Introduction
LibraCyber ESG has multiple functionalities to ensure that your traffic is always transmitted securely: HTTPS (TLS), SMTPS (TLS), and end-to-end encryption. All these options come with the best defaults possible on installation, but reviewing the configuration is something very important to increase security.
×NOTE Steps 4 and 5 are only required if you plan on using end-to-end Mail Encryption, otherwise, the default are good enough.
×NOTE This guide is for LibraCyber ESG version 5.0 and above. Please do upgrade if you are still using previous versions.
Creating TLS certificate
The first step in improving security is to configure valid certificates using a well-known Certificate Authority (CA). LibraCyber ESG comes with a self-signed certificate, which is enough to send and receive encrypted data but remote senders cannot verify your identity since there is no external Authority for your certificate.
The main problem with self-signed certificates is that they are not trusted by the browser, so the user is presented a scary warning “Untrusted Certificate” and there is no (easy) way to make sure that someone isn’t trying to do spoofing.
To create a new certificate go to “Admin Area > Appliance > TLS Certificates”, then on the tab “Configure Certificates” create a new configuration.
- Let’s Encrypt: auto-renew free certificate (Recommended)
If you plan on publishing the web interface of the appliance also from outside the company, Let’s Encrypt is the way to go. Let’s Encrypt provides an easy to use certificates free of charge, auto-renewed, and with a properly trusted public Certification Authority. It’s just a one-click setup and you’re done!
NOTE Let’s Encrypt requires you to map both port 443 and port 80 for the chosen name to LibraCyber ESG from all IP sources (e.g. from any address to your.tls-name.test:80 and your.tls-name.test:443). This is not a security issue as LibraCyber ESG only use port 80 for Let’s Encrypt validation and user are forced to use HTTPS.
2. Certificate Request: new hostname certificate
If you prefer to buy a certificate from a Certificate Authority for the hostname assigned to LibraCyber ESG, then you have to create a Certificate Request from LibraCyber ESG.
On LibraCyber ESG create a new Certificate of type “CSR” and fill in all the information requested for the certificate.
From the newly created record, you can download the Certificate Request file (file extension is *.csr), and use this on the Certification Authority panel to create properly signed certificates.
Once you receive the certificates back from the CA, make sure you upload your certificate, all intermediate certificate files, and (optionally) the CA root certificate (these files extension is usually *.pem or *.crt).
If everything is done correctly and certificates are validated for the hostname, your record will now show “Installed: yes”.
×RENEWAL before the certificate expires, you have to download the Request Certificate again and use it to create a new certificate on your CA. It’s better to update the current certificate, instead of creating a new one.
3. Wildcard Certificate: if your company already owns it
Larger organizations often prefer to buy a single wildcard certificate to be used for all the hosts of your company. A wildcard certificate is similar to the normal certificate, but as the name suggests the common name is not restricted to a single value (e.g. *.your-domain.test may be used for mail1.your-domain.test and mail2.your-domain.test, but not for two.sub-level.your-domain.test).
When installing a wildcard certificate you must also install the private key that the CA provides you when buying the wildcard certificates.
On LibraCyber ESG create a new certificate and select type “Wildcard”, then make sure you upload your certificate private key, the wildcard certificate, all intermediate certificate files, and (optionally) the CA root certificate (these files extension is usually *.pem or *.crt).
If everything is done correctly and certificates are validated, your record will be created and will show “Installed: yes”.
Use installed certificates for public services
Now that valid certificates are installed on LibraCyber ESG, the can be assigned to LibraCyber ESG services.
Web access (HTTPS)
The web interface entry controls HTTPS service, that is the service used by web browsers. The certificate chosen should match the hostname you want your users to use while browsing; with that in mind, may be a good idea to review the configuration for “Report Link URL” from “Admin area > Appliance > Quarantine settings”.
Plain text connection over HTTP are disabled on LibraCyber ESG and there’s no override to it.
Mail Transport (SMTPS)
The mail transport agent controls the SMTPS service, which is the service used by mail servers to relay your email. The certificate chosen should match the hostname that is advertised by the SMTP banner, which defaults to the appliance hostname; with that in mind, it maybe a good idea to review the configuration for “My Hostname” from “Admin area > Mail Transport > Advanced Configuration”.
LibraCyber ESG is a mail gateway so it must accept both encrypted and plain text traffic as specified by RFC 2487. If you prevent the use of TLS for email you may bounce back messages to the sender, especially when you talk with small companies or outdated Mail Servers.
