Securing Your Bank

Securing Your Bank's Email with 4-Layer Protection

Securing Your Bank's Email with 4-Layer ProtectionImagine getting an urgent phone call from one of your bank employees or contractors, apologizing for the fact that they had just accidentally sent an email with a customer’s confidential account information to a random email address. Or worse, what if the phone call came from the random person who received and opened the email…both cases have very bad implications and pose a massive breach of privacy.

Well, according to Reuters, this actually happened on June 23rd 2014, when a contractor at Goldman Sachs sent an email containing confidential client data to a stranger's Gmail account by mistake.

This is by no means the first time such a mistake happened, it occurred also in the past with other banks, such as Rocky Mountain Bank in Wyoming, where according to various news reports and the court filing, a customer of Rocky Mountain Bank in Wyoming asked a bank employee to email loan statements to a third-party representative. Unfortunately, the bank employee sent the information to the wrong Gmail address. To make matters worse, the data file attached to the erroneously-sent email contained confidential information on 1,325 accounts of other customers. The file included names, addresses, tax identification numbers, and loan information.

While the above cases did not end up costing the bank money, in other cases, sending a wrong email may indeed inflict penalties and fines on the bank or even loss of revenue which can reach millions of dollars.

There are four main reasons why situations as described above may happen:

  • Entering the wrong email address – The bank’s email sender is not required to choose from a closed list of email addresses, and is allowed to enter manual email addresses. In addition, there is no validation of the email recipient. This means, the sender might accidently enter a wrong email address (as per the stories above), or even incidentally send an email to a forbidden recipient.
  • Outgoing emails are not scanned for sensitive data leakage - The content of the emails sent by the bank are not scanned to ensure sensitive information is not emailed (leaked out of the organization). This means email senders can add any information they wish into emails, including sensitive information and there is no system in place to prevent such information from leaving the organization.
  • Emails are unprotected - The email sent by the bank is sent unprotected, allowing the recipient to open the email without requiring any authentication and/or password. If a wrong recipient receives an email, there is no safe guard preventing them access to the information and attachment within the email.
  • Email content is unencrypted - The attachment and content of emails sent by the bank is sent unencrypted, allowing any recipient to not only open the email but also read the content. This is the last line of defense in terms of emails; and in many cases, organizations do not implement it in order to simplify the process of sending the email and the lack of willingness to manage encryption keys.

Banks who are aware of the above reasons for sending email to wrong recipients are looking today for solutions to prevent such grave mistakes from occurring, while maintaining their employees and contractors email sending routines and methods.

Such organizations should deploy a secure email solution which consists of multiple layers of defense which together provide multiple fail-safe points along the process of sending an email to bank’s customers and business partners. These layers should include the following:

  • 1st Layer: should ensure the secured email is only sent to an email address available within the bank’s CRM, thus, preventing the situation of sending the email to a recipient who is unknown to the financial organization. In case the bank does wish to allow entering email addresses manually, it should ensure it implements the additional layers with even higher importance.
  • 2nd Layer: should allow scanning the content of sent emails using a DLP (Data Loss Prevention) system to ensure sensitive data is not sent.
  • 3rd Layer: store the encrypted package within the bank’s network and send the recipient a link to download the package, rather than the email itself, as it happened in the cases mentioned above. In addition, a one-time password or username and password is then needed in order to access the email within the server. This layer of protection offers 2 factor authentication, and prevents un-allowed access to the content.
  • 4th Layer: should allow to automatically encrypt the entire content of the email, including the email’s body and attachment. Thus preventing the situation of sending an email to a wrong recipient and them opening the email and reading the content.

Deploying such a solution will allow bank employees and contractors to send encrypted emails securely to customers and business partners, without disrupting their normal email routines, and does not require the recipient to install software or exchange keys.

About the Author

Eitan Bremler is director product marketing and product management at Safe-T.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.