How do you guarantee e-mail security?

I think we all agree that SMTP protocol is inherently insecure. ;)

But just because email security is not guarantee doesn't mean we shouldn't use it.
What it means is we shouldn't use email for to communicate sensitive or confidential information.

If confidentiality of information is important, PGP should be used as Jon suggested.

However, if the organization is handling confidential information most of the time, it should consider an enterprise version of PGP.

Just my 0.02 cents.

The author seems to confuse traffic analysis (and physical security at the endpoints) with message content security.

On the whole, as a business email user I don't care if someone knows that company A (a customer) sends me email, or that Company B (a supplier) does the same. The *content* of that message is obviously of high importance, but the traffic is not.

As a private person, I care a little more about traffic analysis - what business is it of some random observer who I talk to? but for this there are ways and means. I can conceal as much as I need to - for instance, by subscribing to a privacy-protective email service such as Hushmail, or by use of the anonymous remailler network, or simply by (ab)using a open proxy server to relay my TLS mail connection directly to the recipient's ISP.

PGP (and indeed, even such lowly packages as the 7-zip compression program) can effectively and cheaply protect content at rediculous levels of strength - and while it is true that traces may remain at the endpoints if myself or my correspontent are careless, it is *more* likely that one or both of us would insecurely dispose of a paper missive than that the automated (and free!) swap and freespace erasers would fail in such a way as to not remove all trace of deleted mail once the machine is rebooted.

Although I agree with most of what John Yarden has to say regarding e-mail security, there is one sticking point in his argument - the conclusion.
To propose a "Don't use e-mail" approach as a solution to security seems a bit extreme, and in many cases not viable.
We all know that e-mail is clear text and not very secure. And I'm sure that many are aware of e-mail server log entries and the vulnerability to sniffing anywhere betwen e-mail point A and point B. And, in an absolute sense, John's position is correct - if you can't risk detection of e-mail correspondence, the safe route is to find an alternate means of communication. But, before we go all cloak-and-dagger, let us consider the reality of the situation. Many companies have gone to great lengths and expense to drag their users into the modern world of office communication. It is a world wherein the paper-based memo typed by a secretary has been replaced by an e-mail typed by the manager. It is an enabling paradigm that improves productiviity in the workplace. Users have embraced this form of commununication and made it their own. And now we say to them, "your communication is not secure"? Now that we have our users on-board, we sink the ship? It appears that we, as IT professionals are contradicting ourselves, which does little for our credibility.
If we preach too much security to our users, won't they hesitate to use e-mail at all? Rather than that, shouldn't we work toward a more universally secure e-mail transport? Why not just implement currently available e-mail security solutions?

Although I believe you can never be too vigilant with security, in this case I believe its all about the approach. And shouldn't it be incumbent upon us as IT professionals to provide secure solutions to our users, so that they need not concern themselves with the security of their e-mail communications?

Robert McIntire

I can relate to the Article. What John is saying is... we all need to use more common sense when sending e-mails.

I like the postcard theory... would you be telling your mistress how much you love her if you know the card could easily be read by her husband.. :)

One member suggested using encryption was enough because they did care if one person knew about him talking to other vendors competitors etc...
Yet I can say I know of "literally" a million dollar deal that was cancelled because it was discovered that a supplier was going to become a vendor also, putting the distribution company in direct competition with their customers. It was an e-mail from a manufacture left laying around that ?let the cat out?.

I had arguments with superiors, because they print out all emails and file them away. When I asked why they did this, they said it was to cover their backsides. I pointed out that without the email data from the server, it wouldn't 'prove' anything. Anyone could forge a printed e-mail.

I can say, I even know of lawyers who use public, unsecured internet fax services to transmit contracts and other confidential information to each other.
(Even after they were warned that said information could be viewed by unauthorized people.

While I understand what Jon was saying? I would tell Jon, he?s wasting his time. Until someone gets caught using obtained information from the internet and people are show the potential problems that exist, no one is going to care. They figure their privacy is protected when it?s not.

