Acknowledgements / Contact Information
Data and Identity Protection Committee Leadership• Alex Brotman (Co-Chair - Comcast)• Joe St. Sauver (Senior Technical Advisor – Farsight Security)• Stephen Farrell (Senior Technical Advisor – Trinity CollegeDublin)
Contact Information• Janet.Jones@Microsoft.com

THANK YOU!
JP AAWG 1st General Meeting | Tokyo | November 2018