Categories | XQ Message Forum — XQ Message Forum

Creating Data Loss Prevention and Data Access Control Policies

Sarah Sanders — Fri, 10 Feb 2023 22:10:22 +0000

Data Loss Prevention (DLP) and Data Access Control (DAC) Policies are custom rules that trigger specific actions when emails are sent or opened. These policies help to protect sensitive data and control access to resources. This article provides guidance on creating policies and examples of best practices.

Note: The examples in this article are best practices. We recommend discussing your DLP and DAC Policies with your CMMC assessor to ensure compliance with NIST 800-171 requirements.

Access the Policy Manager

Using XQ's Policy Manager, you can configure DLP and DAC Policies right from your team's XQ Dashboard. Use the following steps to access the Policy Manager in your dashboard: Step 1: In the XQ Dashboard, click Policy Manager in the left-hand navigation bar. Step 2: Click Create Policy to launch the New Policy page. Step 3: On the New Policy page, use the Type drop-down menu to choose your policy type. The available types are Data Loss and Data Access. Use the following sections in this article to create your Data Loss and Data Access policies.

Creating Data Loss Prevention Policies

Creating Data Loss Prevention (DLP) Policies in XQ ensures the protection of controlled unclassified information (CUI) using automated encryption. With XQ, you can secure your data anywhere it travels. DLP Policies play a crucial role in meeting CMMC compliance requirements, as they:

Help companies fulfill multiple NIST 800-171 requirements.
Enable companies to identify the types of data that require encryption.
Allow companies to create custom profiles and rules for different types of data.

Create a new policy

Use the following steps to create a Data Loss Prevention (DLP) Policy: Step 1: Launch the Policy Manager in your XQ Dashboard and click Create Policy If you have already created a policy previously, click the ADD NEW button at the top of the page. Step 2: On the New Policy page, name your policy for future reference and select Data Loss from the Type drop-down. Step 3: Choose your policy's Conditions. Conditions control which criteria must be met to activate your policy. You can choose between these options:

Data: What body of data is being referenced? For now, you can only choose Email.
Field: What field is being referenced in your email? You can choose whether to reference a recipient or the contents within the message itself.
Operator: Select the available operator from the drop-down. The operator works by triggering your policy if the Data Type includes your chosen Value. Operator options change depending on the field you choose.
Data Type: Choose whether to allow or restrict email access based on your chosen Field. The options will change depending on the field you choose. For example, if your field is To/Recipient, you can choose between Domain and Email Address. If your field is Body, you can choose between Keywords and Pattern.
Value: Depending on your chosen Data Type, enter a value or select from the dropdown list.

You can add more conditions by clicking Add Condition in the top-right corner. If you have more than one condition, you can choose whether All or Any conditions are met to then trigger your action. You can also add more than one condition if necessary. Step 4: Choose whether to Send or Block the message. For example, if you want to prevent team members from sending messages containing specific keywords, select Block. Step 5: Then, choose to execute any of the following actions:

Notify User: Notifies the user who created the message. You can customize the message that is sent.
Log: Log this event in the event log. You can customize the message included in this log.
Auto-Encrypt: Automatically encrypts the message.

You can add more actions by clicking the Add Action button in the top-right corner. Step 6: Click Add Policy at the top-right corner of the page to save your Data Loss Prevention Policy.

Best practice recommendation: Auto-encryption

To achieve CMMC compliance with Data Loss Prevention (DLP) Policies, we recommend creating auto-encryption policies in XQ. Auto-encryption policies allow you to create criteria using keywords or specific conditions. This eliminates the chance of human error and ensures that all sensitive information is properly encrypted before being sent. For CMMC compliance, we recommend using the following keywords for your auto-encryption policy:

CUI
Confidential
Controlled
Classified
FAO
Invoice
JADC2
NDA

You can use additional keywords to ensure your auto-encryption policies are thorough and effective. The more keywords and conditions you add, the stronger your auto-encryption policies are. We recommend discussing your auto-encryption keywords with your CMMC assessor to ensure compliance with NIST 800-171 requirements. The following example provides an example of an auto-encryption policy that uses keywords: As an additional measure to ensure the security of sensitive information, we suggest automating the encryption of all email attachments. This guarantees that all attachments are always protected by encryption, regardless of their contents.