Yeah I know I rant and rave about GW all the time but that's because it is awesome!

I have configured two GW PO's with 128 bit encryption AND PKI in a python script for select corporate users. IN five years, they have not had a single virus (knock on wood), SPAM is VERY minimal and a third party reading mail is made MUCH more difficult through PKI services on a 486 running Python.

Cost to secure was VERY minimal, software is a little more expensive than Exchange but requires hundreds less maintenance and patch hours each year. Almost a fire and forget.

as for NOT using email at all, that's just paranoia. A friend of mine runs a business scanning executive cars and offices for bugs. He gets called to patking lots at all hours to scan a car that's been parked for a few hours, just to make sure bugs aren't travelling with the owner. When they get home from a two week excursion, they then have hime check thier house, phone, fax, internet cabling, electrical system and property for bugs and tracers.

In 9 years he has actually found less than fifteen bugs, but it is some form of paranioa or peace of mind that keeps them calling for his services. Hey, for less than a $6,000.00 investment in equipment, it sure is a neat niche business.

securing email should be done based on the importance of th information secured. If someone hacks MY email and gets my band BS and promo songs, I don't care, usage is completely copyrighted anyway. If someone retrieves my TR login information or my SHAW login information, I my have a few additional things on my Shaw bill but nothing that will not be rectified with a quick call and certainly not something that will cost me money.

If someone retrieves MY business information (keeping in mind, I'd never send credit card info or SIN#'s etc by email.) I don't care, if they are a competitor then they can see that I'm gaining thier business, so what?

In a banking situation, everything is PKI secured anyhow. In Military transmission, the military has it's on encryption format and authentication system. Plus anything THAT important wouldn't be sent by email.

In closing I feel that if you're are dumb enough to trasnmit sensitive information via email, you deserve what you get. Many companies I've seen go way overboard in security, who cares how many dreapes your company cleaned last week. I think people flatter themselves by adding ridiculous security to email when it is completely not needed and the information isn't even wanted by anyone anyway.

Security is relative, the white house has many guards outside, it needs it. How many guards are in front of YOUR property guarding YOUR house? You don't need guards do you, having the Secret Service monitoring your lawn looks cool and sounds cool but that's about it, perhaps even a enw reason for someonw to try and breach you and see WHY you need such security.

Well - we have a very strongly supported email policies - we also have a content filtering software, where outbound messages are encrypted if need be and sent or if healthcare issue or financial issues.

Then we dump it into tumbleweed.........

After having reviewed the comments up to the time of this message, I believe this is nothing more or less than another case of acceptable risk. Nothing is 100% secure, whether it's an email, a network, or my 'ex' getting ready to go out to dinner. What is the risk you or your customer is willing to take based on resources involved and expected outcome? How many government or corporate networks have NO physical connection to the outside? How many of these are housed within 'dampened' rooms? -Can't really say, but I've seen a few. On the other hand, how many systems are 'plugged-in' via ADSL or cable modem without ANY firewall or basic security patches in place? -Too many --we've all seen our firewall logs and the thousands of hits we take 24/7.

The driving question is simple: What level of risk is acceptable to you or your users. We all know ANY transmission can eventually be decrypted. We've read the horror stories of 'leaked' email, subpoenaed email, and stolen data.

Just like the physician telling you not to eat that Philly cheese steak pizza, smoke that cigarette, or inhale that spray paint; we should inform our customers of the issues; showing how the process of sending, relaying, and receiving email (not too in-depth tho). The better you can explain the situation to people with varying levels of understanding, the better your chances of success.

Having gone through the technology 'hierarchy', I've been fortunate to experience it from different levels: -as the young technician warning people of the issues (otherwise known as beating my head against the wall), -as the sage (biting-my-tongue), well-paid consultant coming in (AFTER the fact) to 'fix' the disaster (without being able to fix the underlying problem), and finally, -as the director who sets policy based on input from what? -Best Practices of other leading government technology organizations, my peers, and finally (possibly the most important source), -That young technician who thinks they're beating their head against the wall.

