Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Ask Slashdot: What Is the Best Email Encryption Gateway For a Small Business?

Soulskill posted about a year ago | from the randomize-all-outbound-communications dept.

Businesses 155

Attila Dimedici writes "I am in the process of implementing an Email Encryption Gateway for my company. I checked with my various contacts in the industry and came away with Voltage as the best solution. However, as I have been working with them to implement a solution, I have been sadly disappointed by their lack of professionalism. Every time I think I am one question away from being ready to pull the trigger, I discover something that my contact with them had not mentioned before that has to be ironed out by the various stakeholders on my end. So, my question for Slashdot readers is this: what is your experience with implementing an Email Encryption Gateway for your company and what solution would you recommend?"

cancel ×

155 comments

Outlook.com (5, Funny)

tretre (2920363) | about a year ago | (#43688003)

Outlook.com offers great features [microsoft.com] , is fully encrypted and offers everything a small (or larger) business needs. I can truly say how happy I am with their service. It also works great with your existing Microsoft stack.

Re:Outlook.com (1)

Anonymous Coward | about a year ago | (#43688125)

I feel dumb, but what is wrong with just Exchange? It can do the ActiveSync policies (passwords, demand encryption, secure erase.) What does a third party product like Good or BES give us except for more management headaches and more money slurped off for licensing fees?

Re:Outlook.com (5, Informative)

RobbieCrash (834439) | about a year ago | (#43688199)

BES offers a shitload of benefits if you want to use them. Blocking things like the camera or SMS, limiting WiFi connectivity, security configuration, password requirements, etc, on company owned and paid for phones is a requirement for many large enterprises. Additionally, ActiveSync isn't as feature complete with syncing in most cases (Android doesn't do tasks or notes for example), while BES provides complete bi-directional sync between BlackBerrys and Exchange. Remote software management, an always on administrator controlled VPN connection is another benefit.

We had issues with our Exchange server's gateway and it wasn't able to get to the internet, however the tunnel to our location that had BES was up and it had internet connectivity, so our BBs were receiving email communicating what was going on and who was doing what. Sure we could've done that with personal email or with BBM/GTalk, but this way we didn't need to.

BES is a pain in the ass when you don't need any of the above and all you're doing is syncing email, calendar and contacts. But those are all critical features in many places.

Re:Outlook.com (1)

Anonymous Coward | about a year ago | (#43688853)

You have got to be kidding. BES is the biggest turd of an application I've ever worked with in my life. It is slow, bloated, stops working randomly on both the client and server side and is a total security nightmare. You seriously suggest using a program that insists on having read and impersonate access to all of your mailboxes with your encryption? Yikes!

Re:Outlook.com (1)

Anonymous Coward | about a year ago | (#43689749)

Not only that, but BB10 devices support activesync if that's your cup of tea, and bb mobile fusion will do a lot of those management functions for devices other than blackberrys. If you want full security though, you'll probably want the new bb10 handsets with their balance function, so you can control all the data on a separate partition.

Re:Outlook.com (5, Informative)

sneakyimp (1161443) | about a year ago | (#43688203)

I disagree that Outlook.com is all that great. If you want your email to be truly secure, you need to encrypt it at the client and, in trying to set this up with one of my clients, I found that a) the documentation on this process using Outlook is very poor, b) one must pay to purchase a Digital Certificate for Outlook, and c) once my client did purchase a Digital Cert from one of the vendors listed on microsoft's website, windows and/or Outlook 2010 could not find this certificate or did not recognize it. A waste of time and money.

I found it much easier to configure Thunderbird with a self-signed certificate and OpenPGP. The email is encrypted on my computer and decrypted on the client's computer. However, it's probably not feasible to train a bunch of tech-challenged workers to do this themselves and would likely introduce too much of a training/support burden for any sizeable IT shop.

I realize that M$ may offer some handy tools for IT managers tasked with managing a large organization -- if you are willing to pay for it. I also find it extremely disappointing that client-based email encryption is not more widespread and easy to implement.

Re:Outlook.com (4, Informative)

v1 (525388) | about a year ago | (#43688451)

I disagree that Outlook.com is all that great. If you want your email to be truly secure, you need to encrypt it at the client

THIS. Once it gets off your LAN, there are SO many ways for you to get tapped into. Not counting the illegal ways, look at all the options the govt has and is well known to use, often ignoring or pencil-whipping judicial oversight. They can subpoena your ISP, whoever is doing your email encryption, whoever is providing them with their SSL keys, or their ISP.

If you are serious about protecting your privacy, make darn sure your data is secured before it leaves your property. At least then, if they want to snoop, you're a lot more likely to at least know it's happening. And that will keep out most of your threats, short of spear-phishing, stray bait flash drives left in your parking lot, and internal threats. (malicious employees)

In the short term, get everyone an email certificate, and USE them to sign and encrypt outgoing email. (any decent email client will support signing and encryption) That data could still be subpoenaed from the group you get them from though. You can roll your own if you want to also, but you won't be easily able to revoke if need be.

