What to Look for in a Secure Email Provider

How secure is your email? The reality is email remains one of the top targets for cyber criminals. Almost 9 out of 10 cyber-attacks begin with a phishing email. If your email isn’t secure, then the sensitive content sent via email is at risk.

What is a secure email? Secure email providers stop outsiders from intercepting your messages in transit or at rest; this is done through end-to-end encryption.

Is Email Inherently Secure?

The short answer is no.

Email is one of the oldest forms of digital communication available. Its popularity is its ubiquity; it’s relatively easy to send lengthy emails with attached files to nearly everyone in the world. Email addresses are more common than physical ones, and almost everyone uses email as a combination communication and storage tool.

Email is also an open protocol, meaning that it is commonly implemented on systems across the world to send plain-text messages and files. A server requires credentials (usernames and passwords) to allow users to access accounts, but the actual messages aren’t secured in practice.

What are some of the potential pitfalls and challenges related to implementing email securely?

• Unencrypted data: Email, without additional security, does not provide protection for the content sent over the protocol or stored in servers. Steps can be taken to protect such data, but with the ubiquity of email, it’s hard to coordinate encryption.
   

  For example, the most common form of encryption for data in transit is Transport Layer Security, and it is implemented in most providers. That means that information in transit is encrypted. However, once that information reaches a destination, that isn’t the case. End-to-end email encryption isn’t standard for most email providers, meaning that the potential for unauthorized disclosure at either end of the email exchange is high.

• Man-in-the-middle attacks: Hackers can, with the right tactics, step between servers and users and intercept information moving between senders and recipients, often without either party knowing. This means that attackers can read all unencrypted data and circumvent other encryption standards by tricking users into providing encryption keys or other information.
• Authorization attacks: Email accounts are often secured using standard identity and access management (IAM) measures. Compromised usernames and passwords can open email accounts to breaches. Hackers can then use these accounts to reset passwords or bypass multi-factor authentication used in other services.

Due to the above reasons and the fact that email remains a primary target of cyber criminals and nation-state actors, most compliance frameworks and regulations restrict the use of general-purpose email for communicating any sensitive information.

What Makes Email Secure?

There are several ways to secure email to protect sensitive content:

• End-to-end encryption: As previously mentioned, most providers offer some form of TLS encryption for sending emails. However, major providers like Microsoft and Google don’t provide encryption as emails travel throughout their systems without special configurations, and it’s much too difficult to coordinate end-to-end encryption across multiple providers.
   

  Additionally, encryption on servers is notoriously difficult to implement. End-to-end encryption calls for a method, like public key cryptography, to encode emails before they’re sent and upon their receipt. But using such a method requires that both users deploy the same type of encryption.

  New solutions in email security are changing this—Kiteworks’ acquisition of totemo moves the platform to an end-to-end encryption standard that can work across various third parties, seamlessly without involving the user in any way. This changes the typical requirement that end-to-end encryption solutions are viable so long as those emails stay within the same system.

• Authentication and MFA: Email accounts should include authentication tools to verify user identity throughout multiple avenues. Password hacks and phishing attacks are very common, and MFA solutions that combine passwords with biometrics or token-based verification using mobile devices can protect accounts.
• Privacy agreements: Providers like Google admit to sharing access to emails for advertising and service purposes—a clear violation of privacy. A provider must provide data privacy controls, including agreements not to share data or email PII. Additionally, privacy agreements must follow local privacy jurisdictions—which means that messages on servers in countries with certain laws can face mandatory data disclosures or seizure by government agencies.
• Secure email links: While encryption is a tricky subject, a provider or similar platform can bypass encryption adoption by using secure links. A provider allows the user to send a link to a resource on a secure server equipped with encryption and IAM controls. The receiver must have an account with that server, ensuring that any private data accessed is protected, private, and monitored with logging tools.

Secure, Compliant Email for Most Regulations With Kiteworks

While secure email is a must-have technology for most organizations, few solutions deliver a comprehensive communications approach that includes secure email, file sharing, file transfer, managed file transfer, web forms, and application programming interfaces (APIs) in one single pane of glass. This centralized view of metadata is critical for organizations seeking to unify tracking, control, and security of confidential data that is sent, shared, or transferred into, within, and out of their organization.

The following secure email capabilities of the Kiteworks platform are important, delivering email compliance across industries and national jurisdictions:

• Security: Kiteworks utilizes AES-256 encryption for data at rest and TLS 1.2+ for data in transit. Additionally, Kiteworks uses network and web application firewall and anti-malware technologies to protect the Kiteworks platform from malicious cyber-attacks.
  
• Compliance: The Kiteworks platform supports compliance efforts for HIPAA, GDPR, FedRAMP, CMMC, PCI DSS, IRAP, and several other frameworks under the National Institute of Standards and Technology (NIST) and the International Organization for Standardization. Its hardened virtual appliance, granular controls, authentication, comprehensive logging and audit, and other security stack integrations enable organizations to achieve email compliance efficiently.
• Audit logging: With the Kiteworks platform’s immutable audit logs, organizations can trust that they can detect attacks sooner and that they are maintaining the correct chain of evidence to perform forensics. Since the system merges and standardizes entries from all the components, Kiteworks unified Syslog and alerts save SOC teams crucial time and help compliance teams prepare for audits.
• Consent documentation: With many frameworks like GDPR calling for documented consent for the collection of data and any data subject access request, organizations need a platform to automate that process. The Kiteworks platform provides extensive reporting and logging of all consent forms and data requests, enabling organizations to generate reports that demonstrate email compliance.
• Single-tenant cloud environment: File transfers, file storage, and emails will occur on a dedicated Kiteworks instance, deployed on-premises, on Logging-as-a-Service resources, or hosted as a private single-tenant instance. That means no shared runtime, shared databases or repositories, shared resources, or potential for cross-cloud breaches or attacks—which also means no potential for email communications to inexplicably end up in the hands of unauthorized users.
• Visibility and management: Kiteworks’ CISO Dashboard gives organizations an overview of their information: where it is, who is accessing it, how it is being used, and if it complies. This capability, in turn, allows organizations to secure email servers with a bird’s-eye view of the system.

If you’re ready for a secure email solution that also includes compliant infrastructure and enterprise-grade capabilities, sign up for a free Kiteworks demo.

Additional Resources

• Webinar How Automated Email Encryption Delivers Improved Privacy Protection and Compliance
• Blog Post What Email Security Is Needed for CMMC Compliance
• Brief How to Optimize Email Governance, Compliance, and Content Protection
• ArticleSecurity Risk Management [Information Risk & Assessment] –
• Blog PostMost Secure File Sharing Options for Enterprise & Compliance