Secure E-mail standard released
Connecting state and local government leaders
An international government-industry group has published specifications for a secure E-mail standard that is intended to let governments communicate securely and with their private-sector suppliers.
An international government-industry group has published specifications for a Secure E-mail standard that is intended to let governments communicate securely with each other and with their private-sector suppliers.
The specs developed by the Transglobal Secure Collaboration Program are built on a trusted public-key infrastructure model, similar to the U.S. government's Federal PKI Bridge, but also include a policies and procedures for vetting and managing identity and access controls within an organization. This would assure users not only that an e-mail message is securely encrypted, but that the senders and receivers are who they say they are and are entitled to access the contents.
TCSP was formed in 2002 by the U.K. Ministry of Defense (MOD); its members now include the U.S. Defense Department, the Dutch government and a handful of major international defense contractors, including BAE Systems, Boeing, EADS, Lockheed Martin, Northrop Grumman, Raytheon and Rolls-Royce. Both the DOD and MOD plan to implement Secure E-mail, said TSCP Director Wayne Grundy, who also works for BAE.
'When you think about this in principle, it sounds straightforward,' Grundy said. 'When you try to implement it, it becomes tremendously complicated. That is why nobody has done it before' on a wide scale. 'It is done on a case-by-case basis.'
The goal of the standard is to extend trusted relationships throughout the government supply chain, which can include thousands of suppliers as well as government entities and their prime contractors.
Paul Grant, deputy information sharing executive for the DOD chief information officer, said the standard would turn e-mail 'from one of the most extensively used but least-trusted collaboration capabilities to one that can be trusted with sensitive information. This will serve as a foundation for sharing Controlled Unclassified Information with our mission partners, which certainly includes our suppliers.'
The U.S. Controlled Unclassified designation includes 'For Official Use Only' and 'Sensitive but Unclassified Information.' Across the pond, the standard will be used with information designated 'U.K. Restricted.'
The specifications were completed late last year. MOD has announced its intention to make Secure E-Mail standard on desktops across its enterprise this year. DOD completed testing of the specs last fall and is planning to pilot the standard this year in a large program involving most TSCP member companies, Grundy said. Details of the pilot are expected to be released soon.
'This is not about a specific technology,' Grundy said. 'The technology isn't necessarily unique. It's about how to get governments and other parties to agree' on who can be trusted.
The current implementation of the standard uses off-the-shelf e-mail products and open-source software, with CertiPath as the certificate authority. CertiPath is certified with the Federal PKI Bridge. The relationship between the federal bridge and CertiPath is unique because CertiPath itself is a bridge that cross-certifies certificates issued by aerospace contractors. CertiPath is a joint venture of Arinc, Exostar and SITA. VeriSign issues certificates to the CertiPath bridge for bridge-to-bridge trust.
Digital certificates act as electronic IDs, but the party or application accepting a certificate must have a way of validating it. When a foreign certificate is submitted to an application, it is passed on to the federal bridge, which verifies that it was issued by an organization whose policies have been accepted by the bridge. The bridge also can check with the issuing authority to ensure the certificate is still valid.
But the trust established by a PKI bridge is only as reliable as the practices of the member organizations for establishing the identity of employees and contractors who receive certificates, and for managing their access privileges within the organization. The Secure E-Mail specifications are a step-by-step manual on how this must be done. The system also requires an end-user encryption certificate lookup tool for the collection of unpublished digital certificates in Microsoft Outlook or Lotus Notes e-mail clients. Boeing developed this tool for Secure E-Mail.
The end result should be that a sender's and receiver's identities are known at a common level of assurance and still are valid, and that the underlying identity management systems can be trusted. This assurance is used to grant access to sensitive information.
NEXT STORY: Library of Congress gets more interactive