By default, LibraCyber ESG tries to use the highest protection available, but you may want to configure stricter requirements for your domains.
Set TLS policies for email flow
Incoming email
The responsibility of encrypting via TLS an inbound message via depends on the Mail Server sending it to LibraCyber ESG. If you have uploaded a TLS Certificate signed by Certification Authority then you should enforce all your servers sending to LibraCyber ESG to use an “encrypt+verify”
Review the list of all your trusted servers in “Admin Area > Mail Transport > Relay Configuration > Trusted Network” and the account list “System > Mail Transport > Relay Configuration > SMTP Auth”; for each of your trusted servers and make sure that strict TLS policies are configured.
External resources:
Outgoing email: TLS policies
Outgoing email traffic cannot be enforced to use TLS with a public Mail Server as specified by RFC 2487; if you do, you may see some message bounced back either because a receiver doesn’t support one (or all) of the standard encryption algorithms used by LibraCyber ESG.
It’s a good practice to enforce TLS for Mail Servers managed by LibraCyber ESG.
The default policy for outgoing connection (required)
Make sure that “Default policy for outgoing connection” is set to “may”. This will grant proper reception of emails from all sources.
Force Encryption for Trusted Senders (recommended)
For each of the trusted servers, it is pretty straightforward to set up the policy “encrypt”; this ensures that all the traffic is never sent in plain text and you will grant email privacy for internal communication.
Verify Domain and Encrypt (whenever possible)
For each server for which you know that the certificate is valid and signed by a public Certification Authority, you should add a “verify” policy. This means that before setting up the encrypted communication channel, the server is verified against public information (CA, DNS, SMTP banner).
End-to-End Mail Encryption
LibraCyber ESG end-to-end encryption begins transparently on the gateway and ensures your encrypted emails are only readable by the intended recipient.
You must review some of your settings to make sure that the communication between your servers and LibraCyber ESG is safe. If you follow common security guidelines or you have followed this guide up to this point, you already have everything up and running.
To recap the requirements, make sure that:
- a valid (non-self-signed) certificate is installed, and assigned to Web Interface and Mail Transport Agent;
- Outgoing e-mails are secured by TLS in LibraCyber ESG, possibly by forcing “encrypt/verify” policies for all your servers;
- Incoming e-mails are secured by TLS in all your Mail Server, possibly forcing the use of TLS.
Give the users a way to explicitly encrypt
No matter which automation you have in your company, training the user to encrypt sensible data is one of the best ways to prevent data loss.
Change the general settings of Mail Encryption, with something like the following:
It is suggested to keep “Sensitive” header detection enabled. Most of the users are comfortable with their Mail Clients (e.g. Outlook), by enabling this every message marked as confidential in a Mail Client is encrypted by LibraCyber ESG.
For any other users, who prefer to tag the message in the subject, choose one of the available keywords: “Encrypt”, “Secure” and “Confidential”. You may enable more keywords, but be aware this could incur in too many messages being encrypted, so having a few is preferred.
×Localization The encryption keyword in the subject is detected in many variants and for all supported languages (e.g. English, Italian) and in many variants (e.g. Encrypt, Encrypted, Encryption, …).
If you prefer simple tagging to encrypt a message, you may want to add a custom expression like “[encrypt] [cypher]”, and then you can prefix the subject with “[encrypt]”, or “[cypher]”.
Configure End-to-End policy for the sensible destination
You can encrypt all the messages for a single destination (or source), independently of confidentiality level or content analysis.
As an example, you may encrypt all the outgoing messages to your lawyer or the company business consultant.
Use dictionaries of reserved words to prevent data loss
Mail Encryption is integrated seamlessly into dictionaries' content detection, both for inbound and outbound messages. To safeguard secrets you may want to create a dictionary of sensible words to trigger encryption.
Step #1: New dictionary
First create a new Dictionary for top-secret words:
Step #2: Add sensible information
Then add sensible words or numbers to dictionaries. Good candidates are Credit Card Numbers, VAT Numbers, National Insurance Numbers, … You may want to add one word at a time or use text import for bulk inserts.
Step #3: Encryption trigger
Finally, create an encryption rule for your dictionary and apply settings to make it effective
HINT From now on whenever there is the need to track a new secret word or code, you can simply add an entry in your dictionary.