GDS updates email and service guidelines for tighter security
The Government Digital Service has updated its guidelines to mandate that services run on secure HTTPS and use HTTP Strict Transport Security by 1 October 2016.
GDS has imposed higher security measures for services and emails - Photo credit: Flickr, Jobs for Felons Hub
The security guidelines for government services were first established in 2012, and have now been updated to set out stricter security measures for services and emails.
All government services must run on secure systems – HTTPS – so that all data is encrypted while users are using the service.
In addition they must use HSTS. This tells browsers that a service will only use secure connections and that information should be encrypted.
The service.gov.uk domain will only ever connect to government services via HTTPS from September, meaning that services that are only available over unsecured connections will stop working in modern browsers.
Alongside the updates to services, GDS has published guidance on how to implement secure email practices.
This includes an update to its DMARC - Domain-based Message Authentication, Reporting and Conformance – policy.
Any emails that do not have a DMARC policy set to the highest level, known as p=reject, by 1 October may have their emails rejected by external email providers, GDS said in a blogpost.
It said that, as a temporary measure, if teams can’t change their policy to p=reject, they should publish a record using p=none to override the default policy.
CyberArk, our sponsor for PublicTechnology Cyber Week, writes about how industry and government are working together to meet Australia’s cyber challenges
Information request reveals that number of reported incidents increased slightly
The perimeter security programme is already protecting thousands of NHS services and wants to work with more trusts, according to Rosie Underwood
Fake online shops, malware, phishing emails and ransomware attacks on hospitals have been among the scams perpetrated by bad actors during the pandemic
CyberArk's David Higgins explores the cyber risks of hiring independent contractors
CyberArk's John Hurst looks at the true cost of GDPR breaches
PublicTechnology talks to Rich Turner about why organisations need to adopt a ‘risk-based approach’ to security – but first make sure they get the basics right