+APP.5.3 General E-Mail Clients and Servers
---+APP.5.3.G1. Insufficient Planning of E-Mail Use
---+APP.5.3.G2. Incorrect Configuration of E-Mail Clients and Servers
---+APP.5.3.G3. E-mail Unreliability
---+APP.5.3.G4. Malware in E-Mails
---+APP.5.3.G5. Social engineering
---+APP.5.3.G6. Reading and Manipulating E-Mails
---+APP.5.3.A1 Secure Configuration of E-Mail Clients (B)
---+APP.5.3.A2 Secure Operation of E-Mail Servers (B)
---+APP.5.3.A3 Data Backup and Archiving of E-Mails (B)
---+APP.5.3.A4 Spam and Virus Protection on E-Mail Servers (B)
---+APP.5.3.A5 Establishing Deputising Rules for E-Mail Use [Supervisor] (S)
---+APP.5.3.A6 Defining a Security Policy for E-Mail (S)
---+APP.5.3.A7 User Training on the Security Mechanisms of E-Mail Clients (S)
---+APP.5.3.A8 Training Users to Deal with Spam [User] (S)
---+APP.5.3.A9 Extended Security Safeguards on E-Mail Servers (S)
---+APP.5.3.A10 End-to-End Encryption (H)
---+APP.5.3.A11 Deployment of Redundant E-Mail Servers (H)
---+APP.5.3.A12 Monitoring Public Blacklists (H)
---+APP.5.3.A13 TLS Reporting (H)

APP.5.3 General E-Mail Clients and Servers

Introduction

E-mail is one of the oldest and commonly used Internet applications. E-mails are used to send text and attached files to other people. Users require an e-mail address for this purpose.

E-mail applications require e-mail servers that can send and receive electronic messages. As a rule, e-mail clients retrieve messages intended for them from an e-mail server using the POP3 or IMAP protocols and send messages to the e-mail server using the SMTP protocol, which forwards them to another e-mail server if necessary.

Since e-mail is widely used, especially at companies and public authorities, e-mail servers are often targeted by attackers.

E-mail clients are often also a focus of attack: sending malware via e-mail is a common strategy. In addition, e-mails are often used as a tool for social engineering attacks.

For these reasons, the secure operation and use of e-mail applications is of particular importance.

Objective

The objective of this module is to protect information that is processed with e-mail clients or on e-mail servers.

Scoping and Modelling

Module APP.5.3 General E-Mail Clients and Servers must be applied to each e-mail client and server in the information domain under consideration.

The module includes requirements for general e-mail servers and clients. Requirements for server platforms, operating systems, and clients are not covered. These can be found in the modules SYS.1.1 General Server and SYS.2.1 General Client, as well as in the respective operating-system-specific modules.

Within the context of an information domain, module APP.5.3 General E-Mail Clients and Servers is mostly used in combination with another specific module of layer APP.5 E-Mail/Groupware/Communication. These must also be implemented separately. Among others, these modules include APP.5.2 Microsoft Exchange and Outlook.

Requirements for logging and backup are included in the modules OPS.1.1.5 Logging and CON.3 Backup Concept.

Groupware functions that offer features such as the administration of contact details and calendars in addition to e-mail are not covered in this module. Pure cloud solutions such as those that are part of Microsoft 365 or Google's G Suite are also not included. General requirements for this are included in module OPS.2.2 Cloud Usage.

Useful Resources

In the ISO/IEC 27001:2013 standard, the International Organization for Standardization (ISO) specifies requirements for the operation of e-mail services in section 13.2.3.

Section CF2.3.3 of “The Standard of Good Practice for Information Security” published by the Information Security Forum (ISF) provides guidelines for operating e-mail services.

In its “Guidelines on Electronic Mail Security”, the National Institute of Standards and Technology (NIST) describes how e-mail applications can be run securely.

In “BSI TR-03108 Secure E-Mail Transport”, the Federal Office for Information Security (BSI) provides information on sending e-mails securely.

1. Panoramica

APP.5.3.A1 Secure Configuration of E-Mail Clients (B)

An organisation MUST specify a secure configuration for its e-mail clients. The e-mail clients MUST be pre-configured when they are handed over to the users.

The organisation MUST ensure that the security-relevant aspects of the configuration cannot be changed by users. If this is not possible, the organisation MUST inform the users that they are not permitted to change the configuration on their own.

Before file attachments from e-mails are opened, they MUST be checked for malware by a protection program on the client, if this is not already done on the e-mail server. E-mail clients MUST be configured in such a way that they do not automatically interpret any HTML code or other active content in e-mails. Preview functions for file attachments MUST be configured so that they do not automatically interpret files. E-mail filtering rules and uncontrolled automatic forwarding of e-mails MUST be limited to necessary application scenarios.

E-mail clients MUST use secure transport encryption for communications with e-mail servers across untrusted networks.
APP.5.3.A2 Secure Operation of E-Mail Servers (B)

The IT Operation Department MUST implement protection mechanisms against denial-of-service (DoS) attacks. E-mail servers MUST offer secure transport encryption for receiving e-mails and accessing e-mail clients via public data networks. If e-mail servers send e-mails on their own, they SHOULD also use secure transport encryption for this purpose.

An organisation MUST specify all the e-mail protocols and services it permits. In addition, the IT Operation Department MUST configure e-mail servers so that they cannot be misused as spam relays.