Creating Data Access Control Policies

Data Access Control (DAC) policies empower the system administrator to set rules for accessing a resource. These rules are established by assigning permissions to designated users. With DAC policies, the administrator can determine who can access the resource and the level of access they are permitted. DAC Policies play a crucial role in meeting CMMC compliance requirements, as they:

Help companies fulfill multiple NIST 800-171 requirements.
These policies provide administrators the ability to establish who is authorized to access a resource and the actions they are allowed to perform with it.

Create a new policy

Step 1: Launch the Policy Manager in your XQ Dashboard and click Create Policy If you have already created a policy previously, click the ADD NEW button at the top of the page. Step 2: On the New Policy page, name your policy for future reference and select Data Access from the Type drop-down. Step 3: Choose your policy's Conditions. Conditions control which criteria must be met to activate your policy. You can choose between these options:

Data: What body of data is being referenced? For now, you can only choose Email.
Event: What event is happening to your email? For now, you can only choose Access.
Operator: Choose to trigger your policy if the Data Type is From or Not From a country or IP address.
Data Type: Choose whether you're allowing or restricting email access based on countries or IPs.
Value: Depending on your chosen Data Type, select a country or input an IP address.

Step 4: Choose whether to Send or Block if your conditions are met. Step 5: Choose an Action. The available options include:

Alert Admin: This action sends a customized email to a specific admin. Optionally, you can include '$User' in your message to display the email address of any user attempting to send a message affected by your policy (eg. $USER tried sending a message with the word 'password' included).
Notify User: This action notifies the user who created the message. You can customize the message that is sent.
Log: This action logs this event in the event log. You can customize the message included in this log.

You can add more actions by clicking the Add Action button in the top-right corner. Step 6: Click Add Policy at the top-right corner of the page to save your Data Access Control Policy.

Best practice recommendation: Location-based restriction

Location-based restriction policies enable you to limit access to resources based on geographical location. These policies prevent unauthorized individuals located outside the designated geographical location from accessing the resource. This example shows a location-based restriction policy that restricts data access from outside the United States:

Best practice recommendation: IP address restriction

Further limiting access through IP address restrictions provides a more secure way of controlling user access. When implementing this type of policy, specific IP addresses are designated as authorized for accessing a resource. Attempts to access data from an unapproved IP address will be blocked. This example shows an IP address-based restriction policy that restricts data access to one authorized IP address:

Understanding Team Member Roles and Privileges

Sarah Sanders — Fri, 03 Feb 2023 23:01:36 +0000

You can assign different roles to a team member when creating their account in the XQ Dashboard. Each role has a different set of user privileges that control the level of access the team member has in the XQ Dashboard. We recommend assigning User as the default role for most Dashboard users. Reserve the SuperUser and Admin roles for team members who need to access User or Application Management features and Event Logs. This article provides an overview of the available team member roles and a description of what privileges each role has.

Descriptions of roles and privileges

SuperUser (Owner): This role is automatically assigned to the user who created the XQ account and has full access to all XQ Dashboard features, products, and settings.

Note: SuperUser (Owner) is the only account that can access the Billing page and purchase upgrades. This role cannot be transferred through the XQ Dashboard. If you need to transfer this role to a new user, contact the XQ Support team at support@xqmsg.com.

SuperUser: Users with this role can log in to the Dashboard and use all XQ Dashboard features, products, and settings except Billing. Admin: Users with this role can log in to the Dashboard and use all features, products, and settings except Billing and Trusted Range Management. User: Users with this role can log in to Dashboard and use enabled features, products, and settings with the exception of User Management, Application Management, and Event Log Access. Vendor: Users with this role cannot log in to Dashboard. This role allows for verified tracking of communications between vendors and other team members. Customer: Users with this role cannot log in to Dashboard. This role allows for verified tracking of communications between customers and other team members. Device: This role assigns devices a virtual address that is trackable. The role can only be used by trusted devices that connect through the XQ Gateway, and cannot log into the Dashboard.

