Intro

In this lesson, we begin our look at enabling safe employee participation in remote meetings and access to information resources across the cloud and in the data center. In this video, I address video conferencing, instant messaging, and email. In part 23 of this series in CISSP Domain 4, I cover remote access security in general. You can download the script for this video from above or at the end of the video. The script includes slide graphics.

Remote working risks

Prior to COBIT, working remotely was a benefit mostly provided to employees who needed frequently to travel for business. Today, however, working from home is becoming something employees expect from current or potential employers. This change increases remote access risk across remote access and collaboration activities, including video conferencing, online document editing, real-time file exchange, versioning control, instant messaging, and email. Risk for these challenges is largely managed with video conferencing, instant messaging, and email safeguards, which we now cover.

Video Conferencing

Video conferencing is a key component of working remotely. Working from home or while on the road does not remove employee requirements for collaboration with other employees. This can take the form of simple voice conference calls or video meetings using tools like Zoom or Webex running over on-premise or cloud-based services. During remote meetings, some or all participants might connect over hostile networks: home or public. Connections might also happen across vendor networks. Employees at the office might use office Wi-Fi to connect. Devices used include smartphones, tablets, desktops, or laptops. Organizations implement video conferencing services via on-premise or cloud services. Regardless of how video conferencing is implemented, baseline safeguards include identity verification to access the call. The strength of the verification should match the classification of the information discussed at the meeting. Content encryption across the internet and over in-office Wi-Fi. Basic VoIP, or voice over IP, protection as described in the video above; and ensuring meeting attendee need-to-know for highly classified data. Attendees should both have the need to know the information discussed and have data owner permission for access.

Instant Messaging

Employees only make voice calls when they're absolutely necessary. Most employees today use instant messaging, or I'm, for quick personal and business communication however it isn't just typed in data that's sent i am also includes file transfers voice recordings screen sharing remote control and command scripting the ease with which users can distribute business data even when phished via IM can raise risk to higher than acceptable levels. Vulnerabilities that increase this risk include lack of strong authentication. Organizations must protect employee IM access with identity verification that is appropriate for each employee's role. Lack of encryption. As with any communication medium, organizations should encrypt classified information in motion or stored in IM application data repositories. Compromise of systems and devices. This is related to the first two vulnerabilities. Compromise of smartphones or other devices on which IM is used can make all IM content available to a threat actor, and lack of employee awareness. Residual risk always remains. When using IM, most of this risk is manageable with user training and awareness. Training content should include organization policies governing use of IM and email for sharing of data. Further, employees should understand how social engineering attacks are enabled using IM.

How Email Works

Email is considered by many organizations to be the most important communication medium they have. It is also the preferred attack vector for many threat actors. First, let's walk through how email works. First, the user uses a mail user agent, or MUA, like Outlook, to create a message. Second, once the sender clicks send, the MUA transfers the message to a mail delivery agent, or MDA. MDA is an umbrella term for software that manages email delivery between message transfer agents, or MTAs. MTAs move messages from one email server to another. They use DNS MX records to locate destination addresses. The sending MTA uses SMTP to send the message to the target email servers MTA. The receiving server's MDA receives the message from the receiving MTA and places it in the receiver's inbox.

Email Policy

The first step in achieving these goals is the creation of an email policy. The policy should include acceptable use. Employees must understand authorized and unauthorized use of the organizational organization's email services. This includes how to send or not to send classified information. If classified information is sent, how must they protect it? Access control. Inboxes that include sensitive information transactions should be assigned to a specific, auditable user. The user should use strong authentication appropriate for the risk. Expectation of privacy. It's common for employees to expect some privacy when using email. However, the organization should make it clear that messages are filtered for content. In addition, many organizations state clearly in employee handbooks or employee hiring paperwork that they should have no expectation of privacy. Employees should clearly understand the level of privacy they can expect; and backup and retention. Email content. Content constitutes official business communications in addition to creating a communications record. Email content is also subject to retention rules such as e-discovery orders. Email protection includes backups and archival of critical threads.

Attacks against email

Now let's look at attacks against email and how to minimize the associated risk. Threat actors use phishing and spoofing campaigns to obtain authentication credentials for both email and business resources. Threat actors use phishing attacks to lure users into clicking on malicious links or opening infected attachments. This can result in redirection to a malicious server designed to collect the user's credentials. Spoofing attacks are a subset of phishing. A threat actor sends a message that looks like it's from a known organization or someone with whom the user interacts. This includes creating a source domain name that appears to be legitimate. Again, the threat actor's goal can be to obtain user credentials or convince the user to share files or other data.

Email Controls

Interception and eavesdropping are also possible when the right safeguards are not in place. Anything that travels across a network or the internet is subject to capture by a threat actor. Capture can result in information theft or modification. Encryption is an important safeguard for protecting message confidentiality. Multi-factor authentication helps protect against stolen credential use. Phishing and spoofing normally get access to a user ID, password, and answers to secret questions. Also, organizations should have procedures in place to manage the secure use of secret questions for identity verification. Safe use of secret questions is addressed in the article above. Verification of senders and the protection of message confidentiality and integrity is possible with security protocols that we cover in the next slide.

Email Secure Protocols

Controls that help manage this risk include S/MIME, or secure multi-purpose internet mail extensions. It's a standard protocol that uses public-private keys and x.509 certificates for digitally signing and encrypting messages. For a more detailed look at how asymmetric encryption enables this, watch the video above. S/MIME can support authentication, confidentiality, integrity, and non-repudiation to create two types of messages: signed messages and enveloped messages. Signed messages verify the sender, establish non-repudiation, and ensure message integrity. Digital signing is the most common use of S/MIME. Enveloped messages are encrypted and extend protection or signed protection to confidentiality by protecting the message content with encryption. Mime object security services, or MOSS, uses symmetric encryption and the multi-part signed multi-part encrypted frameworks for message signing and encrypting. MOSS is not widely used. MOSS uses MD2, MD5, RSA, public key, and DES for authentication, confidentiality, integrity, and non-repudiation. PEM, or privacy enhanced email, is a file format used for storing and sharing keys, certificates, and other sensitive information based on IETF standards. PEM was never popular and was pushed to the side by PGP and S/MIME. PGP uses a set of algorithms to encrypt email and other digital assets. It is widely used, even though it is not a standard. Domain keys identified mail, or DKIM, is used to ensure that messages coming from a specific domain are actually authorized by the domain. The owner does this with digital signatures created with certificates linked to a domain name. Each message is signed by the infrastructure and is transparent to the users. The public keys needed to verify the message signatures for protected domains are stored in a DNS record. This enables retrieval of the key by a DNS lookup. And finally TLS, or transport layer security, which enables encrypted remote access to email services. Cloud services like Gmail automatically enforce TLS connectivity. For a detailed look at how TLS works, watch the video above.

Instant Messaging

Instant messaging used for business communication, and that is outside an organization's control, introduces legal, civil, and regulatory risks. It can contain classified information regulated by privacy and of other rules. It's difficult to know where the message data is stored and the length of data retention. It's difficult to or impossible fully to comply with e-discovery orders. Requiring the use of a business-managed messaging solution helps avoid general IM risks. In addition to data management and filtering related to messaging and chat, some solutions also offer full secure collaboration tools, including video conferencing. I listed examples on the left including Google Workspace, Microsoft Teams, Slack, Cisco Jabber, and Webex App. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click.