ASD-Cyber-Security-Bulletin-2014-06

Watch that Webmail
Web-based email, or webmail, is a convenient
way to communicate from anywhere, at any time.
Webmail is email that is accessed through a web
browser – such as Windows Live Mail, Gmail, Yahoo
or email provided by Internet Service Providers.
However, government agencies using webmail for
business purposes should be aware of the security
risks of this approach.
Government agencies have their own security
measures for handling email and other sensitive
communications. Employees using a webmail
account for sensitive business information
will not have these same protections for their
communications. This increases the risk of
unauthorised disclosure – and in some cases, this
may even breach legislative requirements.
It is also important to note that agencies may
not have full control over your data when using a
webmail service. Service providers are subject to
the laws and regulations of the country where they
are based. This may involve a number of countries,
depending on where the data is stored and
processed and where it transits.
Foreign governments may have the right to lawfully
access the data held by the webmail service without
user knowledge. It may also be difficult to sanitise
or clean up data spills in the case of a data leak.
ASD has seen malicious emails that have been
sent to government agencies also forwarded onto
users’ personal webmail accounts, which can lead
to the compromise of the device used to access
the webmail – such as a personal mobile phone
or tablet. In some cases, the device may already
be compromised (for example, if you are using a
public terminal or a device running outdated and
vulnerable software.)
If you and your colleagues become accustomed
to seeing webmail used for business, there is the
danger that it will be more difficult to detect the
commonly used intrusion technique of ‘spoofing’.
This is where a webmail account is set up to appear
as if it is a legitimate user, to trick the receiver
into opening the email and clicking on a malicious
link or attachment.
If your agency does allow webmail use, it is recommended that you:
• use your agency’s email service rather than webmail when accessing email from your
work network
• maintain separate accounts for work and personal purposes
• send only publicly available, unclassified government information over webmail –
never send sensitive or classified information
• ensure that your webmail software is up to date with
anti-virus installed
• use a strong and unique password or multi-factor
authentication to enhance the security of your account.
More information is available at the ASD website in the Protect
publication Implications of Using Webmail for Government Business.
Issue #13 – June 2014 Page 4