How Data Access and Data Loss Policies Affect Your Inbox

Jovito Salem — Fri, 23 Dec 2022 04:25:02 +0000

When Data Access and Data Loss Prevention Policies are enabled, you may encounter a number of alerts or message blocks, depending on the rules set by an XQ admin. This article discusses the types of notifications you may receive while creating or viewing these messages. The sections below include:

Opening Blocked Messages (XQ Dashboard, Outlook Add-In, and Chrome Extension)
Sending Blocked Messages (XQ Dashboard, Outlook Add-In, and Chrome Extension)
Sending Auto-Encrypted Messages (XQ Dashboard, Outlook Add-In, and Chrome Extension)

Opening Blocked Messages

XQ policies can block emails from being sent or opened depending on certain criteria. Some examples are:

Block messages from being opened in a certain country or IP address.
Block messages if they are sent to a specific email address or email domain.
Block messages that contain specific keywords (eg. Password, Confidential, etc.)

Each of these blocked messages will contain a notification configured by an XQ admin and will be visible in the XQ Dashboard. Additionally, if you have installed the XQ Chrome Extension or Outlook Add-In, you will see these alerts directly within your inbox.

XQ Dashboard

Outlook Add-In and Chrome Extension

Sending Blocked Messages

If you are an XQ user attempting to send a message blocked by a Data Loss Prevention policy, you will immediately see the notification in the dashboard or through the Chrome Extension or Outlook Add-In. This will appear immediately after you attempt to hit send.

XQ Dashboard

Outlook Add-In and Chrome Extension

Sending Auto-Encrypted Messages

As an alternative to blocking messages, XQ policies can auto-encrypt emails depending on specific criteria. For example, an XQ admin can choose to auto-encrypt any messages including the word 'password' rather than blocking it altogether. Just like with blocked messages, you can view these notifications immediately after hitting send.

XQ Dashboard

Outlook Add-In and Chrome Extension

After hitting send in Outlook or Gmail, the auto-encryption notification will immediately appear in a new window. Click Continue Encrypted to proceed.

Creating and Managing Teams

Sarah Sanders — Thu, 15 Dec 2022 00:24:33 +0000

SuperUsers and Admins can create and manage teams in the XQ Dashboard to organize and monitor communications. This article provides instructions for creating a new team and guidance for managing teams.

Create a new team

Step 1: Log in to the XQ Dashboard and click Personal Dashboard in the top-right corner.
Step 2: In the dropdown menu, select + Create a new team. Step 3: Input your team name.
Optional - If you already have contacts in your personal dashboard, you can choose to add existing contacts to your new team. Select the checkbox to add existing contacts.
Click NEXT to proceed. Step 4: Invite members to your team by entering their email addresses in the text field and clicking NEXT. You can also choose Skip for now to add team members later. For instructions on adding team members, see How to Add Multiple Team Members.

Manage your team

Step 1: Log in to the XQ Dashboard and select your team's dashboard in the top-right corner.
Step 2: Click the Team tab from the Dashboard's navigation menu. Under the Team page, you can review authorized team members and their roles. You can also new team members on this page.
Step 3: To view communications and activities of individual team members, click on the team member's name. On the Team Member Details page, you can monitor team member activities and communications, emails, titles, statuses, roles, and last login date. You can also click EDIT INFO to disable or delete a team member. If you need to edit a team member's role, see Team Member Roles and Privileges for a description of each role. For instructions on adding team members, see How to Add Team Members.

Audit Tools

Traian — Thu, 21 Oct 2021 04:14:59 +0000

XQ Audit Tools allow you to export encryption keys and unlock archived communications. The available Audit Tools include Export and Unlock.

This guide provides an overview of Audit Tools and instructions for using each tool.

Export

The Export tool can be used to export message encryption keys belonging to members of your team. These encryption keys can be used to restore messages, even after the keys are no longer available online. Refer to the following steps to use the Export tool:

Step 1: Log in to the XQ Dashboard, locate Audit Tools from the navigation menu, and select Export.

