Passwords on attachments

[enjay]

An organisation who really should know better have asked us to stop using passwords on confidential attachments, which we started doing when they claimed to be unable to read our secure emails. My colleague has pushed back saying this is school policy due to GDPR, and the organisation has replied saying "you don't need to, our email system is secure".

 

I mainly wanted to just vent about this, but if anyone knows a good site which explains why email isn't secure or attachments should be encrypted, I'll take it as it would save me a Google...

[DGardiner]

An organisation who really should know better have asked us to stop using passwords on confidential attachments, which we started doing when they claimed to be unable to read our secure emails. My colleague has pushed back saying this is school policy due to GDPR, and the organisation has replied saying "you don't need to, our email system is secure".

 

I mainly wanted to just vent about this, but if anyone knows a good site which explains why email isn't secure or attachments should be encrypted, I'll take it as it would save me a Google...

 

We have had the same for years, one LA used 7zip to password files and we did that fine, others wouldnt. We bought egress and now some refuse to use that

[mavhc]

In what way is email not secure?

[LukeRowberry]

In what way is email not secure?

 

[synaesthesia]

It's as secure as the fleshy bits either end. This isn't about making it more secure, it's risk management against the meatbags doing silly things - wrong email recipients for example.

[PotNoodleTech]

If it's Gov network > Gov network then it's fully encrypted. So that should cover LA, Police, NHS.

 

Police round here have a new system the last couple of years that does encrypted uploads of files - used it lots for CCTV footage etc it's much more secure than using email.

 

If it's an exam board or something seperate then yeh but bare in mind putting passwords on word docs or zip files isnt really very secure nowadays as most modern PCs are powerful enough to brute force those.

 

Better off encrypting the entire email chain point to point either built in tools or third party like Egress.

 

Even better - just don't send them the data file at all, either insist that they put it on a secure online system (like the police hve now done) or use your own sharepoint etc and share it with them that wasy you can control editing/downloads etc.

[jthompson]

Eurgh. Egress... hate it with a passion.

 

RE: attachments, if the receiving org has their email systems set up nicely and are using MTA-STS, then they will only accept incoming mail transfers that are secured with TLS. If I understand it corrently, then that would mean that emails are ensured to be safely encryted in transit to them.

 

The risk then of a non password-protected attachment is that it just sits in somebody's mailbox indefinitely (including yours), or sits in their downloads folder indefinitely, but then there's a risk of hat anyway even if you sent it to them password-protected.

 

You can send CCTV clips or whatever to the police by sharing it from Google Drive and then unsharing it after they've downloaded it. Problem solved!

[jmak]

 

Even better - just don't send them the data file at all, either insist that they put it on a secure online system (like the police hve now done) or use your own sharepoint etc and share it with them that wasy you can control editing/downloads etc.

 

 

^^This. Every time. This

[enjay]

In what way is email not secure?

 

In a not encrypted in transit so could theoretically be intercepted kind of way.

[enjay]

If it's Gov network > Gov network then it's fully encrypted. So that should cover LA, Police, NHS.

 

It's a school with M365 > Gov, so possibly secured all the way but would we want to rely on that?

[enjay]

Better off encrypting the entire email chain point to point either built in tools or third party like Egress.

 

That was our first method. They said they couldn't read them, and their IT support said it was our issue because the secure email is within our SharePoint (!).

 

Even better - just don't send them the data file at all, either insist that they put it on a secure online system (like the police hve now done) or use your own sharepoint etc and share it with them that wasy you can control editing/downloads etc.

 

That's going to be my next suggestion, or tell them to remove the password at their end if they don't like it - there's no reason to keep it separately encrypted on their secure network.

[jthompson]

It's a school with M365 > Gov, so possibly secured all the way but would we want to rely on that?

 

You could use https://mxtoolbox.com/mta-sts.aspx to check whether the recipient domain has an MTA-STS policy, and more importantly, whether it's a policy that's in enforce mode.

[mavhc]

In a not encrypted in transit so could theoretically be intercepted kind of way.

 

All my email is encrypted in transit, why isn't yours?

[enjay]

All my email is encrypted in transit, why isn't yours?

 

Okay, maybe I'm mistaken. How would I check?

[msi_school]

That was our first method. They said they couldn't read them, and their IT support said it was our issue because the secure email is within our SharePoint (!).

 

How is it when ever I tell a user the issue is not at our end they don't believe me but some IT departments can get away with saying this?

[mavhc]

Okay, maybe I'm mistaken. How would I check?

 

Check TLS settings, I set M365 to not send email to servers that don't do TLS, thus all my emails are encrypted in transit.

 

If you're wanting to encrypt your email attachment in addition to TLS how are you sending the password? if it's by email that's pointless, so anything that lets the user login without a password you gave them is worthless, anyone you can steal the email can steal the password. It's only worth bothering about if you phone or post a password

[jthompson]

With Gmail you can send a password in a confidential mode email with a short expiry. That limits the potential exposure of the password.

 

But essentially, password protecting file attachments is not as essential as it may seem.

[enjay]

If you're wanting to encrypt your email attachment in addition to TLS how are you sending the password? if it's by email that's pointless, so anything that lets the user login without a password you gave them is worthless, anyone you can steal the email can steal the password. It's only worth bothering about if you phone or post a password

 

I've given up trying to explain this to people, it hurts too much. I've even see a document where the password was included in the filename! In this instance, it is an agreed password which is put on all the documents we send them.

[mavhc]

I've given up trying to explain this to people, it hurts too much. I've even see a document where the password was included in the filename! In this instance, it is an agreed password which is put on all the documents we send them.

 

It's as if people don't give a crap about security if it makes their job 1 iota more difficult. On the plus side, many more years of employment for us

[NegativeKillDeath]

Check TLS settings, I set M365 to not send email to servers that don't do TLS, thus all my emails are encrypted in transit.

 

If you're wanting to encrypt your email attachment in addition to TLS how are you sending the password? if it's by email that's pointless, so anything that lets the user login without a password you gave them is worthless, anyone you can steal the email can steal the password. It's only worth bothering about if you phone or post a password

 

Do you have much trouble with emails not being sent because the other end wont accept TLS connections?

[mavhc]

https://admin.exchange.microsoft.com/#/reports/outboundsecurity says no problems