NIST guides target e-mail, patches

Draft Special Publication 800-45: Guidelines on Electronic Mail Security

The National Institute of Standards and Technology released new draft guidance April 3 for dealing with two of the most common sources of security breaches: poorly configured e-mail servers and the failure to apply software patches.

The two draft guides are part of a series of guidance developed by NIST's Computer Security Division and are available through its Computer Security Resource Center Web site (csrc.nist.gov). NIST serves as the primary technical security resource for civilian agencies under the Computer Security Act of 1987.

Other than Web servers, most viruses, worms and other malicious code are written for e-mail applications. Beyond disrupting e-mail service, attackers often will use e-mail to obtain or change sensitive information and even to gain access to the rest of an organization's network, according to the guide.

NIST's e-mail guide is very technical and is intended for systems administrators who are responsible for installing, configuring and maintaining e-mail servers and clients. It includes general information on securing any e-mail application, but it also provides specifics for securing the most popular e-mail applications — Microsoft Corp.'s Exchange Server and Linux and Unix sendmail.

Comments on the e-mail guide are due to Wayne Jansen (jansen@nist.gov) by April 30.

NIST's draft guide on patches is intended for both managers and systems administrators.

The guide addresses the low implementation rate of commercial software patches, which experts attribute to the success of most security attacks. Cyberattackers take advantage of known vulnerabilities, gaining access because systems administrators have not applied free patches that are available from multiple sources

Several efforts are under way in government to help agencies apply the patches they need, including a new program available through the General Services Administration's Federal Computer Incident Response Center. But the basic problem cited by public- and private-sector experts is the lack of any standard process for applying the patches and the lack of oversight from managers to enforce the application.

The NIST guide outlines a "systematic, accountable and documented process for handling security patches and vulnerabilities," according to NIST. IT also offers specific advice on regularly identifying vulnerabilities and obtaining patches; testing the effectiveness of the patches; and installing the patches on all necessary systems.

Comments on this guide are due back to Peter Mell (peter.mell@nist.gov) by May 2.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.