5 ways to keep email hacking from damaging your public life
Connecting state and local government leaders
With the midterm elections just around the corner, candidates and government officials must take extra care to ensure their communications are secure.
With midterm elections looming, the personal email accounts of politicians and their staffers are becoming hackers’ prime targets. According to a September report in the Washington Post, Sen. Ron Wyden (D-Ore.) maintained that Senate and staff emails were under attack, but because these hacking attempts did not involve official devices or accounts, they were beyond the scope and authority of the Hill’s cybersecurity experts.
It’s incumbent on email users at every level of the government-- local, state and federal -- to have a better understanding of how to protect themselves from the prying eyes of bad actors. Without that understanding, current and prospective government figures will find themselves susceptible to a repeat of the hacking episodes of 2016, where stolen email data made its way into the public domain, causing irreparable damage to the public trust.
What follows are five simple steps to reduce the risk of email hacking.
1. Know email’s inherent vulnerabilities. Because it is typically sent in plain text, email that is not thoroughly encrypted can be read by anybody, including hackers. Think of it as a modern-day postcard, where anyone can see what’s written. To fix this digital postcard’s vulnerabilities, users must encrypt everything -- all emails, metadata, subject lines, files and every other element related to the email -- to ensure private communications.
2. Use unique encryption credentials for everything. Encryption credentials for every data packet sent minimizes potential attack surfaces to a single message, which should be reassuring for those in the public eye, whose correspondence is relatively easy to identify and isolate for hacking or phishing. Unique credentials ensure that brute-force attacks against a targeted individual will only compromise a single message, compelling hackers to decrypt the entire thread to get whatever they may be after.
Hackers may track emails for months -- identifying patterns and flows, times of day, recipients and senders -- to understand how email is used. Over time, this knowledge could lead to phishing efforts specifically tailored to key individuals. Content within emails, such as names of children or pets or other personal information, may give hackers clues about possible passwords.
3. Maintain an audit trail. An unfortunate consequence of email hacking is that public figures do end up in court, challenging each other over what they said, to whom, when, and over which communication channel.
For that reason alone, politicians, candidates and support staff need records of all communications. They must have read receipts for each exchange to provide evidence that an email was received and read and to remove the possibility of denial.
4. Understand the boundaries of security. Many people wrongly believe that moving to the cloud eliminates security problems. In fact, cloud service providers don’t necessarily have control over what is being used beyond the firewall, by either the recipient or the sender.
Within an organization, it is easy to encrypt email content. The keys for encryption and decryption are maintained within the firewall. At the boundary of the firewall, however, messages may be decrypted and sent as plain text. By failing to understand what is happening in the encryption process, mistakes can happen -- especially if users put their trust exclusively in the hands of a cloud vendor.
5. Beware of passwords. Most technologies to protect data in transit use passwords, but passwords themselves are hackers' most frequent targets.
Ideally, we would all have a “one time, forever password” with which I could send something to you, tell you the password so you could decrypt the first message, and thereafter everything we sent to each other would be encrypted.
In the real world, however, we need multifactor authentication -- a combination of a password and other factors to strengthen the security perimeter. Without that, the best security in the world is easily defeated.
Government officials can be uninformed about the risks they face when using email. But if they learn how to protect their communications, they can mitigate security risks.
NEXT STORY: Illuminating the ‘dark web’