Email Encryption Gets Easier

Remember the OpenPGP and S/MIME email encryption wars? Back then, it was all about which encryption protocol would become the standard for protecting email messages from prying eyes.

The headache and complexity of using encryption keys for messaging wasn't appealing to the typical organization or end user. And now, about a decade later, most users still don't encrypt their email messages. "The way a traditional PKI works, it's useless to make the majority of information workers send and receive email" with it, says Richi Jennings, an analyst with Ferris Research.

But email encryption technology is actually getting easier to deploy and manage today, with new approaches such as identity-based encryption (IBE) from companies like Voltage Security and Identum that match users to their more tangible email addresses or logons. There are several email encryption service offerings as well, such as Goodmail for consumers, as well as from service providers like Yahoo. (See Six Hot Security Products.)

So far, email encryption is still mainly used by organizations with highly sensitive missions or information, or paranoid security types who know too much. But enterprises, especially those under the heaviest regulatory microscopes like healthcare and financial services, are starting to look more closely at email encryption. The recent epidemic of laptop thefts and customer data leaks has also spurred interest in giving email encryption a second look.

Aside from Voltage Security's SecureMail, which uses a special algorithm that turns a user's logon or email address into a public/private key pair, email encryption pioneer PGP yesterday rolled out a new feature for its PGP Universal Gateway product that lets you send encrypted mail to an organization or recipient that doesn't have secure messaging.

"At the end of the day, you can't dictate what's on the recipient's end. There has be some transparent way to communicate," says John Dasher, director of product management for PGP.

"It's [email encryption] becoming more usable," says Christopher Gervais, enterprise architect for Partners HealthCare System, a Boston-based network of hospitals and research labs, who says email encryption may be an option for the company in the near future. "Some of the email encryption experience for end users has become more integrated -- there's no more goofy manual certificate management, or [having to decide] do I encrypt this or that. It's becoming more automated."

Integro Insurance, for instance, runs Voltage's appliance for internal email among its 13 locations worldwide, and then with a Web-based setup for external messaging. "Encryption has to be painless or people are not going to do it," says Fred Danback, principal and head of global technology services for Integro Insurance Brokers. "Users get frustrated if they can't open a message they need."

Danback says he configured the appliance, which cost about $40,000, by registering it via the firm's Active Directory, not user by user, so it was simple to deploy. Each user gets a Voltage plug-in for Outlook, and then all they do is hit the "send secure" button to encrypt a message using their email address. "And oftentimes I don't know when a message to me was encrypted," he says, because it's automatically decrypted for him. Aside from a handful of policies (such as all messages with "HR bonus payoffs" or "open enrollment" automatically get encrypted), most email encryption at Integro is at the user's discretion, he says.

Email encryption has even become a sort of selling point for the company: Danback attributes a half-million-dollar deal the firm recently sealed with a New York investment bank to Integro's email encryption capabilities. "The [win] was largely due to the security of our infrastructure and our ability to send and receive encrypted messages."

And meanwhile, an in-house email encryption installation today also obviously must address the growing number of BlackBerries, Trios, and iPhones in organizations. Partners HealthCare's Gervais says adding handhelds to the equation would be a factor if he were to adopt email encryption: "We have more and more users getting their email on different types of devices -- BlackBerry, Trio, iPhones, etc., and users getting their mail through Web interfaces from different endpoints and nodes."

Whether email encryption truly goes mainstream isn't clear. For now, many firms merely use secure VPN connections to their business partners when sending sensitive mail, notes Ferris Research's Jennings. "That's not what encryption maestros call desktop-to-desktop, but it means certain email is not going unencrypted over the public Internet."

"I don't see a large percentage of email getting encrypted over the Internet [yet]... We're still in the very early days of email encryption," Jennings says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.