Product review: Titus Labs helps stop e-mail slips
Titus Labs Message Classification proves an easy and flexible way to enforce data sensitivity labeling in OutlookFollow @rogeragrimes
Once the settings are configured, when users create an Outlook e-mail, they can add a data classification level label (see Figure 2) to the outgoing message. The default labels are Unclassified, Confidential, and Secret, but any number of labels can be added or deleted, so long as they are ranked from less restrictive to more restrictive (for other features to apply correctly). A second level of labels can be defined so that any level 1 label can be further defined (Unclassified – Internal use only, Unclassified – External use allowed, and so forth). Labels can be added to the e-mail subject line (before or after the regular subject text) and/or added to the message’s e-mail header and message body.
Classified company messages
Message classification is configurable as an optional setting or enforced. If labeling is required and the user attempts to send an e-mail without selecting a label, a default label can be applied automatically without any user intervention or the user can be warned or prevented from sending the e-mail until after they have selected a label (see Figure 3). When a user forwards a labeled message and attempts to reclassify it, a warning can be displayed or the message can be prevented from being sent. Labels can also be signed and verified so that subsequent modification results in a denial message. If Titus Labs’ Document Classification product is used, Microsoft Office attachments can have their own data classification labels, which interact with the message data classification features in expected ways.
Forcing users to classify each e-mail can help in providing data sensitivity awareness, but Message Classification can also be used to prevent inadvertent sending to unauthorized parties, enable encryption, or provide policy-defined archival. At a very basic level, the classification label text can be interrogated by an Outlook rule, which then controls where and from whom the message can be sent. For example, a message labeled Confidential can be restricted to internal readership only and automatically enable S/MIME protections. Similarly, the data classification labels can be acted upon using e-mail server-side programming (such as Microsoft Exchange event sinks or rules), but Message Classification can also interact with more sophisticated protection products such as Microsoft’s Rights Management Service (RMS).
Better security, less coding
RMS (available with Windows Server 2003 or 2008) allows e-mails, documents, and other protected content to be restricted to particular users or groups, and each user can be allowed full access, or forbidden to forward, print, or save. Message Classification allows each data classification level to trigger a particular RMS template (which contains predefined rights for particular users and groups). RMS must be purchased and installed separately, and the involved RMS templates must be distributed to each participating client (as is required even without Message Classification installed). In my testing, Message Classification interacted with RMS perfectly. You can accomplish the same results in RMS without the Message Classification product, but it requires a lot more custom coding. Together, the two are a strong combination, and I’m surprised Microsoft hasn’t tried to purchase Titus Labs products and add them to its default RMS offering.