N-6Exhibit E - Canadian Centre for Cyber Security Email Best Practices (ITSM.60.002, August 2025)
28 passages
1.1.3 Malware Threat actors often use email to deliver several types of malware, such as viruses, worms, ransomware, and spyware. Malware can be directly attached to emails or embedded in shared documents sent as attachments, links, or thr...
AI summary This section discusses the use of email by threat actors to deliver malware, such as viruses, worms, ransomware, and spyware, which can lead to unauthorized access and data compromise. It also references a ransomware playbook for defense and recovery.
1.1.4 Business email compromise BEC presents a growing concern for organizations of all sizes and across various industries. This sophisticated scheme often targets businesses engaged in wire transfers. Threat actors aim to defraud organiz...
AI summary Business email compromise (BEC) is a growing threat targeting organizations through sophisticated scams that impersonate executives or business partners to defraud them of funds. These attacks are highly financially damaging and rely on social engineering tactics to deceive employees into transferring money to fraudulent accounts.
1.1.5 Impersonation Impersonation is used by threat actors to exploit trust, benefit financially, or access sensitive information through email. For instance, in BEC, threat actors pose as trusted individuals, like employees, to steal from...
AI summary Impersonation is a tactic used by threat actors to exploit trust and access sensitive information through email. This includes Business Email Compromise (BEC), attorney impersonation, and brand impersonation, all of which aim to deceive individuals into revealing confidential information or committing financial fraud.
1.1.6 Data exfiltration Data exfiltration involves the unauthorized transfer or removal of sensitive information from an organization's email system. Threat actors use various techniques, such as phishing, spyware, or malware, to exfiltrat...
AI summary Data exfiltration refers to the unauthorized transfer of sensitive information from an organization's email system, often through phishing, spyware, or malware. This can lead to cybercrimes such as extortion and data sales on the dark web, resulting in significant business and legal consequences.
2 Email security protocols Email security protocols are important for protecting digital communications, as they prevent unauthorized access to email content. These protocols establish rules and standards that govern the transmission, rece...
AI summary Email security protocols are essential for securing digital communications by preventing unauthorized access. They establish rules for transmitting, receiving, and handling emails, ensuring confidentiality, integrity, and availability. The Cyber Centre provides guidance on implementing technical measures to protect domains from spoofing.
2.1 Transport layer security Transport layer security (TLS), which replaces secure sockets layer (SSL), is a cryptographic protocol for establishing a secure communication channel via a 'handshake'. During a TLS handshake, the two communic...
AI summary Transport Layer Security (TLS) is a cryptographic protocol used to establish secure communication between a client and a server. While it encrypts data during transmission, it does not provide end-to-end confidentiality as the sending and receiving servers can still access plaintext messages. TLS also does not guarantee encryption for all intermediary transfers of email across servers.
2.3 Pretty good privacy and open pretty good privacy Pretty good privacy (PGP), including open-source pretty good privacy (OpenPGP), ensures end-to-end encryption for secure plaintext, emails, and files, restricting access to only the inte...
AI summary Pretty Good Privacy (PGP) provides end-to-end encryption for emails and files, ensuring secure communication. It uses public-key cryptography and requires both sender and receiver to have compatible software and exchange public keys. While PGP is cost-effective and widely available, its implementation can be complicated due to compatibility issues with major email services.
2.6 Domain-based message authentication, reporting, and conformance Domain-based message authentication, reporting, and conformance (DMARC) helps prevent email phishing and domain spoofing by allowing domain owners to define protocols for...
AI summary DMARC is a protocol that prevents email phishing and domain spoofing by allowing domain owners to define policies for handling unauthorized messages. It relies on SPF and DKIM to authenticate emails and ensures that messages are handled effectively by recipient servers, such as rejection or quarantine. Major email providers like Gmail and Microsoft enforce strict DMARC policies for inbound emails.