Re:Outlook.com (3, Interesting)

Flavianoep (1404029) | about a year ago | (#43688375)

Are you serious? (hint: "Poe's Law" [wikipedia.org] )

Re:Outlook.com (4, Funny)

cultiv8 (1660093) | about a year ago | (#43688419)

I second this, and highly recommend sharepoint for all you collaboration and intranet purposes as well. As a developer, I can truly say how happy I am when I need to work on a Sharepoint site. Sharepoint even integrates with Outlook [microsoft.com] ! Amazing integration with your existing Microsoft stack!

Re:Outlook.com (1)

Anonymous Coward | about a year ago | (#43689647)

Sharepoint sucks.
Outlook sucks.

Thunderbird + Enigmail + GPG sucks less. It still sucks, just less.
If you want secure email, run your own servers and encrypt everything from the client.

Voltage is pretty good (4, Informative)

seanmcelroy (207852) | about a year ago | (#43688033)

I'd ask for a different account rep. I've used Voltage for about 10 employees to great results. I've never encountered this professionalism problem you report.

Re:Voltage is pretty good (4, Insightful)

Obfuscant (592200) | about a year ago | (#43688399)

I'm not sure that I'd rate a failure of the account rep to predict every issue that a "stakeholder" might come up with and tell the purchaser how to deal with it in advance a "lack of professionalism". That sounds a lot like trying to aim at a moving target to me. "Oh, can your product also do X? It has to do X, which I just thought of..."

Re:Voltage is pretty good (1)

Anonymous Coward | about a year ago | (#43688413)

And I would recommend not relying on email for critical communications. If you must, just use normal email. Install TrueCrypt, and manually encrypt files by hand and then attach. If your staff can't handle that, then they have no business dealing with sensitive information to begin with.

Re: Voltage is pretty good (1)

Anonymous Coward | about a year ago | (#43689055)

truecrypt as attachment? you maybe overdoing it liken to hitting a fly with a hammer, use simpler methods but powerful encryption like axcrypt

Re:Voltage is pretty good (1)

Anonymous Coward | about a year ago | (#43688449)

I'd ask for a different account rep. I've used Voltage for about 10 employees to great results. I've never encountered this professionalism problem you report.

I bet the professionalism problem is just him discovering that it actually takes some setup to do(stakeholders at _his_ end). That is, he can't just install a magic piece of sw and expect magically every email communication from his firm to be encrypted.

gmail (1)

Anonymous Coward | about a year ago | (#43688041)

gmail supports encryption and you can use feature rich email clients like MS Outlook with it. Do you really need to have a mail server in-house anymore these days?

Re:gmail (3, Insightful)

egcagrac0 (1410377) | about a year ago | (#43688083)

Do you really need to have a mail server in-house anymore these days?

That really depends on the confidentiality requirements of your email.

If I were the business was healthcare, a law firm, or an accounting firm... yes, I'd feel a need to run the email in-house.

Re:gmail (1)

Anonymous Coward | about a year ago | (#43688445)

The email is by default, no matter what you do, is not secure from end to end and at rest. I believe, sending medical information over email is not permitted by HIPA, unless sent as encrypted asymmetrically on the client side. I believe the technologies that meet this requirement are things like PGP/GPG.

I don't believe there is legal standard for legal confidential data, as there isn't a standard for FERPA data, just that it be "secured."

Re:gmail (5, Interesting)

Anonymous Coward | about a year ago | (#43688645)

I love the idea of those places running things in house, but in my experience, specifically with law firms, they do not even when they are big enough for it to make a huge difference. They are also some of the most technologically misinformed and lazy people I have met. I've got three really good examples of this.

First example is Dropbox and other services like it. A local attorney was in a big surprise when Dropbox complied with a subpoena and turned over all documents they had that the attorney and his client had uploaded to their dropbox accounts. The court had a special master review them for confidential information and turned over a ton of documents and data. Suffice it to say, they "lost" the divorce case when the information included pictures of a second home (complete with GPS coordinates), multiple cars and other hidden assets.

The second is that many solos and small firms (about 40% of practicing attorneys) use the email service provided by the state bar association. The email service that does not have SSL or TLS support. Webmail, pop3, IMAP, SMTP, LDAP and the rest are all unencrypted. When I asked the tech guy at the association about why it was unencrypted, he pointed me to the board minutes, where at every meeting, they refused to approve a certificate because, as one put it, "it was a waste of money." During an experiment conducted at a legal education program (which I'll detail below), they came up with quite the large amount of information.

The third is the experiment I mentioned. At a legal education program, they partnered with a security group and they set up a device to log all the attempts to connect to wireless networks as well as real access points. The access points were protected by WPA2, but the password was given with the materials. It then had a screen presented with a TOS and privacy policy that they had to agree to before being granted access. The TOS gave all this away and included a button to click so we could see how many people actually read them (the people who clicked saw a stat page, which included a bar graph so you could see it over time). The access point was setup to log all the traffic (which ended up being gigabytes of data, they said, due to all the videos people watched) as the traffic came in. They then analyzed it for key words and statistics. A team of attorneys and people from the ethics committee cleared all the info that was presented in the speech about safety and being careful online. They talked about all the video, and news people checked, and then it slowly got more personal. They started referencing people's email, a snippet of a person's VOIP session and a document uploaded to some service. They then talked about safety steps like TLS, truecrypt and being careful and that you need to check that you are connecting to who you think you are as well as other things. The best part was right at the end, the speaker said "Jody wants you to remember to pick of a pizza on the way home," and about 25 people all went for their phones to see if they were talking about them. Incidentally, after the presentation, encrypting the bar association's email was added to their 5-year plan for year 5(!), but I guess it is better than nothing.

