Stay Current


Email Security for Dummies


What is Email Security?
On one level, email security is ensuring that your emails are secure: that is, it involves the maintenance of the basic information security concepts:

  • Integrity - ensuring that your message has not had unauthorized alteration
  • Confidentiality - ensuring that no unauthorized person (or process) has viewed the content
  • Accountability - being able to prove who wrote the email
  • Availability - ensuring that the email can be sent/received
  • Non-repudiability - being able to prove that the recipient really did receive it

   Related Articles:

But more than the email itself is involved in email security. It also involves:

  • Ensuring that you neither receive nor send malware hidden within the email or any attachments
  • Minimizing the receipt of spam, scams, phishing expeditions and illegal content
  • Ensuring that staff neither accidentally nor with malicious intent allow or send confidential, sensitive or illegal content within or outside of the company
Why do I need Email Security?
You need email security simply because failure to do so has both commercial and legal ramifications. An example that can illustrate both aspects would be infection with a highly destructive and virulent virus. Let us assume that your own systems are infected, and the virus payload is delayed but destructive: that is, you manage to infect, say, a competitor before this virus destroys your system.

The commercial implication is obvious: loss of your systems, data, records etcetera will be severely damaging if not fatal. But on the legal side, many lawyers believe that you could be held liable for any loss suffered by a third party that you infect, whether intentionally or even knowingly or not. If that third party were a competitor, then it would have little incentive not to sue the elbow off you.

And the history of internet litigation is already strewn with examples of both staff and competitors suing companies that have allowed compromising information to circulate within, or worse, to escape from, the company network.

It would be much safer to ensure your email is secure rather than risk the potential problems of insecure emails.

What do I need in Email Security?
Since so much is involved in email security, it is not surprising that you will be lucky to find everything you need in a single product (although the current drive towards single-product unified threat management - UTM - appliances) may change this. Just on the basis of the above discussion, you will need:
  • Anti-virus software (to ward off viruses and worms)
  • Anti-spyware software (to ward off trojans, adware and spyware)
  • Anti-spam, -phishing, -scam software (to cut down on wasted staff time)
  • Content security software (to make sure confidential, sensitive or illegal content is neither circulated within nor leaked from the company)
  • A company email usage policy (to reduce staff misuse of the email, and give you some redress for when they do misuse it)
  • And last but not least, a secure email (as opposed to email security) capability

The secure email system is possibly the hardest of all. The problem is that it inevitably involves encryption - and the only form of encryption that does not create administrative problems between the sender and the receiver is a public key infrastructure (PKI). But PKI is expensive to run and administer - and gets you involved with even more requirements. For example, if you operate a PKI, then you need to consider identity management software and provisioning software. Nevertheless, if you are a large company with lots of sensitive data, then PKI is the obvious route.

In particular, PKI can demonstrably provide four of the five security basics we noted at the outset of this article: integrity, confidentiality, accountability, availability, non-repudiability (availability is the one not specifically provided by PKI).

If you are a small company with lots of sensitive data, then you should consider a secure email system based on PGP.

If you are a very small company with just the occasional sensitive email, then you should look for a web-hosted secure email solution.

Where do I get Email Security?

If you are looking for email security software then you have a basic choice: you can look for best of breed point products in all of the above; you can look for an email security specialist that bundles different aspects within a single product or suite; or you can go for a hosted service. Check out our Buyer's Guide for a list of suppliers you could investigate.

To learn more about Email Security Vendors, download our Comparison Guide.

Article Tools

Recent Articles