If messages are stored on an e-mail server, the IT Operation Department MUST configure and document an appropriate size limit for the server-side mailbox.
APP.5.3.A3 Data Backup and Archiving of E-Mails (B)

The IT Operation Department MUST back up its e-mail servers regularly. To this end, the corresponding organisation MUST regulate how the sent and received e-mails of e-mail clients and the e-mails on the servers are backed up. With regard to archiving, the organisation SHOULD also consider that e-mails may only be stored locally on clients.
APP.5.3.A4 Spam and Virus Protection on E-Mail Servers (B)

The IT Operation Department MUST ensure that incoming and outgoing e-mails on e-mail servers, and particularly their attachments, are checked for spam characteristics and harmful content. The introduction and use of e-mail filtering programs MUST be coordinated with the Data Protection Officer, Employee Representatives, and Users.

The organisation MUST specify how encrypted e-mails are to be dealt with if they cannot be decrypted by the virus protection program in use.
APP.5.3.A5 Establishing Deputising Rules for E-Mail Use [Supervisor] (S)

An organisation should establish deputising rules for the handling of e-mails. If e-mails are forwarded, the deputising users SHOULD at least be informed. Data protection aspects MUST be taken into account when forwarding e-mails. An organisation SHOULD establish regulations for autoreply functions in e-mail programs that describe how these functions can be used securely. When employees use the autoreply functions, no internal information SHOULD be forwarded.
APP.5.3.A6 Defining a Security Policy for E-Mail (S)

An organisation SHOULD establish and regularly update a security policy for the use of e-mail. The organisation SHOULD inform all users and administrators of new or changed security requirements for e-mail applications. The organisation's e-mail security policy SHOULD comply with its generally applicable security policies. The organisation SHOULD check that the security policy is being applied correctly.

The e-mail security policy for users SHOULD specify the following:

  • how these communications can be secured
  • what user access rights exist
  • how e-mails are checked for forged senders
  • how to secure transmitted information
  • how to check the integrity of e-mails
  • which open e-mail distribution lists may be used
  • whether private e-mail use is permitted
  • how to deal with e-mails and mailboxes of employees who leave the company
  • whether and how webmail services may be used
  • who is responsible for group mailboxes
  • how file attachments should be handled
  • how e-mails in HTML format should be handled by users

The e-mail security policy SHOULD also include the configuration options of the e-mail applications for administrators, as well as the specifications for possible access to an e-mail server from other servers. Information on authorised points from which an e-mail server may be accessed SHOULD also be included in the policy.

The e-mail security policy SHOULD regulate the handling of newsgroups and mailing lists.
APP.5.3.A7 User Training on the Security Mechanisms of E-Mail Clients (S)

An organisation SHOULD educate users on the risks of using e-mail applications and how to use e-mail safely. This SHOULD take place in addition to general training and awareness raising.

The organisation SHOULD make users aware of the possible dangers of opening e-mail attachments. Training SHOULD also address how users can recognise e-mails from fake senders.

The organisation SHOULD warn users not to participate in e-mail chain letters or subscribe to a large number of mailing lists.
APP.5.3.A8 Training Users to Deal with Spam [User] (S)

As a matter of principle, all users SHOULD ignore and delete all spam e-mails. Users SHOULD NOT answer unsolicited e-mails. They SHOULD NOT click links in these e-mails. If an organisation has a central spam management solution, users SHOULD forward spam e-mails to it and then delete them.
APP.5.3.A9 Extended Security Safeguards on E-Mail Servers (S)

An organisation's e-mail servers SHOULD check incoming e-mails using the Sender Policy Framework (SPF) and DomainKeys. The organisation SHOULD use DomainKeys and the SPF to authenticate e-mails it sends.

If SPF is used, it SHOULD be clearly specified how e-mails are to be handled. The softfail parameter ("~") SHOULD only be used for testing purposes.

The organisation SHOULD use Domain-based Message Authentication, Reporting and Conformance (DMARC) to specify how the e-mails it sends should be verified by the receiving e-mail server. DMARC reports SHOULD be evaluated regularly. The organisation SHOULD determine whether DMARC reports on received e-mails are sent to other organisations.

The organisation SHOULD secure its e-mail communications via DANE and MTA-STS.
APP.5.3.A10 End-to-End Encryption (H)

An organisation SHOULD use end-to-end encryption and signatures for e-mails. Only protocols that comply with the current state of the art SHOULD be used for encryption and signatures.
APP.5.3.A11 Deployment of Redundant E-Mail Servers (H)

An organisation SHOULD operate several redundant e-mail servers. The redundant e-mail servers SHOULD be stored with appropriate priority in the DNS information of the domains concerned. The organisation SHOULD determine how e-mails are to be synchronised among its e-mail servers.
APP.5.3.A12 Monitoring Public Blacklists (H)

The IT Operation Department SHOULD regularly check if its organisation's e-mail servers are listed on public spam or blacklists.
APP.5.3.A13 TLS Reporting (H)

An organisation SHOULD use TLS reporting. It SHOULD be determined whether TLS reports are to be sent to other organisations.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
includes APP.5.3.G1. Insufficient Planning of E-Mail Use
includes APP.5.3.G2. Incorrect Configuration of E-Mail Clients and Servers
includes APP.5.3.G3. E-mail Unreliability
includes APP.5.3.G4. Malware in E-Mails
includes APP.5.3.G5. Social engineering
includes APP.5.3.G6. Reading and Manipulating E-Mails