Csdrhrt

I suppose the FBI receives email with attachments, like any other government agency: documents, resumes/CVs, etc. I also suppose they are very careful not to get infected, more than the average user, for obvious reasons. If I were to send an email to the FBI, attaching maybe a PDF with my resume/CV, how are they going to open it?

So I wonder if US government agencies are known to use particular procedures or follow particular standards for dealing with emails safely. I also suppose what I'm asking is not secret information, given the large number of people involved (all the people who work in or for the government are expected to deal with emails safely).

While I cannot speak for every government agency everywhere, in highly secure environments, what I have seen [unable to disclose] is:

• sandbox email attachments


• no attachments but authorised, attributable file upload tools

In each instance, the attachment is inspected and run in an isolated sandbox. The recipient only interacts with the file through this abstraction.

Oftentimes, the content is extracted as text and reconstructed in a structured way, wherever that is possible.

Segmentation is the key technique here.

You never work with sensitive data and external data at the same time. Depending on the sensitivity, you may use a different device that may be air gapped from the external world, but often just a device with mandatory VPN, or a different virtual machines, or SELinux context (hint: SELinux was developed by NSA). Even further employees that handle data from the public are different from employees that handle sensitive data, employees that handles hiring doesn't really need to have access to investigation data, for example and vice versa.

There is usually a procedure to transfer data between sensitive zones, with check and controls about what kind of data can be transferred under what conditions. This is often enforced through some form of MAC (mandatory access control).

Emails are often segmented as well. The mail server may automatically strip attachments from emails by people outside the agency's trusted environment, and they may be automatically tagged for work in untrusted context. You may have internal mailbox that's separate from public mailbox. There are often a form of content filtering in email server and/or client, through antivirus check and/or some form of document classification and protection system.

But most importantly though, security is mainly about human. Regular security drills, practice on detecting phishing, documented procedures, and classifying documents, all works to prevent attacks. Many security vulnerabilities depends on human factors. Software and tools can help prevent errors and make enforcement easier, but ultimately user training is the most important way to protect any system.

I wasn't able to find a publicly available document of email security practices for US government agency, but here's one for Australia. In particular, you may be interested in Page 182 Email Security and Page 190 Email Content Filtering. Other sections that may be of interest is Page 282 Data Transfer and Content Filtering.