How does unauthorized data leave your agency?
Nov 01, 2012
According to a recent survey of government security and IT managers, work e-mail is the most significant channel for data leakage in an agency, but accepted best practices for securing e-mail can make it harder to stop those leaks. Desktop-to-desktop encryption makes it more difficult for bad guys to snoop e-mail traffic, but it also can make it more difficult for agencies to keep an eye on what is being sent out of the enterprise.
“There is a trade-off between the best practice of encryption and the lack of transparency in protecting against data loss,” said Mike Dayton, senior vice president for security solutions at Axway.
That does not mean point-to-point encryption is bad. “Yes, you should have it. It’s still a best practice,” he said. But IT managers need to think about how it is used and make provisions for examining it as it leaves the network.
The survey was conducted by MeriTalk and underwritten by Axway, a company that provides e-mail security systems (including one that allows agencies to decrypt outgoing e-mail at the gateway). MeriTalk conducted the survey online, obtaining responses from 203 government officials, and claims a margin of error of plus or minus 6.84 percent at a 95 percent confidence level.
The trade-offs of encrypting e-mail are not new. The National Institute of Standards and Technology noted them in its Guidelines on Electronic Mail Security. “Although encrypting e-mail provides additional security, it does come at a cost, so organizations should carefully weigh the issues associated with encrypting e-mail messages,” the guidelines note. Still, “for many organizations the benefits of e-mail encryption and signatures will outweigh the costs.”
Issues for encrypting e-mail cited in the publication include:
Scanning for malware and filtering e-mail content at the firewall and mail server is significantly more complicated. If the firewall or mail server does not have a method for decrypting the e-mail, it cannot read and act upon the contents. Not all e-mail scanners can decrypt e-mail, and decryption schemes can be complex and hard to enforce.
Encryption and decryption require processor time. Organizations might need to upgrade or replace equipment to support the load of encryption and decryption.
Organizationwide use of encryption can require significant administrative overhead for key management.
E-mail encryption can complicate the review of e-mail messages for investigative purposes.
Encrypted e-mails to or from other organizations could be poorly protected if those organizations do not support the use of strong encryption. Mail applications should notify users when receiving a weakly encrypted message or when they are attempting to send a message to a recipient that only supports weak encryption.