Email Encryption

[Badaz52]

Hi all,

 

Does anyone have any suggestions or recommendations for a good email encryption software that will comply with GDPR. We use Exchange 2013 so it would need to work with that.

 

Cheers!

[djrscally]

Hi all,

 

Does anyone have any suggestions or recommendations for a good email encryption software that will comply with GDPR. We use Exchange 2013 so it would need to work with that.

 

Cheers!

 

Egress have a tool that integrates with Outlook and Exchange 2013 I think.

[Meldrew]

Egress have a tool that integrates with Outlook and Exchange 2013 I think.

 

It does, but I don't consider it suitable. Although it does encrypt the contents of an email body and attachments, it still leaves the possibility of a data breach if the user accidentally enters the wrong email address. The reason being that all any recipient of an encrypted email needs to do is sign up for a free Egress account in order to get access to the encrypted contents. I think this leaves users in a false sense of security that they are being protected.

 

Meldrew

[Dom_]

It does, but I don't consider it suitable. Although it does encrypt the contents of an email body and attachments, it still leaves the possibility of a data breach if the user accidentally enters the wrong email address. The reason being that all any recipient of an encrypted email needs to do is sign up for a free Egress account in order to get access to the encrypted contents. I think this leaves users in a false sense of security that they are being protected.

 

Meldrew

 

That would be the same with most encryption solutions though... you're encrypting to prevent anyone intercepting the mail. Using the wrong address is a different issue altogether (and the only real way around that would be some kind of classifier like this - https://www.itgovernance.co.uk/data-classification-software)

[mavhc]

What are you trying to prevent happening?

a) people tapping the line and getting unencrypted data? Tunnel encryption, TLS, everyone should do this as standard now, just need to make sure a downgrade attack into possible

b) people emailing to a server that's been compromised? At rest encryption, which no one uses because webmail

c) people emailing to the wrong people? Encrypt the message with their private key (doesn't work if it's automatic, unless you only have private keys of specific people, or put them in groups, can only email X to a user if their key is in group Y), or a shared key you send via a different method (which is normally ignored, they email you the key also, so a waste of everyone's time and money)

d) people emailing the wrong stuff? Content analysis on your server before it's sent

[mjk]

S/MIME on Google Suite:

 

https://blog.google/topics/education/tools-every-school-g-suite-education-updates/

[Meldrew]

That would be the same with most encryption solutions though... you're encrypting to prevent anyone intercepting the mail. Using the wrong address is a different issue altogether (and the only real way around that would be some kind of classifier like this - https://www.itgovernance.co.uk/data-classification-software)

 

Agreed. The (free) solution we're going with is: user encrypts attachment with password (easy if Office document), email to recipient, telephone password to recipient.

 

Meldrew

[djrscally]

Agreed. The (free) solution we're going with is: user encrypts attachment with password (easy if Office document), email to recipient, telephone password to recipient.

 

Meldrew

 

This is good for sending batches of files and stuff but when it's a long spanning email conversation I think this probably becomes inconvenient enough that people might lean towards not bothering. Ideally it needs to be as transparent as possible. Egress kinda try to ameliorate the problem by letting you revoke emails after they've sent, as well as see if they've been accessed or not.

 

It is a trade off, no method is perfect sadly. As mentioned, S/MIME (or PGP) is kind of the best transparent method, but with the generally low level of technical knowledge in schools it's unlikely to work seamlessly for our staff I think.

 

EDIT: Well, actually when they're integrated I suppose it just picks the key based on the recipient, so probably it's no different actually.

[enjay]

This is good for sending batches of files and stuff but when it's a long spanning email conversation I think this probably becomes inconvenient enough that people might lean towards not bothering. Ideally it needs to be as transparent as possible. Egress kinda try to ameliorate the problem by letting you revoke emails after they've sent, as well as see if they've been accessed or not.

 

Agreed. Sensitive data doesn't only reside in attachments. A CSV attachment could contain lots of data, or more typically, a small amount of data on a lot of people, but that is often relatively low-level stuff (names, email address, summary grades), whereas an email exchange about a particular student could contain far more sensitive information about that individual.

 

Also, whatever solution you put in place needs to be easy to use, both from the viewpoint of the sender and the recipient (considering recipients outside your organisation, for whom the added steps of Egress or whatever might be frustrating).

 

Also also, education is the key not technical measures. People need to understand why you're insisting on these extra steps and need to be encouraged to think before they send. If, for example, you ban attachments (and possibly even force use of encrypted memory sticks), people will paste the data into the message body instead. If you restrict some functionality so it is in-school only, people will email things to personal addresses to carry one work at home.