Step 2: Select a date range from the calendar.

Step 3 - Optional: Select a User Role and Contact. These are optional fields. The default values are All Roles and All Contacts.

Step 4: Select an Export Format and click EXPORT KEYS when finished.

Once the keys are exported, you can use the file to unlock your workspace team member's encrypted communications with the Unlock tool.

Unlock

The Unlock tool allows you to unlock encrypted communications. You must export encryption keys before using the Unlock tool.

Step 1: Under Audit Tools in the navigation menu, select Unlock.

Step 2: Drag and drop or upload the encrypted message files you are unlocking.

Step 3: Drag and drop or upload the encryption key file you created using the Export tool.

Step 4 - Optional: Enter keywords in the filter field to filter the data. You can also click the All keywords required checkbox.

Step 4: Click Unlock Data to decrypt your messages.

Decrypted communications are now readable from the XQ Dashboard and can be downloaded.

How to Decrypt a File

Traian — Thu, 21 Oct 2021 04:11:51 +0000

You can decrypt files directly from the XQ Dashboard. This article provides steps for decrypting a file.

Step 1: Log in to the XQ Dashboard and select Secure Messaging from the Product Hub.

Step 2: Click Decrypt File from the top navigation menu.

Step 3: Drag and drop or click Browse to upload a file.

Note: Your uploaded file must have an XQF extension. Your file is decrypted locally and never leaves your device.

Step 4: Click DOWNLOAD DECRYPTED FILE.

How to Encrypt a File

Traian — Thu, 21 Oct 2021 04:09:14 +0000

XQ provides Zero Trust encryption so you never have to worry about data leaks and you can feel confident your files reach the recipient securely. This article provides steps for encrypting a file from the XQ Dashboard.

Step 1: Log in to the XQ Dashboard.

Step 2: From the Product Hub menu, click Secure Messaging.

Step 3: Click Encrypt File from the top navigation menu.

Step 4: Enter the recipient's email address(es) in the Who will be able to view this encrypted file? field.

Step 5: Select a Message Expiration time frame.

Step 6 - Optional: Use the checkbox to enable or disable Require user authentication to read.

Step 7: Drag and drop a file or click Browse to upload a file.

Step 8: Click DOWNLOAD ENCRYPTED FILE.

Your file is now encrypted and can be sent to a recipient or saved on your device locally.

How to Send Secure Messages from the XQ Dashboard

Traian — Thu, 21 Oct 2021 04:07:22 +0000

This article provides instructions for encrypting and sending messages from the XQ Dashboard.

Step 1: Log in to your XQ Dashboard at manage.xqmsg.com and click Secure Messaging from the Product Hub menu.

Step 2: Add Recipients, then fill out your Subject and Message.

Step 3: Attach a file if necessary and set a Message Expiration time frame.

Optional - Tick the Send copy to myself checkbox to send a copy of the message to your email address. You can also tick the Require user authentication to read checkbox to require your recipient to authenticate with their XQ account to open the message. If this option is enabled and your recipient is not already authenticated, the email the recipient receives will display a note that reads "Please log into your XQ account to read this secure message". It will then automatically open a window asking them to sign in:

Step 4: Click Secure Send to send the message.

How to Add Team Members

Traian — Thu, 21 Oct 2021 04:05:35 +0000

Having a verified team adds a layer of security to secure communications by authenticating the identity of the communicating parties. It also helps identify external communications of sensitive material. Team members will be able to access and send information securely, all while being recorded through the XQ Dashboard.

If you have not yet created a team, see Creating and Managing Teams for more information.

SuperUsers and Admins can add team members individually from the Dashboard or in bulk with a CSV file. This article provides steps for adding team members.

Add Individual Team Members

Step 1: Open the XQ Dashboard and click Team from the navigation bar.

If you are not currently viewing the correct team, click on your team menu in the top-right corner of the dashboard to select the right one.

Step 2: Click the + icon on the top-right corner above the existing team member list. Then, click Add New.

Step 3: Fill out the form and choose one of the pre-defined roles from the dropdown list. For more information on the available user roles, Team Member Roles and Privileges.

