The encryption trend is still quite strong – and no wonder, when cyber-attacks are in the headlines practically every day. Legislators have also jumped on the bandwagon and include requirements for the encryption of important data in an increasing number of directives and regulations. In the EU level there’s the GDPR, in addition to further recommendations by the security authorities in the various countries.
Unencrypted emails provide criminals with a broad field of attack, as messages are often routed via multiple servers across different countries. Attackers can position themselves on one of these paths and intercept or read the unencrypted text.
This is also why companies sometimes choose encrypted data transmission to share confidential information with external business partners. A number of different techniques are available, including traditional email encryption. However, this is associated with a number of disadvantages for people’s everyday work.
Complicated key sharing process
Sharing encryption keys is complicated and takes time. The most common techniques include OpenPGP and s/MIME. A pair of keys and a password are initially created for the email account in question. Along with the private keys, there’s also a public key that’s stored on a server. This method is based on an asymmetrical encryption procedure, which requires email recipients to create a pair of keys as well and to upload a public key.
In this way, users exchange separate keys with each of the external people they’re emailing. This requires a certain level of knowledge on the part of employees – and this isn’t always a given with non-technical staff unfamiliar with encryption. And because of the effort involved, the procedure isn’t really suitable for people just sending a few emails.
Emails are not tamper-proof
There’s another weak point to OpenPGP und s/MIME. Although they encrypt the actual data transmission and attachments, they don’t track what happens to the documents after the mail is delivered. These techniques don’t offer any levels of security – whoever is on the recipient list gets the original document and can keep it for ever. They can forward it – naturally unencrypted – to third parties and store it on non-secure media. And the email message itself is visible in plain text on the server. As such, these methods don’t meet the usual compliance requirements for the protection of confidential information, as these are based on full control as well as tamper-proof logging every time a document is accessed.
Security risk: EFAIL exploits flaw in vulnerable email clients
The result of these risks has been seen recently in shock headlines saying that neither s/MIME nor OpenPGP can fully guarantee the security of messages that are encrypted in transmission. The new security flaw, EFAIL, allows attackers to intercept a mail during transmission and manipulate it using a “man in the middle” technique. Hackers make the recipient’s email program send the message to them in plain text. The non-secure element is not the encryption – instead, the attackers use an unencrypted part of the mail, or an encrypted part that they are familiar with, to send the command to the browser.
According to Ars Technica, most common mail programs’ plug-ins are affected by the security flaw, including Thunderbird, Mail (macOS) and Outlook. These encrypt emails automatically, but not at every stage of the mail’s transmission. This incident shows that secure encryption alone doesn’t make the whole system secure. Systems are only ever as strong as their weakest link, which in this case is the email program.
Alternatives to email encryption provide comprehensive protection
For the reasons outlined above, your company shouldn’t send sensitive documents by email if confidentiality is important to you. Instead, you can store them on a platform designed for secure document sharing – it works in a similar way to a safe. The platform has comprehensive protection mechanisms for confidential documents, including watermarks and Information Rights Management technologies, which guarantee file integrity. That facilitates collaboration while ensuring you have control over the file. In addition, all document changes are logged in a tamper-proof audit trail.
This “all-inclusive security” approach lets you share information safely and securely, while evolving with the latest regulatory requirements and state-of-the-art technologies – like those used in Brainloop services.
Confirmed in practice
This was exactly the reason Credit Suisse recently decided to implement Brainloop instead of email encryption. Read more about it in this success story.
Written by Stefan Krenn
Collaboration, Information Security
This could also be of interest:
On cloud 9? How we see data storage today
The key ingredients in secure collaboration software
Cryptic messages: an ABC of encryption
