Keeping Emails Private
From ipinfinity.com
<digg/>
An accountant wants to email her clients their tax returns but needs to be sure that no one else can open the attachments. A doctor wants to send an insurance report by email but is nervous about protecting the confidentiality of his client. The Procurement director needs to exchange pricing information with the supply chain but must be sure that this market-sensitive information doesn’t leak.
Email is at the heart of business today. The Radicati Group, a technology market research firm, estimated in August 2008 that there are 1.3 billion email users worldwide. In earlier research, they counted 516 million business email inboxes worldwide. It’s easy to ground these big numbers in your own everyday experience – just imagine what would happen if your own email link were switched off.
Email may be ubiquitous but it is far from secret. The vast majority of emails are unencrypted which means that they are not secure during transit and can ultimately be read by anyone. With so much at stake, what are the risks of sending unencrypted emails, what are the options for keeping emails private?
Contents |
The Case For Email Encryption
Email encryption addresses three business issues. It reduces the risk of data loss. It helps companies comply with legal and professional requirements. Lastly, it builds trust by demonstrating a company’s commitment to data security.
Data loss is in the news. The government seems to lose laptops, CDs and memory sticks with personal data on a regular basis. Businesses face the same risks but perhaps less pressure to go public about each incident. Email is another conduit for data loss. Consider these possibilities:
- Customers assume that the financial information that they share by email with a business is secure, only to learn that their messages have been intercepted, harming the company’s reputation.
- A law firm loses business because it can’t guarantee that email messages between clients and lawyers are secure.
- Client emails containing medical, legal or tax paperwork fall into unauthorised hands
The risks are obvious:
- Reputation damage through negative PR
- The legal risk that someone might sue you for breach of confidentiality
- Loss of company secrets and intellectual property
- The risk of identity theft or other security problems
- Failure to live up to regulatory requirements
Once it has leaked, data is very hard to put back into the bottle. It can be shared easily online and it is difficult to trace who has seen it or who is responsible for leaking it. For example, information can find its way onto internet sites that are very difficult or impossible to shut down. An ounce of prevention is worth a pound of cure.
Conversely, a proactive approach to data security that embraces email encryption can demonstrate to employees, partners and customers that you value their trust – a valuable business asset. While it may be difficult to quantify, imagine the business benefits of increased trust in your company’s email. For example, you could send wage slips, invoices, pin numbers and other sensitive information via encrypted email and save money on printing and postage.
Being able to exchange sensitive information safely is a competitive advantage. It is more efficient for your customers, employees and partners. It is cheaper for you. Using email is also greener than sending things by post. Secure, trustworthy, efficient email could be a key differentiator for companies that use it.
Legal And Regulatory Concerns
Email privacy is especially important to regulated professions including the legal, finance, medical and insurance sectors. However, in the UK, the Data Protection Act 1998 applies to all businesses. Among other provisions, it requires companies to take appropriate technical and organisational measures against unauthorised or unlawful processing of personal data and to protect against its accidental loss. Companies must take care to make sure that informa- tion sent by email is protected in transit.
Besides the risks of legal action arising from wrongful disclosure, the Information Commissioner can issue a very public enforcement notice. For example, in January 2008, the Information Commissioner required that a leading high street retailer encrypt all the hard drives of its laptop computers by April 2008. It almost goes without saying that such a notice would be very damaging to a company’s reputation.
Regulation is also a concern. Different professions have different rules and regulations. However, sanctions can be severe. In February 2006, for example, the Financial Services Authority fined one of the UK’s largest building societies £980,000 when a computer containing unencrypted customer files was stolen from an employee’s home. On a personal level, failure to take reasonable precautions in similar circumstances could be career-limiting, to say the least.
Approaches To Email Encryption
Encryption is not just for spooks and the military. It’s part of everyday life but it goes unnoticed most of the time. Millions of people use SSL certificates to encrypt ecommerce and other online transactions. Mobile phone conversations are encrypted to prevent eavesdropping and, with the right settings, so are wireless networks.
It is possible to make encryption a seamless and near-invisible part of the email experience. There are different ways to do it and the choice depends on a variety of factors: what you need to protect, the level of control you want, how much time and skill your IT department has and the level of automation you need. There are four main choices:
Desktop vs Gateway
As the name suggests, with desktop encryption the actual encoding takes place on each user’s own PC, typically on a message-by-message basis within the email client and requires desktop software to be installed. This approach gives individual users more flexibility and allows for additional features such as non-repudiation and sender authentication. However, keeping track of encryption keys and enforcing company policies creates headaches for the IT department. Gateway encryption lets IT departments define policies at a corporate level and encrypt emails as they pass through the email system, removing the need for users to decide what to protect. Gateway encryption also makes it easier to implement email archiving, content control and anti-virus protection because messages are not encrypted until they pass through these systems.
Types Of Encryption
Having decided where in the email pipeline to do your encryption, you then have to decide how to do it. There are several encryption protocols, including TLS, S/MIME and OpenPGP. TLS is like a permanent encrypted tunnel between two email systems. S/MIME is supported by many email clients but requires each user to have their own certificate and unique encryption key. (S/MIME Gateway technology can make it easier to manage.) OpenPGP is an open standard based on the commercial PGP encryption protocol. It also requires that individual users have certificates and unique keys. It requires sender and recipient to use compatible versions of the encryption software.
Push vs Pull
These encryption options support the “send-to-anyone” capability. Once the email has been encrypted and sent to the recipient, how do they read it? This is the choice between push and pull. With push emails, the encrypted message appears in the recipient’s normal inbox. The push solution requires no special software and has the benefit of storing the encrypted message directly in the recipient’s inbox. With pull emails, the recipient is ‘pulled’ to a secure website to read encrypted messages. The pull option does not require special software either and, in addition, it can support other unique features including automatic expiration of messages and read receipts.
Software, Appliance or Service
The final choice determines how companies implement encryption. An in-house software solution requires dedicated servers, including a Public Key Infrastructure key server, and dedicated software and maintenance. Some vendors pre-package all this technology into stand-alone appliances. This makes it simpler to install and maintain but still requires capital expenditure and in-house technical expertise. The other option, encryption as a service, is the fastest and easiest way to implement encryption. A trusted third party handles the whole process using their servers, eliminating the need for capital-intensive hardware and technical expertise on the client’s premises.
Managing Encryption
The technology is only part of the puzzle. It raises several management challenges. For the IT department, encryption has a reputation for being difficult both to implement and manage. For example, with a software-based, in-house solution, if a user loses their encryption key, they cannot read their old email. So keeping track of everyone’s keys and providing the means to issue replacements is vital, if burdensome. An effective encryption system needs to minimise the burden on the IT department.
Traditional approaches to encryption are not always intuitive and easy to use for non-technical users. Many users who deal with confidential information – call centre workers or frontline medical personnel, for example – may not have the computer skills to use desktop encryption software properly and consistently. What is more, most encryption techniques require that users pre-share their public keys so that they can decrypt one another’s emails. This means that both the sender and the recipient have to know what they are doing. Under pressure of time or faced with ‘computer problems’, users may simply bypass encryption altogether.
To be worthwhile, encryption must work for all users in compliance with all company policies, otherwise it provides a false sense of security. It may be better to know that all your emails are unencrypted than to have some secure and some not, but not to know which is which.
