[oagitm] Re: Quick Poll - Personal Email Access?

From: Dennis TOMLIN <dennis.tomlin@xxxxxxxxx>
To: Part Hartley <Pat.Hartley@xxxxxxxxxxxxxxxxx>
Date: Thu, 22 Feb 2018 14:38:44 -0800

All,

1.  Yes we do allow users to access personal email from county owned
devices. This is largely controlled through policy:

"Information technology and electronic communications will be used only for
county business, except as otherwise provided in these rules. No one will
grant access to systems without county management authorization."

"Personal use must be brief and infrequent in terms of time used as
compared to use for assigned work and may only be done during breaks and
non-work hours. Accessing personal emails through internet providers such
as AOL, Yahoo or Google, must be done in such a way as to ensure county
systems are not compromised by viruses or other threats. Employees should
not open emails using the county systems unless the sender is known to
them. "

In addition use of county assets "must always be on the employee’s own
time, at virtually no cost to the county, and be brief and infrequent."

"Personal use of county-owned mobile devices, consistent with these rules,
is considered an incidental benefit under MCPR xxxx"

a.  N/A

b.  One of the threats that exist is that of malware being introduced
through a users personal email.  We have implemented technical controls in
front of our county incoming email gateway and as a result we have seen a
"malware through county email" reduction from 37% of all malware incidents
coming through county email to 8% (National Avg is 31%).

However we of course do not have technical controls on personal email
(other than anti-virus/anti-malware at the desktop). "Malware through
personal email" is pretty low at around 1% of all security incidents.

Security Awareness Training and managed phishing exercises have helped us
reduce the number of "clickers" in the organization.  In addition we have
several outbound email rules (DLP data loss prevention)  that alert us when
users forward emails with certain content "outside of our domain", to their
personal email accounts for example.

This is a tricky topic because outside of policy there is really no good
way to prevent or minimize users from accessing personal email from their
issued devices.

I hope that helps.

Best,

Dennis

Dennis Tomlin, CISSP, HCISPP, ITIL
Chief Information Security Officer • Multnomah County, Oregon • 503.988.9487

On Thu, Feb 22, 2018 at 8:01 AM, Hartley, Pat <Pat.Hartley@xxxxxxxxxxxxxxxxx

wrote:

Click With Caution -
[image: Click With Caution]

Howdy folks!

Gresham has a long tradition of allowing access to personal email (like
Gmail) via web browser from City owned computers.

I have been working up a plan to shift that practice and mitigate the
risks it represents and I was hoping that you guys could help me out  by
answering the following two questions for me.  I am happy to compile the
results and present them back to the group when we are done if you would
like.

   1. Does your organization allow staff to access personal email from
   city owned devices?
      1. If not, do you provide alternatives for them? Could you explain?
      2. If you do allow access, are there checks in-place to mitigate
      any perceived threats?  Could you explain?

Thanks so much for your time and input!

~Pat

*Pat Hartley, IT Director *| City of Gresham
Skype  |  Pat.Hartley@xxxxxxxxxxxxxxxxx | 503.618.2520 <(503)%20618-2520>
1333 N.W. Eastman Parkway
<https://maps.google.com/?q=1333+N.W.+Eastman+Parkway%C2%A0%7C%C2%A0Gresham,+OR+%C2%A097030&entry=gmail&source=g>
|
<https://maps.google.com/?q=1333+N.W.+Eastman+Parkway%C2%A0%7C%C2%A0Gresham,+OR+%C2%A097030&entry=gmail&source=g>
Gresham, OR
<https://maps.google.com/?q=1333+N.W.+Eastman+Parkway%C2%A0%7C%C2%A0Gresham,+OR+%C2%A097030&entry=gmail&source=g>
97030
<https://maps.google.com/?q=1333+N.W.+Eastman+Parkway%C2%A0%7C%C2%A0Gresham,+OR+%C2%A097030&entry=gmail&source=g>
-3813

[image: banner2small] <http://greshamoregon.gov/>

References:
- [oagitm] Quick Poll - Personal Email Access?
  - From: Hartley, Pat

[oagitm] Re: Quick Poll - Personal Email Access?

Other related posts: