About Us | Contact Us
View Cart

Alarming Recurring Finding

By Dan Hadaway | Tuesday, March 8, 2016 - Leave a Comment

“Mal-Configured Secure E-Mail . . .”


A new risk arises as Secure Messaging Enters the Late-Majority Adoption Phase!
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


ServIcons_ITAudit_01

So we’re auditing a bank and they send us files using their shiny new “Secure E-Mail System” and guess what?  It’s not secure AT ALL.

Then we notice it happening at another couple of banks, and then at another couple of vendors, so now we’re worried: people are rolling out new systems that give them a false sense of security.

So because we’re seeing this rather often now, we need to get the word out:  If recipients are not authenticating to receive documents sent through these systems, you are probably fooling yourself (and your recipients).

As companies adopt secure messaging, they are either selecting the option–or it defaults to the option–that the recipient need not authenticate to retrieve the document.  Configuring the secure messaging system in this manner exacerbates the risk of a man-in-the-middle attack.

We’re seeing this primarily with Citrix Sharefile, but we’ve also seen it with other systems.  Based on our own experience rolling out several secure message packages, we fear this may be a reaction to recipients complaining that they can not remember their password.  While we understand forgotten passwords are an inconvenience, bypassing authentication is NOT an adequate solution.

With our vendors, we can’t really do much about it other than (hopefully) convince them to change their configuration and politely request they do not use it for our information until it is configured properly.  In the case of our Clients we hope that it’s caused by these systems being poorly configured by default, because if they’re intentionally bypassing authentication it means they’re not doing proper risk assessments prior to implementing a change!

 

malconfigured_e-mail_server

The above diagram illustrates what a man-in-the-middle attack looks like in this scenario. First though, here’s what should happen: When a new secure message is sent, the system will send an e-mail notifying the recipient of the message. The recipient then clicks on a link in that e-mail that takes them to a secure web page where they SHOULD have to authenticate to get access to the sensitive information.

What we’re worried about–the man-in-the-middle attack–happens when someone inserts an e-mail server into the path that does nothing but copy e-mail messages.

When you do not configure the system to require authentication, the man-in-the-middle has the same access to the sensitive information as the recipient, via the link that is sent in the notice.  Keep in mind this could be a person twenty years down the road who discovers the e-mail on a retired server.  That’s the problem with unencrypted e-mails: they can be available for years and years.

If the secure message system is configured to require authentication, however, merely having the link offers the man-in-the-middle nothing more than a login page. At this point there’s a good chance any would-be attacker will simply move on to a more attractive target–like an organization which HASN’T configured their secure message system correctly.

But a teachable moment arises here in this age of encrypting everything: data needs to be encrypted both in motion and at rest.  If you are not requiring authentication then you are only providing encryption when the data is in transit, when the link is clicked to download the sensitive information. While it’s good that the data is encrypted in motion ANYBODY IN THE PATH can download the information, which is kind of like not encrypting the data at rest!

This approach creates a false sense of security. Malicious servers in the delivery path will surely be adding those secure messaging companies who offer their product configured this way by default to their key-word search.

So please spread the word!  And, when you are sent a link to sensitive information that does not require you to authenticate, consider sending this article to the person who THINKS they are protecting information.


Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”


same_strip_012513


 

Latest News
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Many organizations still fail to consider the unique risks posed by cloud computing… An article review. Last month thousands of Western Digital MyCloud device owners learned about the risks of cloud-based solutions the hard way: their data had been wiped remotely due to a flaw in the internet-facing component of their external hard drives. While […]
    infotex does not use Kaseya… We are protecting our Clients! Another blog post meant to inspire thought about IT Governance . . . . To all infotex managed security service Clients: As you may be aware there was a large ransomware attack recently that leveraged a remote management tool called Kaseya that is used by many […]
    While we’re not a news service, we often use current events to comment on trends and our services. This blog is intended to get people thinking about topics and trends in Technology Risk Management, through our article reviews, as well as through original blog articles about current events and our MSSP services (such as our […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS Dan Hadaway and Sara Fultz co-wrote an article in the Spring 2021 issue of the Ohio Record, the Official Magazine of the Ohio Bankers League.  Find out on page 20 and 21 of the magazine how tabletop testing strengthens bank cybersecurity. You can read the article here! […]
    You’ve heard it from every MSSP you’ve met: the definition of a SIEM is in the eye of the beholder. But at infotex, we are not talking about the database – an asset whose definition is continuously evolving. We’re talking about the way three teams collaborate in an overall Technology Risk Monitoring process. And whether […]
    After the large number of high-profile breaches in the recent months, it is easy to become disconcerted about how to prevent such things from happening to your Bank. The answer to preventing a breach is a very complex one. infotex will explore this with you! The heightened level of awareness and extra protective tendencies that […]
    A follow-up on Dan’s 2008 Password Manifesto On the NIST Publication on Digital Identity Guidelines Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . In June 2017, NIST released a special publication on digital identity, NIST SP 800-63, that is starting to get the attention […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Over Seven Billion Usernames Have Been Leaked in Breaches Since 2011… An article review. An unfortunate fact of modern life seems to be the inevitable announcement of new data breaches, and if you’ve lost track of how many breaches you’ve had to perform a risk assessment on you’re probably not alone…but just how much personal […]