Most of us have inadvertently sent email to an unintended recipient due to the fateful “Reply All” button, or as a result of a hastily typed recipient name that gets “Auto-Completed” with the email address of somebody who has a similar name to the intended recipient. The result can be not only embarrassment, but actual data leakage that should be treated as a security incident or breach.
This blog discusses how common mistakes including inserting the wrong email address and sending emails that contain sensitive and restricted data to the wrong recipient(s),can impact an organization, and how the TITUS Aware for Microsoft Outlook product can prevent these kinds of incidents.
When the convenience of auto-completed Email recipients turns into a data breach
The results were disastrous in 2010 for the Gwent Police Department in the UK, when an unencrypted spreadsheet containing the results of criminal record checks was accidentally sent by a police department employee to a newspaper, instead of an internal departmental recipient. The culprit was the “Auto-Complete” feature in their email program that filled in, or suggested, the newspaper’s email address as a CC recipient, rather than the intended internal recipient.
The file contained Personally Identifiable Information (PII) of 10,000 citizens who had applied for jobs that required criminal record checks. For a brief summary of the story, click HERE. If only the unfortunate police department employee had been warned that they were about to make this mistake, the incident would certainly have been avoided by alerting the user before they send an email to correct the recipient list.
The ultimate unintended Reply-All ruins a legal case
Imagine being an attorney working on a legal case when you respond to a colleague’s email with the Reply-All button, and realize that the recipient list included a member of the opposing counsel. This could be the ultimate breach of attorney-client privilege. In such a case (click HERE), the judge, when asked to rule that the email’s content was inadmissible, noted that this was not the first incident of this type for the attorney in question. Clearly, a firm is expected to be diligent with its email communications.
How TITUS Aware for Microsoft Outlook can help solve inadvertent email misdirection
TITUS Aware for Microsoft Outlook is a powerful email tool for preventing data leakage. Policies can be defined to warn an users or to prevent email from being sent when certain rules are violated.
For example, in the case of the Outlook Auto-Complete problem, any email recipient that is not within predefined SMTP “Safe Domains” (e.g. the employer’s corporate domain) can trigger a pop-up warning to the user to inform them of the potential data loss and asking how they wish to proceed. Giving users a second chance to review the recipient list, to make sure that there are no unintended external recipients, can prevent massive breaches such as occurred in the Gwent Police Department story above.
The image below shows a typical warning, to a user, that a recipient selected via Auto-Complete is actually an external Hotmail user.
Figure 1 – Safe Domains in TITUS Aware for Microsoft Outlook
The risk of accidentally using the Reply All button can also be mitigated through the use of the “Maximum Recipients” feature in TITUS Aware for Microsoft Outlook. When a message has more than a certain number of recipients, a rule can be triggered that presents a warning dialog to the user. This gives users a warning that they might be sending the email to more recipients than they had planned. This can be enough of a reminder that the user will correct the recipient list.
The administrative setting shown in the image below allows for a maximum number of message recipients. Whenever the number of recipients exceeds this value, the user will see the warning dialog.
Figure 2 – Maximum Recipients Setting in TITUS Aware for Microsoft Outlook
These are just a couple of examples of how TITUS Aware for Microsoft Outlook can guide users to making good security decisions when working in a high-pressure environment. Overall, the aim is to create a decision point for the user, encouraging them to review what they plan to send and to whom. This increases users’ responsibility and helps to correct any digressions from the company’s security policy before an incident happens.
How soon do you think the next preventable email incident will occur in your organization? Having an automatic reminder can really reduce the chances of it actually happening. In addition this will empower the user and enable IT to focus on more strategic tasks
If you’d like more information on how the TITUS products can help implement recipient list validation to improve DLP, please use the coordinates on our Contact Us page to let us know.
