An Elephant in the Living Room

Don’t forget to lock the obvious front door to your network

Security managers are more aware than ever that information security requires a layered approach with components addressing every point of intrusion on the corporate network. Yet with an estimated 196 billion emails to be sent daily worldwide in 2015 and email continuing to dominate internal network traffic at most organizations, a network security plan that fails to address the risks posed by email is like leaving the front door unlocked.

Data loss or breach is arguably the largest risk of email communication. The concern is just as great among unregulated industries as it is in sectors where privacy is of heightened concern such as in financial services and healthcare. Here are a few facts that illustrate the urgency:

  • 53 percent of employees have received unencrypted, risky corporate data via emails or email attachments.
  • 21 percent of employees report sending sensitive information without encryption.

The costs of data loss are staggering, not to mention the damage it does to a company’s reputation (who can forget the contents of those Sony emails?) and any legal repercussions for violating regulations regarding the transmission and storage of sensitive information such as, HIPAA, FIPPA or PCI.

  • 22 percent of companies experience data loss through email each year.
  • The average corporate data breach costs $3.5 million.

A growing threat to corporate email users is phishing. Sending emails from a forged sender address, called spoofing, is one way of carrying out a phishing attack, with the goal of tricking the unsuspecting recipient into downloading malware or entering confidential information into a fake web site where it is accessible to the hacker. Though it’s often viewed as a consumer problem— it seems every week there’s a new attack targeting customers of retail sites or online services—hackers have started to set their sights on corporate users by impersonating the company and targeting employees.

  • An estimated 1 out of 392 emails is part of a phishing attack.
  • 300 percent growth in phishing emails in the past year.
  • 33 percent of Fortune 500 executives fall for phishing bait.

Digitally Signed and Encrypted Email: Network Defenses

Not surprisingly 35 percent of organizations now use encrypted email, up from 29 percent according to a Ponemon Institute report. As of this February, Google reported that 78 percent of outbound Gmail messages are encrypted.

The most common approaches to email encryption are based on public key cryptography. Google uses TLS, the same technology that secures your connection to websites (as indicated by the https and padlock in the address bar). For desktop email clients (e.g., Microsoft Outlook, Apple Mail, Thunderbird), which are often more common in corporate environments, S/MIME is the most popular option.

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is the industry standard for public key encryption for MIMEbased (message-based) data. S/MIME offers two key email security functions:

  • Digital Signature
  • Encryption

To digitally sign and encrypt emails, you will need an S/MIME digital certificate. A digital certificate is a virtual passport; a way of proving your identity in online transactions. Just as a local government needs to verify an identity before issuing a passport, a third party verification entity known as a Certificate Authority (CA) needs to vet an individual before issuing a digital certificate. Since the certificate is unique to the individual, using it to sign an email is a way to prove, “yes, it’s really me sending this email.”

Digitally Signed Emails Mitigate Phishing

Digitally signing your emails is a way to assure recipients that the email is legitimate and actually came from you. You can see how this mitigates the corporate phishing risks discussed above. If your company standardizes on digitally signing all email communication, any spoofed emails from phishers will immediately raise a red flag since they aren’t signed.

Encrypted Emails Prevent Sensitive Data from Falling into the Wrong Hands

Encrypting an email ensures only the intended recipient can access the contents. This is because the encryption process requires information from your recipient’s digital certificate. Unless someone has access to the certificate (and only the individual should have access), he won’t be able to read the contents of the email.

One erroneous perception is that digital signatures and encryption add time. In fact, digitally signing an email is as simple as clicking a button, with many email clients enabling the user to set digital signatures as a default on all outgoing messages.

A Red-Ribbon Badge of Authenticity

Digitally signed and encrypted emails literally wear an emblem of their added security. In Microsoft Outlook, a red ribbon indicates that the email was digitally signed and the identity of the signer is listed under the subject line. Encrypted emails display a padlock.

Clicking on the red ribbon or padlock verifies the identity of the sender and offers more details about the signature. These clear trust indicators mean the recipient of the email can instantly see that the email was digitally signed or encrypted, by whom, and know that the email actually came from the correct person, has not been forged, and that the contents of the email have not been changed since it was sent.

Is It Best for Me?

Determining if an email security solution is the best fit for a given organization requires a thoughtful review of many factors:

  • Do you need to send sensitive information via email?
  • What types of regulations do you need to meet? (For instance, HIPAA, FIPPA, PCI regulations regarding the transmission of sensitive information)
  • Has your organization been victim to email spoofing or other phishing threats?
  • How does the solution authenticate the email sender?
  • Does the solution ensure the contents of emails are not altered after they’re sent?
  • What is the implementation process like? Will there be a burden on IT?
  • Will this solution be easy for you and other end users to adopt?
  • What email clients do you need to support?

With hacks, breaches and information theft rampant on corporate networks today, any approach that promises to lessen the likelihood of information loss—with minimal if any impact on end user ease and workday efficiency—is an important step toward controlling those digital assets within the corporate perimeter.

This article originally appeared in the May 2015 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Survey: Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

  • Mobile Applications Are Empowering Security Personnel

    From real-time surveillance and access control management to remote monitoring and communications, a new generation of mobile applications is empowering security personnel to protect people and places. Mobile applications for physical security systems are emerging as indispensable tools to enhance safety. They also offer many features that are reshaping how modern security professionals approach their work. Read Now

Featured Cybersecurity

Webinars

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3