E-mail security as a (not-so-simple) service

As the government’s largest civilian department and the nation’s largest health care provider, the Veterans Affairs Department is faced with a formidable challenge in securing the sensitive information about the nation’s veterans being used each day.

“We needed a way to secure and encrypt e-mail and its contents in an easy fashion,” said Charles De Sanno, VA associate deputy assistant secretary for IT services delivery and engineering. The tools for doing this exist, but “the technology is not that user-friendly and intuitive.”

The department considered public-key infrastructure plans and SMIME, the Secure Multipurpose Internal Mail Extension standard, but for simplicity's sake it settled on Microsoft’s Rights Management Services (MS RMS), an information protection service that works with enabled applications to encrypt data at rest and in transit. It also gives the ability to set attributes to determine what gets encrypted and to manage who can access the data.

Related coverage:

Plan would help agencies control sensitive data 

How to prevent data breaches -- and respond after they occur anyway 

How to improve security? Centralize IT management, VA CIO says

Six years ago, the VA was recognized by Microsoft as having the largest enterprise implementation of its Rights Management Service, and it still is one of the top three, De Sanno said. But usability remained an issue.

“All the functionality is certainly there,” he said. “It is not that it is not user-friendly.” But options for the various attributes that the user must set for adequate control of the data can be cumbersome. The user is required to go through a long list of options, and in the end the success of the plan and the department policies it supports depend on the willingness and ability of the end user to make the right selection. If the wrong selection of attributes is made, the policy will fail even when the technology performs as intended.

A simpler front end

To simplify this, VA selected Message Classification and Document Classification tools from Titus Inc. as the front end MS RMS to provide a customized interface and simplify classification.

“Rights Management has the ability” to enforce policy, De Sanno said. “Titus interfaces with the management service and sets the bits.” The Titus classification products also allow metatagging of messages and documents for easier classification and search and retrieval.

Titus Classification is a client application which is populated with policy through an administrative console. When classification is being used in an application, creators of documents and e-mails are forced to label them, using a drop-down menu of options that have been created by department administrators and pushed out to the client application. This embeds a visual label on the document, which is linked to a set of policy rules for encryption, distribution and access to the information.

Message Classification performs some policy enforcement within the application because that data is inherently in motion. Document Classification relies on the Rights Management Service for enforcement, said Titus president and CEO Tim Upton.

Enforcement options include:

• Stopping a messaging from being sent to a non-authorized recipient, or warn the sender that a recipient is not authorized for that classification and allow the option of overriding the policy.
• Automatically removing an unauthorized recipient from the recipients list.
• Automatically redacting sensitive data that is being sent to unauthorized recipients.

Integrating a user-friendly tool into an e-mail application is not a trivial task, Upton said. “It’s hard to do it right and elegantly,” he said. “E-mail is an incredibly complicated system” with “a lot of things to break.”

In addition to writing and sending a message, there are other functions including reply, reply all, group addresses, and calendar and task lists. “These things make e-mail a difficult thing to add on to.”

In the end, however, the greatest challenge in ensuring that sensitive data is not leaked is the end user who must be aware of and comply with policy, as well as use the classification and enforcement tools properly. “Obviously a human has to make the decision,” De Sanno said. “You come out with a policy, but the human decision process has to take place. The burden has always been on the user.”

'Spell check' for classified info

This challenge is being met in part by automated functions within the classification tools themselves, such as searches for flagged phrases and formats that can then be redacted from a message or document. This works something like a spell-check, applied to sensitive information. This can include specific words or phrases, such as “Project XYZ,” or numerals in a distinctive format, such as those used for credit card accounts or the familiar XXX-XX-XXXX pattern for Social Security Numbers.

Classification and rights management tools also can be helpful in increasing user awareness by forcing the user to choose a classification when the document is created. This does not ensure that the right classification will be applied, but it helps to ensure that the policy is not completely ignored. “We are giving people tools to allow them to more easily deal with policy,” De Sanno said.

Ultimately, however, there is little the Titus Classification tools can do against the malicious or willful user. “That’s always going to be a challenge,” Upton said. “We are not a failsafe security solution. We are one element of it.”

To further support the classification tools, VA also is looking for additional ways to mine data from documents and automatically assign attributes.

“We have some pattern matching tools,” which are being tested for accuracy, De Sanno said. They currently are performing at around 87 percent accuracy, which is pretty good but not quite good enough to implement in a desktop application. “You’re never going to be 100 percent,” but improvements are being made in the algorithms that identify and respond to sensitive information, and the department hopes to be able to starting using them within the next year.

Like the classification tools it would support, it would not be a complete solution and would not replace other tools already in place. “We plan on using that as a backup,” De Sanno said.

It is unlikely that a department as large and unwieldy as VA will ever become perfect in controlling the huge amounts of sensitive information it holds. “With a huge organization, deciding what to do and doing it is complex,” De Sanno said. But employee training and education backed up by multiple layers of technology can help to improve the controls on that information.