Last thing I will note is the mixed advice. For example, the latest, or maybe previous issue, of the ABA magazine had an article detailing the dangers of the cloud, especially dropbox as it is unencrypted, they keep your files after you delete them, and you can get them anywhere. Less than 20 pages later was an article that declared dropbox a "MUST HAVE" app for any attorney for the exact same reasons that the previous said were dangerous.

Re:gmail (0)

Anonymous Coward | about a year ago | (#43688815)

I should point out that the 40% figure I cited is for my state, not any other demographic group.

Re:gmail (1)

Anonymous Coward | about a year ago | (#43689589)

You don't need to pay anything to get a certificate. You only need if you want it signed by a major CA. Something with closed membership like the bar association could just publish the fingerprint and have everyone trust the certificate manually.

Re: gmail (0)

Anonymous Coward | about a year ago | (#43688131)

I hope you're joking, there is nothing secure about gmail or other mail providers like them.

Re: gmail (1)

HiThere (15173) | about a year ago | (#43688521)

Additionally, Google has repeatedly dropped unpaid services without warning or alternative. Not a good match for a business. If you don't run your own e-mail server, you at least want it to be run by someone contractually obligated to meet certain expectations.

Re: gmail (3, Interesting)

DuckDodgers (541817) | about a year ago | (#43688635)

Gmail has hundreds of millions of users, and provides ad revenue for Google. It's not going anywhere. I would also assume Google Plus, Google Search, Google Ad Sense, and Android are fundamental to the future of the company and safe to use. (That's not an endorsement, just a guess that those services will last as long as the company.)

And while Google App Engine is less essential to the company future, and is as vulnerable to the axe as Google Wave and Google Reader, there's an open source implementation of the APIs called "AppScale" which offers a migration path if Google shuts App Engine down.

Re: gmail (1)

AvitarX (172628) | about a year ago | (#43688715)

Google doesn't offer unpaid email to business anymore.

Re: gmail (1)

Bert64 (520050) | about a year ago | (#43689333)

You can pay for gmail, and then they will be beholden to the contract you have with them.
There is nothing to stop any company dropping a service, even one you pay for and have a contract for... The most you can hope for is that they give you notice that the service will be discontinued and you can migrate.

This is also why you should always have your own dedicated domain... The beauty of email is that it's a standard, so if you need to you can take your domain elsewhere and continue using email just fine. A much worse problem is when businesses start to rely on non standard services, like skype, twitter, facebook etc... These services could be pulled at any time, and you'd have no option to move your addresses to a third party service.

Simple (2)

ehud42 (314607) | about a year ago | (#43688067)

The one that you (or someone you trust) can effectively manage.

Cisco (2)

Anonymous Coward | about a year ago | (#43688081)

Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund

I agree (1)

daninaustin (985354) | about a year ago | (#43688221)

I use it as well and it works great.

Then I can't (won't) read email from you. (5, Informative)

Ungrounded Lightning (62228) | about a year ago | (#43688819)

Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund.

Then I can't (won't) read any email you send me.

To read Cisco IronPort mail you must install software from Cisco.

To install the software from Cisco you must sign an EULA - which makes a BIG POINT of being a binding contract.

The EULA has anti-reverse-engineering terms that, were I to sign them, would (IMHO) make me unemployable in the computer security field.

Therefore I will not install the software.

Therefore I cannot decrypt "secure" email you send me.

Therefore I will not do business with your company.

Do you REALLY want to FORCE your clients to CONTRACT WITH A THIRD PARTY and SIGN AWAY THEIR RIGHTS in order to exchange important email with you?

Re: Then I can't (won't) read email from you. (1)

Anonymous Coward | about a year ago | (#43689631)

That is incorrect information. The email is stored on the device and a recipient is given a link to read the email using their provided credentials from the send secure client plugin in outlook

Re: Then I can't (won't) read email from you. (1)

markdavis (642305) | about a year ago | (#43689961)

And what if you don't and/or can't run Outlook?

Re:Cisco (2)

stephanruby (542433) | about a year ago | (#43689191)

Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund

Yeah, we did the same [forbes.com] at my company.

Our IT Staff just threw their hands in the air, and now we just use a public bulletin board for our all our internal electronic communications (with private messaging disabled). And once in a while just to be thorough, we let a spammer come in to post viagra ads on it, just to remind all of our employees that our bulletin board is completely opened to the outside world and nothing posted on it will ever be private.

Re:Cisco (2)

rot26 (240034) | about a year ago | (#43689209)

Ironport blacklisted my mail server because I was in the same class C address space as a "suspected" spammer, despite the fact that no spam had ever been reported from my IP's. There is (or wasn't at that time) ANY REMEDY for getting off of their blacklist.

Proofpoint (3)

Rinoa (91834) | about a year ago | (#43688151)

It's a small company but have absolutely stellar encryption and archiving products and good service. http://www.proofpoint.com/products/privacy/email-encryption.php [proofpoint.com]

Re:Proofpoint (1)

Anonymous Coward | about a year ago | (#43689257)

proofpoint just resells the voltage encryption product as far as I know.

