Email is a crucial part of most people’s daily lives, but few people consider how it’s secured, apart from entering a password to access our accounts. What options are available or even advisable to use for securing email?
What is email security?
For the purposes of this post, I’ll define email security as pertaining to both the content of messages, as well as the accounts people use to access their emails.
Email security does not end with authentication for accessing our accounts: message content can be validated and secured, sender identity can be authenticated, authorization of email senders can be maintained, and the integrity and functionality of the email app itself can be better secured.
If you’re the administrator of your email account, you’ll naturally have a different subset of options than if your account is being administered by someone else. Depending on your threat model, which options are needed may vary somewhat, but most of us could benefit from adding more methods to our repertoires.
Securing message content
Few people seem to be aware that sending an email can be as open to eavesdropping as sending a message on a postcard. Fortunately, there are a variety of ways to add layers of security to the process of sending a message. One method is akin to putting a message in an envelope; people can still see where the message came from, and where it was sent to, as well as the content of the message if an eavesdropper is able to intercept it at some point in the process (especially after the envelope is opened). This type of protection is considered “transport-level”, as it helps protect the message in transit across the internet.
It’s also possible to secure the message from “end to end”, meaning the message is encrypted at the source before it ever hits the network, and then decrypted by the recipient. This shortens the time that a message might be read even by an eavesdropper, as it can’t be read when it’s in transit or until its contents are decrypted. The eavesdropper would also need to have the decryption key as well as the email to access the data within an intercepted message.
Administrators often choose to implement transport-level protection, as it’s the type that’s most transparent to users and because it usually doesn’t require their direct interaction. If end-to-end encryption is needed, it’s a good idea to choose technologies that make this process simple, and to create policies that dictate when this type of encryption must be used.
Ensuring valid, appropriate content
It’s a fact of modern life that much of what arrives in our inbox is not anything we want to receive. When you add up the amount of spam, scams, phishing and malware that’s being sent, there’s a lot of traffic that is wholly unwelcome. Most organizations and email service providers have some manner of filtering for this sort of detritus in place already, to help stem the flow. Depending on our own levels of risk tolerance, there are a variety of ways that this can be done.
Most email providers operate a simple blacklist of known spam, phishing and malware to decrease the amount of unwanted and malicious email that reaches their customers. But many organizations would be wise to be more proactive with their filtering. You could also limit messages by attachment type; either allowing only those files from an approved list of safer or more common file types, or excluding unusual or more-risky file types.
Keep in mind that while many popular file types may seem safer, they can still include powerful macro code or malicious, embedded files. No file type should be considered completely safe. It may be more helpful to view file types less in terms of their potential danger, and more in terms of their level of risk versus potential impact on workflow. While many people send things like documents, spreadsheets, or presentations, very few people have valid work-appropriate reasons to send or receive executable file types via email, so these can be excluded in most organizations with a minimum of hassle.
Some organizations also choose to screen emails before they’re sent out from their network too, for malware and/or confidential company data. Most companies maintain some sort of sensitive files or information such as payment or ID card details, healthcare information, or confidential company data and would do well to log its whereabouts. It can be useful to set gateway anti-malware scanners to more “paranoid” settings, as a potentially slower scan of files going through email will be less noticeable or disruptive.
Email authorization and authentication
Spoofing email is trivially easy for miscreants, and while there are ways to limit this, the available options are not yet widely used. These techniques help authenticate message content, indicate which users and accounts are authorized to send from your domain, and can help verify that email headers are internally consistent.
Because these authorization and authentication techniques are not commonly implemented, the best-use case for most companies is to deploy these methods to help protect your brand integrity or prevent certain types of Business Email Compromise (BEC). You can also use them to log emails that fail to authenticate properly, for forensic purposes.
Use of email authentication and authorization should be considered part of good administration hygiene, like promptly removing (or at least changing the passwords of) accounts that are no longer in use (such as those formerly belonging to employees who are no longer with the company).
Account protection
Most of us are aware of authentication for our email accounts, as this is the type of email security most of us have. Several of the other types of email security we’ve discussed in the previous paragraphs exist in part to help mitigate the damage caused by stolen login credentials, which is to say it’s a huge problem that causes a cascade of other woes. But multi-factor authentication is another very effective level of protection for access to our email accounts.
Rather than just providing a username and password, which is one single “factor” of verifying that you are who you say you are, multi-factor authentication combines these credentials with another method. The most common example of a second method is a one-time key – often sent by email or SMS, or created by an app or dongle – that is input after you’ve successfully entered your username and password. Multi-factor authentication can either be tied directly to the login process for an email app, or to a network login process, depending on your specific needs and threats.
Software protection
Last but not least, it’s also important to protect your email by regularly updating the software you use, including your operating system and the app or browser you use to access email. This will help address vulnerabilities that could allow attackers to access your emails. You may wish to do this with automatic update capabilities in the software itself or in your operating system, or by going directly to the vendor’s website for downloads.
Final Thoughts
Whatever methods you choose to incorporate – be it for email or computer security in general – it’s important that they be things people in your organization can and will use. This means observing the workflow of the people who will be using these technologies, choosing options that are either applied automatically or are easy to use, and then training users about how and when to use protection methods.