Great article! I would like to add that ANY email policy should include some aspect of education so the users can understand the rationale. Otherwise, it will continue to be abused/ignored until someone gets caught or security is breached. There's NOTHING like learning the hard way... remember Melissa.W? I think December 14th, 1999 will be etched in my mind forever (that's the day my most computer savvy user infected the White House Chief of Staff's system) and everyone but our legal department called to ask why all their word documents had been reset to 0bytes (our legal office insisted on WordPerfect -of course they were safe because Corel wasn't a target).

Sorry for the feckless meandering -I guess my adderall wore off. Once again, thanks for all the great inputs! I've enjoyed reading them all.

I am a Net Admin at a law firm. We have an e-mail policy in place that confidential communications should not be done via e-mail. This is especially true for a law firm because of Attorney/Client confidentiality. Faxing is risky too.

But policies only go so far. There is the element of human error to consider. Its so easy to click the send button or fax something to the wrong number. I've seen it happen many times. Everyone has received misdirected email or faxes.

The preferred methods for handling confidential or sensitive documents is in-person meeting, by courier, Fedex or plain old certified mail.

I thoroughly enjoyed Mr. Yarden's article on E-Mail Security (or the lack of it), but it brings to mind a question.

As a person who has not had the opportunity to work on may of the security issues of which he speaks, I wonder what alternatives Mr. Yarden has in mind when suggesting that we stop using E-Mail. I know that that was not the true substance of his article, but I would welcome his views on alternatives in a follow-up article on the subject.

Thanks,

Gerra

03004302 82FF6D11 13G01621 G002B396
31C60D03 G0030200 01208600 140F6E00
3C6B25G0 024FG002 2A0F6E00 3B6B2500
34CC6D00 C2FC2586 01A07700 140F6E00
3C6B25G0 024FG002 2A0F6E00 3B6B2500
34CC6D00 C2FC2586 4F553D43 4F52502F
4F3D4252 554E5357 49434B43 4E3D4269
6C6C2041 76657279 2F4F553D 434F5250
2F4F3D42 52554E53 5749434B 42560400
312E3000 42430100 03424101 0030424C
02007602 4E4E4F00 1B4B11A0 BC2EE3B0
75C89B99 C0C6F2B4 8AD2D577 8E01D9B0
23248785 84F7BD65 1286698D 5BD7A896
A43FC35F 7F64A3BF F1459795 CF054896
52E618D4 84619AE2 410FD230 64D18B69
81B2DF0C 1B893345 4E030001 00014D41
08008CCE 5C9C3877 75077E00 50555253
4146628B 1AC45507 7A316419 A400ED74
7065E0E1 3285A9A5 3F1A3CA8 4B23D5B6
09BDA504 B1D72454 C2B93532 2B06BCE2
EF890823 791F52D9 39A528A3 F046D136
4D996325 93B09967 7D8C6920 F557727F
27425604 00312E30 00424301 00034241
01003042 4C02G001 024E4E40 00931302
81D59F1B 85395002 EF6AF9C5 BECBBE5D
70310092 CF82A4E0 0CB6B296 A0EF8D19
EF1DCBA5 308B0C7D C175D94E CDB3AA37
834F5006 38C37739 74C24D48 BA454E03
00010001 4D410800 9D9QADD5 9427F4A2
6F005055 52554146 0C1F6E6A 2ABF4623
A863776D 324ABCBE F291FCB5 BAD11352
F4BC5539 8DC446ED 2226344D E542E208
145EB3FC 36D72ADD 216C2600 C9C1CCB6
E61B2550 8244B79C 31BFD3A2 EBFA5615
AD23FF94 4D85094

... the best way to guarantee e-mail security is to not use e-mail.

How curious that the simplest solutions always seem to elude us.