PGP (5, Insightful)

koinu (472851) | about a year ago | (#43688159)

Use PGP/GPG for god's sake. Since when do you delegate encryption and integrity to any gateways? You cannot trust ANYONE except yourself when signing private documents. Do you delegate signatures in sensitive and confidential cases to your co-workers?

Re:PGP (1)

sneakyimp (1161443) | about a year ago | (#43688223)

YES! Mod parent up. It's nice to see the old security paranoia in somebody else.

Re:PGP (2)

TheCarp (96830) | about a year ago | (#43688427)

This is exactly what I was thinking. An "encryption gateway" just sounds like one more vector for a problem. This is especially the case when its not needed. Pgp/gpg works and has worked for a long time, and requires no real infrastructure.

Re:PGP (2)

Arrogant-Bastard (141720) | about a year ago | (#43688453)

This. THIS.

You cannot outsource security and expect to succeed. (Consider, for example, Vendor X. Do you think that every single employee of Vendor X is absolutely trustworthy? Really? You don't think that ANY of them are struggling financially, or maybe having an affair, or perhaps amenable to a payoff in crisp folding tax-free income? Because if there exists a non-empty set of Vendor X employees who are less than absolutely trustworthy, you are completely screwed: eventually someone will figure out which one(s) and which lever(s) to pull to subvert them. And note that this is even before we consider that Vendor X will, if sufficiently successful, inevitably be targeted by attackers, since of course hacking Vendor X comes with a very high payoff. And note that this is also before we even consider what governments armed with extrajudicial wiretaps and NSLs and such will do. In both these latter cases, Vendor X will be highly motivated not to inform you -- and that's optimistically presuming they even know.) You MUST do security in-house, which means you need to do it with open software and open standards that are fully subject to peer review.

Re:PGP (4, Insightful)

SpaceCadetTrav (641261) | about a year ago | (#43688497)

So who is going to teach Gladys from accounting how to store her contacts' PGP keys and encrypt her email? And are you also going to train everyone she sends email to, as well? Out here in the real world we have to support non-techies and gateways are the most reasonable compromise.

Re:PGP (4, Insightful)

HiThere (15173) | about a year ago | (#43688603)

What you meantion is a valid problem with the PGP type solution.

Unfortunately, the solution of "let joe do it" opens you up not only to joe, but also to anyone who snoops the unencrypted transmission between Gladys and joe.

In each case you evaluate how much the security matters to you, and to others. The more it matters, the closer to the origin the encryption needs to be done. (You'll have noticed I didn't encrypt this at all.) PGP is pretty good if there's enough importance for you to ensure that it's properly used. If you aren't, then "let joe do it" for, again, varying values of joe. Internal IP is probably more secure than someone outside, but you need to care enough to ensure that they do the job properly. (An easier job then ensuring that every Gladys does her encryption properly, but less easy than delegating it to someone outside.) At every step removed, the security decreases, and the ease increases. Make the trade off that YOU deem appropriate.

Re:PGP (0)

Anonymous Coward | about a year ago | (#43688783)

Doesn't Outlook and other programs support automatic encryption? Either way, where I work we are set up to have email automatically encrypted if we know the other party's public key. Doing encrypted email is no harder then normal email, it just takes a little longer to send. They also tell us to send an email first that is not sensitive if the recipient has never received an email from us before saying that we support email encryption. A little warning pops up if your email won't be encrypted and a blue icon is missing when you compose it (a red one seems to be there regardless). Additionally, they store our certificates somewhere, so we don't have to worry about losing them, we can use the webmail service at home, we only have to do that "we support encryption" email once per recipient and they can access our mail if they need to conduct an investigation or turn it over to someone else.

Re:PGP (5, Insightful)

Arrogant-Bastard (141720) | about a year ago | (#43688801)

Gateways are NOT a "compromise": they are total failure. That say to the world "we care about the appearance of security/privacy/integrity; we just can't trouble ourselves to actually, really, truly, provide those things."

Speaking as someone who's taught Gladys from accounting how to use mutt and GPG -- several thousand Gladys, actually -- it CAN be done. It requires effort, it requires time, it requires budget: but it can be done. Consider it an investment: is it better to spend these resources on Gladys, our valued employee, or is it better to spend these resources on a vendor?

Re:PGP (1)

westlake (615356) | about a year ago | (#43689019)

So who is going to teach Gladys from accounting how to store her contacts' PGP keys and encrypt her email?

Not to be mention the fact that Gladys is a temp and Harriet is an intern and both will gone within a week.

Re:PGP (3, Informative)

Bert64 (520050) | about a year ago | (#43689389)

The IT department provides all staff with a client that is already configured to send and receive PGP email...
The client is configured to automatically encrypt when sending mail to a recipient for which it has a public key, and displays a warning if it doesn't have a key available.
When it receives a public key via email it prompt the user to import it.

It's really not terribly difficult if done right, and users will soon be sending encrypted mail without even realising it.

Re:PGP (0)

Anonymous Coward | about a year ago | (#43689725)

Out here in the real world we have to support non-techies and gateways are the most reasonable compromise.