3.1.1 Use email encryption and encrypted connections Email encryption and encrypted connections play important roles in ensuring robust email security. Together, they safeguard sensitive information throughout the communication process. Em...
AI summary Email encryption and encrypted connections are crucial for securing sensitive communications. TLS protects data during transit but does not prevent service providers from accessing emails. S/MIME and PGP offer end-to-end encryption, ensuring confidentiality even on servers. A hybrid approach using TLS/HTTPS and back-end encryption is recommended for secure data transmission and storage.
3.1.2 Implement protocols to validate user identity and server identity Implement protocols such as S/MIME and PGP to validate user identity and ensure that the sender is indeed who they claim to be. S/MIME and PGP offer multipurpose mecha...
AI summary The text outlines the implementation of protocols like S/MIME and PGP to validate user identity and ensure email content confidentiality. It also emphasizes the importance of server identity validation using SPF, DKIM, and DMARC to enhance email security and prevent spoofing.
3.1.3 Secure the email gateway Email security gateways serve as inspection points to scrutinize and filter out malware, spam, and phishing attempts. These gateways are essential email security tools and can be deployed in various forms, su...
AI summary Email security gateways are critical tools for filtering malware, spam, and phishing attempts. They can be deployed as hardware, virtual instances, or cloud-based services and act as protective barriers between internal and external email environments. Organizations should consider third-party vendors and evaluate deployment models such as hybrid or full-cloud approaches.
3.1.4 Create an email security policy An email security policy serves as a comprehensive guide for managing email communications within your organization. It covers protocols for email usage, data storage, device access, and handling email...
AI summary An email security policy outlines protocols for managing email communications, protecting sensitive information, and promoting cybersecurity awareness within an organization. It serves as a strategic framework to secure data and communication channels, building resilience against cyber threats.
3.1.5 Monitor email activities Organizations should implement monitoring tools to track email activity and detect unusual patterns or suspicious behavior. Regular monitoring is essential in maintaining the security of email systems, as it...
AI summary Organizations are advised to monitor email activities using tools like SIEM systems and by reviewing DMARC reports to detect unusual patterns and potential security breaches. This helps in identifying and responding to threats promptly.
3.1.6 Conduct regular email security audits and testing Regular email security audits are essential for evaluating and addressing vulnerabilities in email security solutions and for maintaining resilience to cyber threats. This involves pe...
AI summary Regular email security audits are essential for evaluating and addressing vulnerabilities in email security solutions and for maintaining resilience to cyber threats. This involves periodic reviews to identify weaknesses and implement necessary improvements and updates to enhance overall email security measures.
3.2 Email infrastructure security recommendations The following sections provide guidance on security recommendations for your email infrastructure.
AI summary This section introduces email infrastructure security recommendations, providing guidance on securing email systems against threats such as Business Email Compromise (BEC) and other cyber threats.
3.2.1 Email servers Ensure email servers are configured according to security best practices, including disabling unnecessary services, using strong encryption for communication channels, and regularly applying security patches. You should...
AI summary The document outlines best practices for configuring email servers, emphasizing security measures such as disabling unnecessary services, using strong encryption, applying security patches, implementing access controls, and using multi-factor authentication for administrative access.
3.2.2 Database/storage security Encrypt sensitive data at rest using strong encryption algorithms to protect it from unauthorized access. Apply strict access controls to the email database/storage, limiting access to authorized personnel o...
AI summary The text outlines measures for securing database and storage systems, including encryption of sensitive data at rest, strict access controls, regular backup procedures, and periodic testing of backup restoration processes.
3.2.3 Physical controls Secure physical access to servers hosting email infrastructure. Use access control mechanisms such as biometric scanners, security badges, and surveillance systems. Maintain optimal environmental conditions (for exa...
AI summary This section discusses the importance of securing physical access to servers that host email infrastructure, including the use of access control mechanisms and maintaining optimal environmental conditions for server reliability.
