An Elephant in the Living Room
Don’t forget to lock the obvious front door to your network
- By Julie Olenski
- May 01, 2015
Security managers are more aware than
ever that information security requires a
layered approach with components addressing
every point of intrusion on the corporate
network. Yet with an estimated 196
billion emails to be sent daily worldwide in
2015 and email continuing to dominate internal network
traffic at most organizations, a network security plan that
fails to address the risks posed by email is like leaving the
front door unlocked.
Data loss or breach is arguably the largest risk of email communication.
The concern is just as great among unregulated industries
as it is in sectors where privacy is of heightened concern
such as in financial services and healthcare. Here are a few facts
that illustrate the urgency:
- 53 percent of employees have received unencrypted, risky corporate
data via emails or email attachments.
- 21 percent of employees report sending sensitive information
without encryption.
The costs of data loss are staggering, not to mention the
damage it does to a company’s reputation (who can forget the
contents of those Sony emails?) and any legal repercussions for
violating regulations regarding the transmission and storage of
sensitive information such as, HIPAA, FIPPA or PCI.
- 22 percent of companies experience data loss through email
each year.
- The average corporate data breach costs $3.5 million.
A growing threat to corporate email users is phishing. Sending
emails from a forged sender address, called spoofing, is one
way of carrying out a phishing attack, with the goal of tricking
the unsuspecting recipient into downloading malware or entering
confidential information into a fake web site where it is accessible
to the hacker. Though it’s often viewed as a consumer problem—
it seems every week there’s a new attack targeting customers of
retail sites or online services—hackers have started to set their
sights on corporate users by impersonating the company and targeting
employees.
- An estimated 1 out of 392 emails is part of a phishing attack.
- 300 percent growth in phishing emails in the past year.
- 33 percent of Fortune 500 executives fall for phishing bait.
Digitally Signed and Encrypted Email:
Network Defenses
Not surprisingly 35 percent of organizations now use encrypted
email, up from 29 percent according to a Ponemon Institute report.
As of this February, Google reported that 78 percent of
outbound Gmail messages are encrypted.
The most common approaches to email encryption are based
on public key cryptography. Google uses TLS, the same technology
that secures your connection to websites (as indicated by the
https and padlock in the address bar). For desktop email clients
(e.g., Microsoft Outlook, Apple Mail, Thunderbird), which are
often more common in corporate environments, S/MIME is the
most popular option.
S/MIME, or Secure/Multipurpose Internet Mail Extensions,
is the industry standard for public key encryption for MIMEbased
(message-based) data. S/MIME offers two key email security
functions:
- Digital Signature
- Encryption
To digitally sign and encrypt emails, you will need an S/MIME
digital certificate. A digital certificate is a virtual passport; a way
of proving your identity in online transactions. Just as a local
government needs to verify an identity before issuing a passport,
a third party verification entity known as a Certificate Authority
(CA) needs to vet an individual before issuing a digital certificate.
Since the certificate is unique to the individual, using it to sign an
email is a way to prove, “yes, it’s really me sending this email.”
Digitally Signed Emails Mitigate Phishing
Digitally signing your emails is a way to assure recipients that
the email is legitimate and actually came from you. You can see
how this mitigates the corporate phishing risks discussed above.
If your company standardizes on digitally signing all email communication,
any spoofed emails from phishers will immediately
raise a red flag since they aren’t signed.
Encrypted Emails Prevent Sensitive Data from Falling into the Wrong Hands
Encrypting an email ensures only the intended recipient can access
the contents. This is because the encryption process requires
information from your recipient’s digital certificate. Unless someone
has access to the certificate (and only the individual should
have access), he won’t be able to read the contents of the email.
One erroneous perception is that digital signatures and encryption
add time. In fact, digitally signing an email is as simple
as clicking a button, with many email clients enabling the user to
set digital signatures as a default on all outgoing messages.
A Red-Ribbon Badge of Authenticity
Digitally signed and encrypted emails literally wear an emblem
of their added security. In Microsoft Outlook, a red ribbon indicates
that the email was digitally signed and the identity of the
signer is listed under the subject line. Encrypted emails display
a padlock.
Clicking on the red ribbon or padlock verifies the identity
of the sender and offers more details about the signature. These
clear trust indicators mean the recipient of the email can instantly
see that the email was digitally signed or encrypted, by whom,
and know that the email actually came from the correct person,
has not been forged, and that the contents of the email have not
been changed since it was sent.
Is It Best for Me?
Determining if an email security solution is the best fit for a given
organization requires a thoughtful review of many factors:
- Do you need to send sensitive information via email?
- What types of regulations do you need to meet? (For instance,
HIPAA, FIPPA, PCI regulations regarding the transmission
of sensitive information)
- Has your organization been victim to email spoofing or other
phishing threats?
- How does the solution authenticate the email sender?
- Does the solution ensure the contents of emails are not altered
after they’re sent?
- What is the implementation process like? Will there be a burden
on IT?
- Will this solution be easy for you and other end users to adopt?
- What email clients do you need to support?
With hacks, breaches and information theft rampant on corporate
networks today, any approach that promises to lessen the
likelihood of information loss—with minimal if any impact on
end user ease and workday efficiency—is an important step toward
controlling those digital assets within the corporate perimeter.
This article originally appeared in the May 2015 issue of Security Today.