No, not-having-the-gateway is the most reasonable compromise. It has all of the security advantages of gateway snakeoil, but at a fraction of the cost.

If Gladys can't learn about key exchange, then it truly and simply IS impossible for her to have really secure email, period. Anyone who says they can offer her secure mail without teaching her key exchange, is in the fraud business, not the security business.

If you relax the constraint that she must be MitM proof (you want to make her safe from passive snooping and are ok if she is defeated by targeted MitM attacks) then you can also lose the training, and use something that works just as well as a gateway but at a fraction of the cost: PGP. Just have her email client automatically get her contacts' keys from public keyservers whenever they're needed, configure it to always encrypt by default (so far I think we're up to the massive training being: the admin, not Gladys, has to click two checkboxes, for most email clients anyway) lower the trust threshold (admin guy will need to learn a bit for that), and you're done. Only training Gladys needs, is to enter her passphrase sometimes, for signing or decrypting. And if she can't do that, she also can't type subject lines either, so she probably wasn't anble to use unencrypted email either.

Re:PGP (1)

Anonymous Coward | about a year ago | (#43688785)

Use PGP/GPG for god's sake.

I would suggest S/MIME certificates instead, far more email programs support S/MIME out of the box than PGP.

Do you delegate signatures in sensitive and confidential cases to your co-workers?

Yes. It's quite common for a business to have a recovery key. And sometimes you do want to delegate functions to someone else.

Re: PGP (2)

koinu (472851) | about a year ago | (#43689635)

I wouldn't have a problem with delegation of one's personal security responsibilities when predictable things like Comodo or Diginotar would not happen. But they do... and it's pretty obvious. Second thing is that I have not seen anyone taking CRLs seriously with S/MIME, yet.

Re:PGP (1)

Attila Dimedici (1036002) | about a year ago | (#43689027)

How do you convince your clients to install PGP certificates on their end? I need a solution that does not require those who we send email to to do anything other than act in response to the email they get from us.

Re:PGP (1)

Anonymous Coward | about a year ago | (#43689395)

If you can't get people on the other end to exchange some setup information out-of-band you *cannot* have confidential, authenticated data exchanges. Full stop.

You can get confidentiality from something like SSL (which is what many gateways do to avoid client software -- provide an HTTPS site that does server-side decryption of the message) but there's no authentication available.

If you setup a website secured with SSL, and you got people to create accounts out-of-band, you could use such a system to remove the requirement to install client software. But that's not typically how such sites are configured.

Re:PGP (1)

LateArthurDent (1403947) | about a year ago | (#43689889)

Use PGP/GPG for god's sake. Since when do you delegate encryption and integrity to any gateways? You cannot trust ANYONE except yourself when signing private documents. Do you delegate signatures in sensitive and confidential cases to your co-workers?

I'd go with s/mime, because most e-mail clients will support it without having to install anything else.

Entrust (3, Informative)

sinij (911942) | about a year ago | (#43688163)

I use and like Entrust Entelligence PKI solution. Signed and/or encrypted email, used by most US gov. agencies for easier interoperability.

GPG? (0)

NoImNotNineVolt (832851) | about a year ago | (#43688167)

GPG?

email encryption gateways (5, Insightful)

nimbius (983462) | about a year ago | (#43688249)

seem like a gimmick. taking steps like ensuring your MTA always delivers using a TLS connection is probably the most interoperable decision, seeing as endpoint encryption requires two mta's to be using the same hardware or software to encrypt/decrypt, assuming its PKI. endpoint encryption raises big questions like at what point does the message become decrypted? where are keys stored? how do you independently verify key integrity or revoke keys that have been compromised? is there a 'barracuda back door?' and can the system be arbitrarily bypassed. These tend to be the kinds of questions that force vendors to seem standoffish or unprofessional because they dont know the answers.

if you need real crypto, then use an open standard thats auditable and verifiable. assign keys to users, and revoke them when they become compromised or the employee leaves. you might consider configuring your mailserver to reject unencrypted messages, which can be detected using spamassassin or plain regex to ensure compliance. Make sure the stakeholders on your end are well informed as to the SLA and method/type of crypto being employed (TLS tunnel vs actual message or even both.) Encrypted messages have the potential to make collaboration cumbersome if not outright impossible without defeating the crypto at some point, while encrypted gateways can cause problems in the event certificates are checked against an authority for self-signature, or expiration. its also worth nothing once again that just because an email system is encrypted, does not mean you will receive less UBE (spam) or phishing attempts (in fact a compromised key makes these attacks far more effective.) encrypted email by nature also requires you to reveal envelope headers in plaintext, and does not excuse a mail administratior from considering or employing SDF and DKIM signatures.

disclaimer: ive done email for more than a decade for search engine companies.

Re:email encryption gateways (1)

chispito (1870390) | about a year ago | (#43688615)

seem like a gimmic

A government-mandated gimmic, depending on your field.

Steal this ideea (0)

Anonymous Coward | about a year ago | (#43689011)

What if Google or other large providers were to add a time penalty to all non TLS mail they receive ? Start with 1 minute and gradually increase as TLS deployment grows. SMTP error: 455 Non TLS delivery delayed, try again in one minute

This way admins have an incentive to deploy TLS: it reaches gmail faster. Plaintext delivery on port 25 should die, pure and simple.

