These are dangerous times for electronic communications. Daily we read of successful cyber-attacks that have breached preventative measures such as firewalls and anti-virus software. For a financial services company, a breach compromising confidential client information is also a reputational breach compromising bonds of trust built over many years with clients.
A recent attack on the New York Times reveals the extent to which organizations are vulnerable. There is actually good news in this article. The term over which the New York Times was attacked was short: four months. Many attacked organizations will go years before learning their security has been compromised. Many will remain unaware.
Last year, the FBI's top cyber cop Shawn Henry spoke to this last point when he noted that they were finding other companies' stolen information in unrelated investigations. He stated, "They are shocked and, in many cases, they've been breached for many months, in some cases years, which means that an adversary had full visibility into everything occurring on that network."
The steady increase in the number of successful attacks has created a tipping point where many security professionals have now accepted that, despite their best efforts, their security will be breached. The next logical question is then "When we are breached, what will the cyber thieves have access to?" It is this question that is driving the need for secure email.
Secure Email
Even when a network, server or desktop computer has been breached, secure email keeps your confidential information from being compromised. When a notebook computer or mobile device is lost, secure email ensures that there is no trace of any confidential communications on the lost device. In the real world where companies are successfully attacked, the use of secure email ensures that the vault is empty when the thieves arrive.
The first challenge in implementing secure email is understanding fully what is required to secure messages and documents.
Hardened client software
The widespread use of the internet for email and browsing the Web has been based upon the adoption of open standards. Unfortunately, from a security perspective, this means that security standards will differ greatly from one user to the next. Each user will run different browsers and different email clients; any one of which could be compromised.
Annually, at a contest known as Pwn2Own, "white hat" ethical hackers continue to successfully breach the major browsers in very little time.
In order to secure email, all endpoints and users involved in the communications must have the same secure "machine." To use a metaphor, Batman's bat phone isn't very useful if Commissioner Gordon doesn't own one as well.
Features such as traceless communications and copy protection cannot be provided using standard browsers or email clients. In order to facilitate secure communications, both senders and recipients must be running the same hardened software. Hardened software uses special techniques to ensure that hackers cannot tamper with the various modules constituting the complete application.
While it is more complicated to write such software, once written it prevents hackers from injecting their own code into the running application in hopes of intercepting your communications.
Copy Protection
If you can't control the copies, you cannot secure communications. Each copy becomes another potential source which could be breached. If you want to protect a message or document, you put it in a safe place and you prevent copies from being made. Unfortunately, conventional email by design does exactly the opposite.
After hitting Send, within seconds, copies are made and forwarded to servers, desktops and mobile devices. The recipient is free to make unauthorized copies and can forward to anyone with a valid email address without the sender's knowledge or consent.
By comparison, secure email provides recipients with view-only access to copy protected messages and documents. The viewing is done virtually; whereby no trace of communications resides in the conventional email system, the network, on the desktop or a mobile device. Further, recipients cannot save, copy, print or forward these copy-protected communications.
Even common backdoors such as print screen, screen clipping/recording, web conferencing, etc., cannot be used to create copies. The sender retains full control of their messages and documents after they are sent.
Access Control and History
With conventional email, once the sender hits Send, all control is lost. Even if the sender requests a read receipt; this is optional for the recipient.
Secure email provides senders with complete control over their communications. Senders can withdraw access to copy-protected messages and documents at any time; even while recipients are viewing communications.
They can also specify access periods after which copy protected documents become inaccessible. Access history is automatically recorded such that the sender can determine which recipients have read their messages and documents, when they were read and how many times.
Lifecycle Management
In the era of conventional email, organizations have essentially given up on the idea of being able to enforce retention policies for communications. There are simply too many copies of the same thing in various locations for this to be practical. Conventional email has an almost perpetual life; regardless of whatever policies an organization may set.
With secure email, copy protected communications will only reside in one location. When the policy-based retention period for a message or document expires, it can be permanently deleted; ensuring that the one copy no longer exists. This management of communications can greatly reduce the costs of legal discovery and reduce business risk and exposure for firms.
In financial service companies, confidential client and transaction information passes daily through the conventional email system. These communications will not only reside within the desktops and servers of the financial company but will also propagate to customer networks, servers, desktops and mobile devices. Any of these locations could be successfully breached; often without being detected and often for long periods of time.
Financial services companies now need to look beyond existing conventional email systems in order to secure email within their organization and outside their organization to customers.
Andy Coutts is CEO of Evizone Ltd. in Ottawa, Ontario.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
