BIO 18.03.01 ISO A.8.24

Email Handling En Classification Design

📅 2025-10-30
•
⏱️ 7 minuten lezen
•
🔴 Must-Have

💼 Management Samenvatting

Email classification design zorgt voor consistent labeling, versleuteling, en DLP bescherming van emails gebaseerd op sensitivity, waardoor gegevenslekken via email wordt voorkomen.

Aanbeveling
IMPLEMENTEER EMAIL CLASSIFICATION
Risico zonder
High
Risk Score
8/10
Implementatie
32u (tech: 16u)
Van toepassing op:
✓ M365
✓ Exchange
✓ Outlook

Email is #1 data exfiltration vector. Classification design adressen: (1) Sensitivity labeling - Users label emails (Internal, Confidential, etc.), triggers automatische bescherming (versleuteling, no forward), (2) Auto-classification - ML detecteert sensitive content (credit cards, SSN, confidential patterns), past toe labels automatically, (3) DLP policies - Block/versleutel emails met regulated data to external recipients, (4) External recipient warnings - Users warned Wanneer sending to buiten organization. Design essentieel voor: AVG compliance (versleuteling voor sensitive PII), IP bescherming (confidential documents attached to emails), regulatory requirements (HIPAA, financial gegevensbescherming).

PowerShell Modules Vereist
Primary API: Exchange Online / Microsoft Graph
Connection: Connect-ExchangeOnline / Connect-MgGraph
Required Modules: ExchangeOnlineManagement, Microsoft.Graph

Implementatie

Email classification design: Sensitivity labels in Outlook (handmatige + auto), DLP policies voor email, External recipient warnings, versleuteling policies (S/MIME of OME), Transport rules voor policy enforcement. implementeren via Exchange Online + Microsoft Purview.

Vereisten

  1. M365 E3/E5 Licenties
  2. Sensitivity labels deployed (zie Azure RMS design)
  3. DLP policies geconfigureerd
  4. User training over email classification
  5. Exchange Online of hybrid Exchange

Implementatie

Gebruik PowerShell-script email-handling-classification.ps1 (functie Invoke-Remediation) – Email classification policies deployment.

  1. Implementeer sensitivity labels to Outlook
  2. Configureer DLP policies voor email workload
  3. Schakel in external recipient warnings
  4. Configureer OME (Office Message versleuteling) voor external versleuteld emails
  5. Transport rules voor policy enforcement

monitoring

Gebruik PowerShell-script email-handling-classification.ps1 (functie Invoke-Monitoring) – Controleren.

  1. DLP policy matches in email
  2. Label usage statistics
  3. External sharing events
  4. versleuteling usage rates

Compliance en Auditing

  1. BIO 18.03 - Cryptografie (email versleuteling)
  2. AVG Artikel 32 - versleuteling voor gevoelige data
  3. ISO 27001:2022 A.8.24 - Cryptography use
  4. ISO 27001:2022 A.5.33 - bescherming of records

Remediatie

Gebruik PowerShell-script email-handling-classification.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Email Handling & Classification Design .DESCRIPTION Implementation for Email Handling & Classification Design .NOTES Filename: email-handling-classification.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 Related JSON: content/design/compliance/email-handling-classification.json #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter()][switch]$WhatIf, [Parameter()][switch]$Monitoring, [Parameter()][switch]$Remediation, [Parameter()][switch]$Revert ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' $PolicyName = "Email Handling & Classification Design" $BIOControl = "18.03" function Connect-RequiredServices { # Connection logic based on API } function Test-Compliance { Write-Verbose "Testing compliance for: $PolicyName..." $result = [PSCustomObject]@{ ScriptName = "email-handling-classification" PolicyName = $PolicyName IsCompliant = $false TotalResources = 0 CompliantCount = 0 NonCompliantCount = 0 Details = @() Recommendations = @() } # Compliance check implementation # Based on: Design Document $result.Details += "Compliance check - implementation required based on control" $result.NonCompliantCount = 1 return $result } function Invoke-Remediation { Write-Host "`nApplying remediation for: $PolicyName..." -ForegroundColor Cyan # Remediation implementation Write-Host " Configuration applied" -ForegroundColor Green Write-Host "`n[OK] Remediation completed" -ForegroundColor Green } function Invoke-Monitoring { $result = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total: $($result.TotalResources)" -ForegroundColor White Write-Host "Compliant: $($result.CompliantCount)" -ForegroundColor Green $color = if ($result.NonCompliantCount -gt 0) { "Red" } else { "Green" } Write-Host "Non-compliant: $($result.NonCompliantCount)" -ForegroundColor $color return $result } function Invoke-Revert { Write-Host "Revert: Configuration revert not yet implemented" -ForegroundColor Yellow } try { Connect-RequiredServices if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { if ($WhatIf) { Write-Host "WhatIf: Would apply remediation" -ForegroundColor Yellow } else { Invoke-Remediation } } elseif ($Revert) { Invoke-Revert } else { $result = Test-Compliance if ($result.IsCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red } } } catch { Write-Error $_ }

Risico zonder implementatie

Risico zonder implementatie
High: Email = #1 data exfiltration vector. Zonder classification + DLP = confidential data flows external unencrypted, compliance violations (AVG encryption), IP leakage competitors. Het risico is HOOG - data leakage.

Management Samenvatting

Email Handling Classification: Sensitivity labels (Confidential/Internal/Public), DLP policies (block PII/financial data external), Auto-classification (machine learning), Encryption (Confidential = auto-encrypt), External recipient warnings, Attachment scanning. Vereist: M365 E3+ (DLP included). Activatie: Purview → Information Protection + DLP policies. Gratis. Verplicht BIO 18.03, AVG encryption, ISO 27001. Implementatie: 16-32 uur. ESSENTIAL data protection - prevents email leakage.