Click CREATE CONTACT to then trigger a confirmation email to your newly added Team Member.

Note: At this point, if you have available seats in your account, you can click the Assign user an email license checkbox to assign one of those seats to any User or Super User.

To learn more about assigning licenses to an account, check out THIS article.

Your newly added team member will now receive an email asking them to accept the invitation. Once they accept, the process is complete.

Add Team Members in Bulk

Step 1: If you would like to bulk upload contacts, navigate back to the Team tab in the left menu bar. Then click the + icon in the top-right corner above your existing team member list. Click Import.

Step 2: Click GET TEMPLATES to download the JSON and CSV file templates required to bulk upload contacts.

Step 3: Open one of the templates from your local file system and input your team members' Emails, First Names, Last Names, Roles, Notifications, Titles, and Phone numbers.

The file will contain instructions and demo users showing how to format your team members in the spreadsheet. The following screenshot shows an example from the .csv file:

Step 4: Once you have populated the spreadsheet, drag and drop the file into the drop-zone or browse for it in your file folder.

All invited team members will receive an email asking them to accept the invitation. You can view their status in the dashboard by navigating back to the Team section.

Monitor Overview

Traian — Thu, 21 Oct 2021 03:06:22 +0000

The Monitor section of the XQ Dashboard has tools that allow you to monitor your team's activities and manage team members. The tools in this section include Communications, Activity, and Team.

This article provides an overview of the Monitor section of the XQ Dashboard.

Communications

The Communications tool allows you to review and keep track of your personal and team communications. The term communication is defined as any file, email, or message that has been encrypted.

From Communications, you can interact with the world map to drill down communications by geographical location. You can also create Reports for more insight into your team's communications. For more information on Reports, see How to Create and Send Reports.

Communications also contains a detailed list of all communications for both personal and team communications. You can search this list by time period or use the filter options to narrow down search results. Each item on the list is marked with relevant details about the communication.

Click on any communication on this page to review the communication details page. From the communication details page, you can REVOKE or GRANT access to recipients and view detailed information about the communication.

Activity

The Activity section provides a quick overview of personal and team communications and activities and a running log of all security events for your communications. The term communication is defined as any file, email, or message that has been encrypted. The term activity is defined as any action performed on a communication. Examples of activities include reading a message or revoking access to a file.

To see more details about a security event, click on the event in the Team Activities list. This will open an Event Details page with specific event details and a list of related events. Security events are marked with a status of Good, Warnings, or Needs Attention so that you can quickly identify security threats.

Team

The Team section allows you to manage and view activities for specific team members. You can add a team member by clicking on the + icon. To manage existing team members and view team member activity, click on the team member from the Team list.

After clicking on a team member's name from the Team list, you will be redirected to the Team Member Details page. This page allows you to edit team member info and view team member activity and communications. Click EDIT INFO on a team member's profile to edit a team member.

On the Update Team Member modal, you can edit team member details, disable a team member, or delete a team member.

Using the tools in the Monitor section of the Dashboard, you can monitor and safely provide secure communications with your customers and team members.

How to Log In to the XQ Dashboard

Traian — Thu, 21 Oct 2021 03:04:49 +0000

The XQ Dashboard is the central location for all communication, encryption activity, team management, and application creation. Use the following steps to log into the XQ Dashboard:

Step 1: Navigate to xqmsg.co and click Login.

Step 2: On the login screen, sign in using one of the available options:

Microsoft single sign-on: Click the Microsoft button and complete the login steps.
Google single sign-on: Click the Google button and complete the login steps.
Email address: Enter a valid email address and click Send me a magic link. To access the magic link, navigate to your email inbox, open the magic link email, and click Sign In.

Note: The magic link is only valid for 24 hours for account security purposes. You must request a new magic link each time you log in with an email address. Check your email's spam folder if you cannot find the magic link email.

Step 3 - Optional: For first-time users, click NEXT to complete the onboarding tour or click SKIP TOUR to skip the tour.

You are now logged in. To learn how to navigate and use the Dashboard, see Using the XQ Dashboard.