Security of Email Accounts
IN a letter to Chairperson (CBEC), the Director General, Computer Emergency Response Team India (CERT-In), has emphasised the need for maintaining email account security in respect of official correspondence. The following points are to be noted:-
1. The password of the mail account should be more than 8 characters having a combination of alphanumeric and special character.
2. The password should be updated regularly (at least once a month)
3. The user owning the mail account should not share the password with anyone
4. The contact details of the officer should be up-to-date with the System/Mail Administrator so as to receive regular updates and alerts.
5. The user should keep track of his/her mail account access through ‘last login' facility.
6. Caution should be exercised in opening the email messages especially keeping in mind phishing, malware infected and targeted attack emails.
7. The users should be sensitized regularly about latest security threats and targeted attacks.
8. The computer system/desktop/laptop used to access official email account should be secure, i.e., authorised OS (operating system), Anti-virus and Firewall should installed and updated regularly
9. The official (as well as personal) email account should never be accessed from the computer systems having weak security or public systems like Cyber Café since these are easy targets for hackers with malicious intent.
10. Recent revelations have brought to light the fact that mail service providers based outside India - like Gmail, Yahoo, Microsoft, etc. are sharing data with surveillance agencies. Hence the use of Gmail, Yahoo etc for official communication may result in sensitive and confidential information being made available to foreign agencies. Therefore official communication (especially carrying information of national interest) should be made using only Email accounts of icegate.gov.in or nic.in domains .
DDT had taken up this issue on several occasions. 06.08.2010 asked, "Why are the government officers using private email ids and not the government ones?"
DDT 1428 20.08.2010 asked, "Can Government Officials use Private Email ids for Official Correspondence?"
A senior Revenue officer was furious with us and asked us as to why he should use a private site like TIOL.