Re:email encryption gateways (1)

Bert64 (520050) | about a year ago | (#43689419)

One issue with encrypted messages however, is that unless your mail filters have the private keys they cannot look inside the encrypted mail for spam or malware...

Zixmail (2)

Anonymous Coward | about a year ago | (#43688281)

I've worked for companies who have used this in the past and it has worked quite well.

Re:Zixmail (3, Informative)

Anonymous Coward | about a year ago | (#43688365)

I setup a ZixGateway appliance and it's worked quite well for encrypting mail. Users can enter a keyword in the subject line and it will encrypt the messages, or if it scans a message and finds something that's in one the lexicons it encrypts it. They were very professional during initial setup and every time I've had to contact support things have gone well with quick responses. Not sure how small of a company you're working for but we're under 100 people and this solution works well for us.

Re:Zixmail (0)

Anonymous Coward | about a year ago | (#43689287)

In my experience the Zix gateway is not much better than glorified TLS as it dos not encrypt at the desktop or while emails are at rest in the mailbox.

Re:Zixmail (3, Insightful)

bill_mcgonigle (4333) | about a year ago | (#43688417)

I'm working with one currently. It's postfix under the covers, so you can at least see what it's doing. The app is tomcat. More importantly, many of their business partners use the same solution, so they have an easy, if proprietary way to interconnect.

My e-mail is on the TLS list so it goes through normally, but if I got the "You've got a new message from foo@exmaple.com, go to this website for your message" e-mail instead of a real one, I'd probably just delete it.

I understand why people do this, but the results are too close to phishing and scams for me to participate.

My e-mail systems can all do end-to-end and transport-layer encryption; the gateways are so often so others don't have to bother with a decent setup. And often the others are customers of large ISP's who don't know any better. But the problems aren't technical so much as ease-of-use and integration.

Re:Zixmail (0)

Anonymous Coward | about a year ago | (#43688933)

Zix implementation here . . . was a piece of cake. First did the hardware then yanked it out when we virtualized our server room and used the Zix App. Quite knowledgeable staff.

Not Voltage's problem: buyer error. (-1)

Anonymous Coward | about a year ago | (#43688305)

Every time I think I am one question away from being ready to pull the trigger, I discover something that my contact with them had not mentioned before that has to be ironed out by the various stakeholders on my end.

That makes no sense.

Is it or isn't it in the contract?

Before signing it, did you check with your stakeholders?

Did you run it past a lawyer?

This doesn't sound like a vendor problem to me. It sounds like someone signed something without reading the contract and completely understanding it.

Your sir should be fired and learn a valuable lesson from it.

Re:Not Voltage's problem: buyer error. (0)

Anonymous Coward | about a year ago | (#43688469)

Every time I think I am one question away from being ready to pull the trigger, I discover something that my contact with them had not mentioned before that has to be ironed out by the various stakeholders on my end.

That makes no sense.

Is it or isn't it in the contract?

Before signing it, did you check with your stakeholders?

Did you run it past a lawyer?

This doesn't sound like a vendor problem to me. It sounds like someone signed something without reading the contract and completely understanding it.

Your sir should be fired and learn a valuable lesson from it.

Contact, not contract. Read it again and it makes more sense.

Re:Not Voltage's problem: buyer error. (1)

NatasRevol (731260) | about a year ago | (#43688559)

But then again, which one is the typo?

Re:Not Voltage's problem: buyer error. (3, Interesting)

guruevi (827432) | about a year ago | (#43688593)

Voltage is a slimeball company though. They typically sell to really big institutions for many times the original quoted costs once you figure in all the 'appliances', upgrades, support contracts, implementation engineers and contractors and then their product usually doesn't deliver. They're the PWC, PeopleSoft or Gartner of e-mail.

Not really the best practice (5, Informative)

Bruce Perens (3872) | about a year ago | (#43688331)

Rather than an encryption gateway, having your email client handle encryption avoids the problem of man-in-the-middle attacks between the gateway and the client.

I don't have much reason to encrypt, but Thunderbird has my certificate installed and does my digital signing. This is not unusual for a modern email client.

Re:Not really the best practice (2)

apleschu (1643151) | about a year ago | (#43688465)

Bingo! If you have the need or wish to encrypt you NEED to do it yourself. Each and every email client worth something is able to encrypt/decrypt. And the ones that are not I'd let go as fast as I let go of a hot coal. At the same time you cannot be hit by a 'quiet' discovery, you know that each employee has their own key, and so on. if you NEED encrypotion there is just no good reason to have encryption farmed out.

Re:Not really the best practice (1)

kwerle (39371) | about a year ago | (#43689301)

But getting folks to understand security and encryption is pretty hard.

Hybrid solutions are what you often want for a business. If the client has encrypted the message, then great - forward it through. If it has not, then encrypt it on the gateway. If it can't figure out how (missing keys), then reject the message.

It's a shame there isn't a commonly used encryption standard. I blame the US government for making this basically illegal to implement without worrying about who a person is and what country they live in/are from.

Re:Not really the best practice (1)

Bruce Perens (3872) | about a year ago | (#43689797)

For years, we have had a cut-out in ITAR 121 that applies to Open Source, it is due to a lawsuit that Phil Karn brought against the Federal Government. Thus, you can implement with impunity, and export to anywhere, as long as it's Open Source.

