Information Security

Defending the digital infrastructure

In This Issue

iSTOCK/GETTY IMAGES

Evaluate

Product review: Titus Labs' Message Classification

DOCUMENT CLASSIFICATION

Published: 01 Feb 2008

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please login.

You have exceeded the maximum character limit.

Please provide a Corporate E-mail Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

DOCUMENT CLASSIFICATION

Message Classification
REVIEWED BY MIKE CHAPPLE

Titus Labs
Price: Standard Edition starts at $22.95 per user, Enterprise Edition at $34.95 per user

Classifying data is tedious and frustrating, but it's impossible to develop appropriate security policies and standards, or efficient e-discovery processes, without a solid understanding of the value of enterprise data.

Message Classification is a simple tool to classify and label Microsoft Outlook email messages, removing some of the barriers to this onerous task. Custom policies control the visual markings applied to messages and prevent third parties from downgrading the classification of a message when forwarding or replying. It's available in a Standard Edition and an Enterprise Edition that offers advanced interoperability with other technologies.

Policy Control

The Standard Edition provides basic policy options: You may require the labeling of messages in the body and/or the subject with first- and second-level classifications. You may either warn the user or block attempts to downgrade the classification of a message reply or forwarding.

The Enterprise Edition adds more granular controls, allowing different document policies for various classification levels. For example, you may allow users to send secret documents to a partner company while prohibiting them from sending top-secret documents to that company. It also allows you to grant certain users the right to downgrade classifications.

The Enterprise Edition integrates with Microsoft Rights Management Services and gateway encryption solutions, triggering automatic policy-based encryption of email messages. Both editions use labels as metatags, so they can integrate with document management and archiving solutions.

Configuration/Management

B+

The Message Classification Administration Tool facilitates creation of policy and configuration settings. It allows you to customize the primary and secondary classification labels. For example, those in the defense industry may configure primary classification levels of "Top Secret" and "Secret," and secondary classification labels to match handling caveats, such as "No Contrac-tors" or "No Foreign Nationals." You may create policies manually on each system, export them to other systems, or to a Group Policy Administrative Template for use with Active Directory. The Enterprise Edition offers tighter integration with Active Directory.

Effectiveness

Message Classification met all of its stated goals during our testing. It correctly enforced policies designed to prevent the unauthorized downgrading of a message and required us to apply labels before sending a message. Message Classification integrates with Outlook and is straightforward for any end user, presenting pull-down menus to apply classification labels.

Reporting

Message Classification allows you to create an audit trail using the built-in Windows Event Viewer, but provides very little granularity. You may choose to log warnings, audit messages, and/or informative messages, but cannot specify the logging of events based on message classification or other criteria. There is no native reporting functionality, requiring administrators to pore through Win- dows Event Viewer to find records of interest. It can be integrated with third-party tools for alerts and reports or integrated with log management products.

Verdict

Message Classification fills a growing need for data security and regulatory compliance, but needs a stronger feature set for mainstream deployment.

Testing methodology: We tested Message Classification in a Windows XP environment using Microsoft Office 2007.