[Sheridan]

We use Egress Switch for a limited number of user who have to have this facility but the SMIME option in G Suite looks interesting, no idea when it will be available as yet though?

[Domino]

Yeah, you need to consider some kind of DLP policy *as well*

 

Regarding data sharing - We've started using Citrix Sharefile here and so far it seems pretty good. Integrates well, easy to use. Although it's pretty pricey, I dunno if they have edu pricing.

[mavhc]

Currently most people are at the level of TLS, next step is DKIM signing for authentication, and DMAC, to make sure it's checked.

 

GSuite or Office365 S/MIME is the final stage, per user encryption, but you have to have certs for everyone, upload them via an api, and email everyone first, to ensure they have your public key. However once all that's done, should be fine. Google only has S/MIME for enterprise currently, not education. Office365's education version is their enterprise version.

 

Please don't use those terrible encryption email websites though, everyone hates those

[djrscally]

Please don't use those terrible encryption email websites though, everyone hates those

 

Do you mean Egress/GalaxyKey etc? The problem is we live in a world where hardly anyone is set up to receive S/MIME (or PGP, or whatever), so those options are not effective. If people can't immediately send an encrypted email, then they probably just won't bother.

[enjay]

Do you mean Egress/GalaxyKey etc? The problem is we live in a world where hardly anyone is set up to receive S/MIME (or PGP, or whatever), so those options are not effective. If people can't immediately send an encrypted email, then they probably just won't bother.

 

True, but Egress is a faff unless you have it embedded in your Exchange. I'm sure it works nicely within a company, but can be tedious otherwise. As an example, our County Council use it and send encrypted emails to us; these emails can't be forwarded on within the school because only the original recipient can view it - what therefore happens is the original recipient copies the text and pastes it into a school email (fully encrypted as we use Google Mail).

[mavhc]

Yeah, would be helpful if google/ms just did it for everyone, then let admins change the certs if they really wanted to.

 

But the question remains, what problem are we trying to solve?

[enjay]

But the question remains, what problem are we trying to solve?

 

If you're using Outlook with messages saving to a local .PST file on your laptop, I think that's reasonably clear. If you're using HTTPS webmail or accessing via mobile apps, I'm less clear...

[djrscally]

Interception. Emails bounce around all over the place; natively they try and stick to a secure TLS tunnel, but if the next hop doesn't support that they go "Ah **** it" and send the email in the clear, meaning whoever runs that particular hop gets to read your emails. The famous example being Hillary Clinton's server, where they let the TLS certificate expire and so everything was sent to it in the clear.

 

Whether anyone actually does intercept them, I have no idea.

Edited February 1, 2018 by djrscally

[mavhc]

Bitlocker for local drives.

 

For forcing TLS https://support.google.com/a/answer/2520500?hl=en

 

and https://support.office.com/en-us/article/How-Exchange-Online-uses-TLS-to-secure-email-connections-in-Office-365-4cde0cda-3430-4dc0-b489-f2c0736c929f

Edited February 1, 2018 by mavhc

[Edu-IT]

I use Egress with our LA and wouldn’t say it is particularly faffy. The web view works a treat.

[enjay]

I use Egress with our LA and wouldn’t say it is particularly faffy. The web view works a treat.

 

Like I said, the main faff is when the recipient of the email isn't the person who can actually deal with it.

[mavhc]

So, what steps does one need to do to generate S/MIME certs for everyone in your school, and upload them to O365 and/or GSuite Enterprise? Has to be automatic, can't ask staff to be requesting certs and uploading them.

[mavhc]

And another question, in Office365 and GSuite, how can we found out stats about how many emails are using TLS today, to know whether to just force it on?

[djrscally]

Not sure about checking whether emails were sent via TLS or not.For the S/MIME question; I doubt whether it's worth going down this route. The problem it is the recipient who needs to have a certificate in order to send an encrypted email to them, and there's fairly scant chance of getting them to set one up (assuming they're outside your organisation. If they're inside your organisation you're probably already covered by TLS and encryption at rest on the servers anyway)

[Arthur]

So, what steps does one need to do to generate S/MIME certs for everyone in your school

https://github.com/taers232c/GAMADV-X/wiki/Users---Gmail---S-MIME?

[mavhc]

https://github.com/taers232c/GAMADV-X/wiki/Users---Gmail---S-MIME?

 

That's how to upload them, but how to make them in the first place, something something powershell something certmgr I guess