ROT13 (0)

Anonymous Coward | about a year ago | (#43688341)

sdfer afdghwe gyfr!!!

Re:ROT13 (0)

Anonymous Coward | about a year ago | (#43688595)

ROT26 is twice as secure.

Re:ROT13 (1)

arfonrg (81735) | about a year ago | (#43688809)

/me goes to decode the above message to find out what he TRUELY said...

Astaro / Sophos UTM with mail security (0)

Anonymous Coward | about a year ago | (#43688347)

Great functions, free for personal use. Mail encryption gateway, openpgp and s/mime.

Email Encryption (4, Interesting)

SecurityPro (2804157) | about a year ago | (#43688361)

I would recommend Zix http://www.zixcorp.com/ [zixcorp.com] or ProofPoint http://www.proofpoint.com/ [proofpoint.com] Both are very good solutions and both have given me no issues with implementation. We sell both and have quite a few satisfied customers with both products. No one is perfect but these are our best vendors.

Axway's Mailgate (Used to be Tumbleweed) (0)

Anonymous Coward | about a year ago | (#43688471)

http://www.axway.com/products-solutions/email-identity-security/comprehensive-email-security/mailgate

Sophos Gateway (1)

Noan21 (720315) | about a year ago | (#43688499)

I worked at a small 25 bed hospital, we implemented the Sophos email appliance. It was fantastic, the basic setup was incredibly easy to do. When you send an encrypted email out the recipient gets an email asking them to register, they create a password and are then mailed a PDF protected with the password they set. That same password will encrypt all of the PDFs they receive until they don't receive one for a period of time that you choose, at which point they create a new password. An outlook add-in is available that will allow you to quickly and easily stamp an email to be encrypted. It also functioned as our spam / virus filter and was fantastic at it. We never setup or configured the scanning of outbound emails to force encryption although that was an option. Loved it 5/5 wish we had it at my current place of employment. After I put it in place and configured it, I almost never touched it again.

Re:Sophos Gateway (4, Insightful)

dskoll (99328) | about a year ago | (#43688803)

One thing I don't understand about these things: If an adversary can intercept your email, he/she can intercept the email asking for registration and create a password.

Without an out-of-band way to register, I fail to see how these things add security.

Re:Sophos Gateway (1)

Bert64 (520050) | about a year ago | (#43689463)

Also, an email asking you to visit a website in order to register looks very much like a phishing scam...

Really? (0)

Anonymous Coward | about a year ago | (#43688555)

Encrypting the content of the e-mail is only 1 part of the problem. The recipient of the e-mail needs to know that the e-mail really did come from you, and was not spoofed by some one else ... DKIM

How about SSL? (1)

guruevi (827432) | about a year ago | (#43688567)

Most SMTP servers can communicate over SSL or TLS with each other these days and if you set it up correctly (eg. Postfix), it will do so and fallback on non-encrypted methods.

For message encryption, you're better off giving each person a personal SSL certificate (setting up a PKI should've been done for other purposes already) and all of the clients I know off support SSL encryption.

Enigmail for Thunderbird (1)

sl4shd0rk (755837) | about a year ago | (#43688569)

To ease the GPG pain*. Enigmail does a great job but it's only half the battle. How you are going to reconfigure every Recipients client without causing sheer panic is going to be interesting. Please report back when you do.

[*] - http://www.enigmail.net/home/index.php [enigmail.net]

Beware of blackboxes (2)

gmuslera (3436) | about a year ago | (#43688619)

Trusting in someone that could be forced by law to give your encrypted communications [slate.com] (after all they have the right to see all your mails [cnet.com] ), or modify packaged software to let them in [pcpro.co.uk] is risky this days. You maybe could trust in the FBI as in a concept, an entity that won't be interested in your trade secrets, but there are people working for them, and people and corporations giving orders to them directly or indirectly that have no problem abusing the power they have.

Open source, widely tested encryption and secure channels are your best options.

Re:Beware of blackboxes (2)

Attila Dimedici (1036002) | about a year ago | (#43689113)

I don't need to encrypt the email to keep it from the government. I need to encrypt the email because the government requires it.

Symantic PGP Gateway (0)

Anonymous Coward | about a year ago | (#43688641)

http://www.symantec.com/gateway-email-encryption

Depends on the needs (2)

edelbrp (62429) | about a year ago | (#43688737)

I've dabbled with a variety of solutions, but it really depends on what it is you are trying to secure, between whom, and where.

GPG/PGP has been around a while, but it usually requires some third party software/plugins. I seems a little clunky to me as most email clients already have S/MIME support built in which brings me to...

S/MIME requires you get a cert through a third party (Thawte used to provide free email certs). By just sending a signed email to somebody they will then have your public key.

If you are talking about securing email between two email relays, then you can just configure the relays to enforce TLS.

If you are talking about securing the link between clients and email sending/receiving, you can just configure the mail server (if it isn't already) to only accept connections on pop3s/imaps/smtps/etc.

Other ideas is setting up encrypted tunnels between relays (like how ssh can do port forwarding), etc.

