Tukukkk

I suppose the FBI receives email with attachments, like any other government agency: documents, resumes/CVs, etc. I also suppose they are very careful not to get infected, more than the average user, for obvious reasons. If I were to send an email to the FBI, attaching maybe a PDF with my resume/CV, how are they going to open it?

So I wonder if US government agencies are known to use particular procedures or follow particular standards for dealing with emails safely. I also suppose what I'm asking is not secret information, given the large number of people involved (all the people who work in or for the government are expected to deal with emails safely).

While I cannot speak for every government agency everywhere, in highly secure environments, what I have seen [unable to disclose] is:

• sandbox email attachments


• no attachments but authorised, attributable file upload tools

In each instance, the attachment is inspected and run in an isolated sandbox. The recipient only interacts with the file through this abstraction.

Oftentimes, the content is extracted as text and reconstructed in a structured way, wherever that is possible.

Segmentation is the key technique here.

You never with with sensitive data and external data at the same time, depending on the sensitivity, you may use a different device that may be air gapped from the external world, but often just different virtual machines or SELinux context (hint: SELinux was developed by NSA). Even further employees that handle data from the public are different from employees that handle sensitive data, employees that handles hiring doesn't really need to have access to investigation data, for example.

There is usually a procedure to transfer data between sensitive zones, with check and controls about what kind of data can be transferred under what conditions. This is often enforced through some form of MAC (mandatory access control).

Emails are often segmented as well. The mail server may automatically strip attachments from emails by people outside the agency's trusted environment, and they may be automatically tagged for work in untrusted context.

But most importantly though, security is mainly about human. Regular security drills, practice on detecting phishing, and documented procedures, all works to prevent attacks. Many security vulnerabilities depends on human factors. Software and tools can help prevent errors and make enforcement easier, but ultimately user training is the most important way to protect any system.