3.2.4 Cloud environment considerations When considering a cloud environment for your email services, it is essential to prioritize security measures to protect sensitive information effectively. Start by verifying that your chosen cloud-ba...
AI summary When considering a cloud environment for email services, it is crucial to ensure the provider follows industry-standard security practices, encrypts data both in transit and at rest, enforces least-privilege access, implements MFA for administrative accounts, and regularly audits the environment for compliance and security.
3.3 Additional cyber security best practices to enhance email protection While email security measures are vital, strengthening your organization's cyber security requires a comprehensive approach that extends beyond email-specific strateg...
AI summary This section discusses additional cyber security best practices to enhance email protection, emphasizing the need for a comprehensive approach beyond email-specific strategies to improve overall security posture and protect digital assets.
3.3.5 Connect to reliable Wi-Fi networks Whenever possible, you should refrain from using public Wi-Fi for email communication. These networks are enticing targets for hackers, who may try to access or steal sensitive information when you...
AI summary This section advises users to avoid public Wi-Fi for email communication due to security risks. If public Wi-Fi is necessary, it recommends selecting networks with strong encryption like WPA3 and using a trusted VPN to protect sensitive data.
3.3.6 Create an incident response plan Organizations should develop and regularly update an incident response plan that includes responding to email security incidents. This plan should outline the specific actions to be taken in the event...
AI summary Organizations are advised to develop and maintain an incident response plan to address email security incidents. The plan should include isolating affected systems, identifying and mitigating vulnerabilities, and notifying relevant stakeholders. A publication is referenced for guidance on creating such a plan.
3.4.1 Detonation and email sandboxing In the context of email security, detonation involves executing potentially harmful email attachments or links within a controlled environment to analyze their behavior and determine if they pose a thr...
AI summary Detonation, or email sandboxing, is a security practice where potentially harmful email attachments or links are executed in a controlled environment to analyze their behavior and assess threats without endangering the organization's systems.
3.4.2 Content control Content control in email security services involves the use of advanced technologies like AI and machine learning (ML) to analyze email content for unsafe patterns. These services can identify and block various types...
AI summary Content control in email security uses AI and ML to detect and block harmful content, including malware in images and attachments. Spam and phishing filters are also employed to prevent malicious emails from reaching users. Traditional methods such as allowing only safe file types and disabling macros are recommended for additional security.
3.4.3 Authentication systems Authentication systems are essential for defending against spoofed emails, ensuring the legitimacy of senders, and mitigating various cyber threats. Anti-spoofing tools use email authentication protocols to pre...
AI summary Authentication systems are critical for defending against spoofed emails and cyber threats. They use protocols like SPF, DKIM, and DMARC to verify sender legitimacy and reduce the risk of impersonation attacks.
3.4.4 Email encryption Email encryption is a security measure that uses encryption techniques to effectively mitigate the risk of email interception. Encrypted emails, which can only be read by authorized senders and recipients, play a piv...
AI summary Email encryption is a critical security measure that prevents unauthorized access to sensitive information by ensuring emails can only be read by authorized senders and recipients. Solutions include push and pull encryption methods, which secure email transmission and retrieval through encrypted files and designated portals.
3.4.6 Continuous monitoring There are email security services that continuously monitor and gather threat intelligence to help defend against emerging threats and vulnerabilities. These services actively monitor the email landscape, watch...
AI summary The text discusses the importance of continuous monitoring through email security services that gather threat intelligence to defend against emerging cyber threats and vulnerabilities. These services adapt to evolving risks and provide timely protection.
4 Summary It is important for your organization to safeguard emails containing sensitive data, including financial records, proprietary information, and customer and employee details. One key way of doing this is to implement comprehensive...
AI summary The document emphasizes the importance of implementing comprehensive email security practices to protect sensitive data. It highlights key protocols such as TLS, S/MIME, SPF, DKIM, and DMARC, which help secure email communication by addressing encryption, authentication, and protection against phishing and spoofing. These practices enhance data privacy, security posture, and resilience against cyber threats.