Need more information. (0)

Anonymous Coward | about a year ago | (#43688767)

You didn't really explain the scope of what you're doing here, or what your actual requirements are.

In our scenario voltage is used between our enterprise and destinations that we do not have an explicit TLS path defined. So before an outbound message leaves the enterprise, it goes through a DLP implementation, if DLP flags it as containing pii/sensitive info without TLS inplace to the target then the message is routed to voltage to be encrypted and then delivered off to the target.

I guess what are you really trying to do? If it's just securing mail to a handful of clients/suppliers, then just work on key exchange and forced TLS for the target domains, if it's general everything that goes out needs to be encrypted, then voltage is not a bad option depending on weather your using their hosted service or running their software locally in your shop. I've shared some of your frustration around deploying their stuff though, especially if you move outside of their comfort zone for how they expect it to be deployed. We've gone the multiple sec-mail gateways at different physical locations and for different functions, with multiple management consoles for dr/bcp etc and yeah a lot of things come up after the fact. It has not been easy, especially when you start going further with custom requirements for integration.

Re:Need more information. (1)

Attila Dimedici (1036002) | about a year ago | (#43689083)

You hit the problem on the head. And your description of the problems dealing with Voltage hit the problem I have with them on the head as well.

I need to buy a car (0)

EmagGeek (574360) | about a year ago | (#43688829)

I need to buy a car, but so far the cars I've looked at haven't suited my needs, and I don't like the car dealer very much.

Will the Slashdot community help me buy a car?

(functionally equivalent)

Voltage is a POS and full of lies (-1)

Anonymous Coward | about a year ago | (#43688857)

Look over their marketingspeak: http://www.voltage.com/technology/identity-based-encryption/ [voltage.com]

They've got gems like this:

IBE can use any arbitrary string as a public key,

The whole point of public/private keys is that you CAN'T (feasibly) calculate the private key from the public key.

So either Voltage has made enormous mathematical breakthroughs that are worthy of the NSA, or they are just spewing BS.

Barracuda hands down (0)

Anonymous Coward | about a year ago | (#43688975)

Best email gateway for the price I found (and they give back to opensource projects they use).

Happy to help - Voltage Security (1)

Anonymous Coward | about a year ago | (#43688977)

If you are not getting what you need from your contact, please feel free to reach out to me directly.

There are millions of happy users across thousands of enterprises around the world using Voltage SecureMail either on-premise or from the Voltage SecureMail Cloud to secure emails and files end to end. Banks from the likes of Wells Fargo and JPMC use it universally, Cloud providers for Exchange including Microsoft use it as a security option for Office365 cloud offerings, and smaller businesses such as lawfirms, credit unions, and financial agencies also enjoy its simplicity in enabling privacy, even to and from popular smartphones. The cloud version simplifies deployement for SMBs in particular, and deployment can even be hybrid cloud to suit particular needs.

We are very pround of our reputation with our customers, proven by exceptional long term relationships and repeat business across our data security product set.

I look forward to helping resolve whatever issue caused the concern.

For the record - we license by active user count, not appliances, in respect to the comment on price.

Best regards,
Mark Bower
VP Product Management
contact : info@voltage.com - ask to reach me personally

Open source (1)

X10 (186866) | about a year ago | (#43688995)

Djigzo email encryption gateway is open source, you can download a free version from www.djigzo.com. It supports S/MIME, it has a lot of cool features. Used by major corporations all over the world. Just give it a try, it's free.

How about smtp.nsa.gov? (1)

CheckeredFlag (950001) | about a year ago | (#43689053)

I hear they have excellent decypt...I mean encryption. I'm sure they'd be delighted to handle all your sensitive information for you! Also saves them the trouble and bandwidth of having to rerouting your email to them.

Please contact me to fix this (4, Informative)

Terence Spies (2920397) | about a year ago | (#43689099)

I'm the CTO at Voltage, and I'm disappointed to hear that the original poster is having a poor experience with us. While I'm not going to claim the Voltage's gateway product is the ideal solution for every small business, we do feel like we do a great job helping businesses of many sizes that handle and exchange sensitive data comply with privacy requirements. There are a lot of security solutions that have been mentioned in this thread, ranging from GPG to SMTP over TLS. All of these solutions have value, depending on the problem that you are trying to solve. Our product focusses on encrypting email messages to end users without needing to enroll those users into a traditional certificate structure, and allowing those users to decrypt those messages with minimal difficulty. Regardless, I'd like to solve the original poster's problem. I'd ask that he contacts me at Voltage, and I'll handle any issue he's having at the moment.

Re:Please contact me to fix this (0)

Anonymous Coward | about a year ago | (#43689373)

Your name is "Spies" and you do email encryption ?

Re:Please contact me to fix this (1)

Terence Spies (2920397) | about a year ago | (#43689425)

Sigh. Yes, you can't make stuff like that up.

Re:Please contact me to fix this (-1)

Anonymous Coward | about a year ago | (#43689827)

Terence has a big family to feed, common guys, use Voltage

Barracuda Networks (1)

charnov (183495) | about a year ago | (#43689163)

Can work through their or standalone web service. They also have just about the best customer service of any company I have ever worked with.

https://www.barracuda.com/products/emailsecurityservice [barracuda.com]

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...