O365 and encrypted mail to other email systems
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
Well this is three years old but this guy really doesn't like only using TLS - but he doesn't specifically mention locking your server down to sending TLS only.
http://betanews.com/2013/09/02/5-big-myths-surrounding-computer-security-and-hipaa-compliance/
It's about 1/3rd the way down.
frankly I see a lot of things I don't like/agree with in this writeup.
He claims that GMail doesn't have TLS. That's definitely not true. His whole theory is based on assuming that no one does TLS, but who doesn't do TLS?
Well today, many do, But I won't say most do.
That write up is 3+ years ago.The real question is... who doesn't?
According to PC World, GMail was 100% by 2010, Yahoo offered it at the time of the above article and forced everyone to it by 2014: http://www.pcworld.com/article/2085700/as-yahoo-makes-encryption-standard-for-email-weak-implementation-seen.html
We know that Microsoft does. Rackspace does, I guarantee that Amazon does. Unless we are worried about the Zix kinds of companies avoiding it just to create insecurity in order to implement it again at high cost another way... who is there to not have TLS? Basically every major free player and anyone running their own systems either have it by force or must not have it by intention - in either case, not our concern.
The only question is... who is on hosted, insecure email? My guess is, no one that you can find.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
The only question is... who is on hosted, insecure email? My guess is, no one that you can find.
Those aren't the people I'm worried about - at least not the free hosted ones for sure.
I'm more concerned with hospital, lawyers, small clinics, etc and what they are using for email. As discussed here and elsewhere for years, these guys move at a glacial pace. Many of them are super cheap too, so they look at subscription plans like O365 and it's forever payments, and make the sometimes invalid assumption that it costs more than a self hosted solution (now personally - there many times where self hosted is cheaper, but it's also riskier) so they refuse to move. It's these people that we have no idea if they have TLS implemented or not. Of course we'd love to hope that they are, but until we try, we have no clue.
-
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
-
-
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
It becomes a simple choice, though... Spend money for a third-party product... or use standards based stuff and not spend money...
-
-
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
Because you described it poorly. I need more coffee to phrase something better, but you could certainly have sold it better.
-
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
The only question is... who is on hosted, insecure email? My guess is, no one that you can find.
Those aren't the people I'm worried about - at least not the free hosted ones for sure.
I'm more concerned with hospital, lawyers, small clinics, etc and what they are using for email. As discussed here and elsewhere for years, these guys move at a glacial pace. Many of them are super cheap too, so they look at subscription plans like O365 and it's forever payments, and make the sometimes invalid assumption that it costs more than a self hosted solution (now personally - there many times where self hosted is cheaper, but it's also riskier) so they refuse to move. It's these people that we have no idea if they have TLS implemented or not. Of course we'd love to hope that they are, but until we try, we have no clue.
If they are self hosted, TLS is at their own discretion.
-
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
That's not a rock and a hard place. It's a great option and a horrible one.
It is more like:
-
Buy a non-email proprietary product that doesn't work at all unless you force every remote users to join up with the product that you have forced down their throats. This isn't email and doesn't satisfy any requirement for email and if doing this, you could do any number of random non-email things like running your own FTP server, that's all that they are doing.
-
Use TLS and provide an awesome, transparent, fully secure option that is email based and works for anyone with the slightest care OR anyone that uses free systems. Force it and "maybe" some places that have done ridiculous things to not have TLS "might" not get your email.
-
Use TLS opportunistically and let customers decide if they want security on or off.
Two good options, one bad one. If she feels like choice 1 is a valid option, it's because she is confused. Why does she feel that there is even a reason to be choosing? How is choice one even being considered once you explained it?
-
-
@dafyre said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
It becomes a simple choice, though... Spend money for a third-party product... or use standards based stuff and not spend money...
All of the caveats of the TLS option apply to the third party one, too. So I think that the nature of the logic simply rules choice one out because of that.
-
-
Frame it more like this, at least to yourself:
TLS Pros Compared to Zix: Cheaper, Standard, Nearly all customers get an effortless experience.
Zix Pros Compared to TLS: None
-
@JaredBusch said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
Because you described it poorly. I need more coffee to phrase something better, but you could certainly have sold it better.
Please - maestro - amaze me with your wordsmithing!
-
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
That's not a rock and a hard place. It's a great option and a horrible one.
It is more like:
-
Buy a non-email proprietary product that doesn't work at all unless you force every remote users to join up with the product that you have forced down their throats. This isn't email and doesn't satisfy any requirement for email and if doing this, you could do any number of random non-email things like running your own FTP server, that's all that they are doing.
-
Use TLS and provide an awesome, transparent, fully secure option that is email based and works for anyone with the slightest care OR anyone that uses free systems. Force it and "maybe" some places that have done ridiculous things to not have TLS "might" not get your email.
-
Use TLS opportunistically and let customers decide if they want security on or off.
Two good options, one bad one. If she feels like choice 1 is a valid option, it's because she is confused. Why does she feel that there is even a reason to be choosing? How is choice one even being considered once you explained it?
First the easy one, #3 isn't HIPAA compliant, so it's out.
#2 is a pain, because when it fails a different solution will have to be found/used to communicate with that contact.
#1 while potentially painful, is more ensuring that there will never be a failure. The use of non TLS email is mitigated by sending an no PHI containing notice that informs the receiver that there is a message for them, but it must be picked up through a secure means.
Now #1 being said, I don't believe that Zix will actually allow for the use of TLS only based encryption - assuming it's available, so all encrypted communications would be the painful type.
-
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
Frame it more like this, at least to yourself:
TLS Pros Compared to Zix: Cheaper, Standard, Nearly all customers get an effortless experience.
Zix Pros Compared to TLS: None
Disagree Zix does have one Pro: able to send notice of desire to communicate, but TLS isn't available, so you must use another more painful means.
-
@Dashrender said in O365 and encrypted mail to other email systems:
First the easy one, #3 isn't HIPAA compliant, so it's out.
That's not true. If that were true, faxing would be out. You know that faxing is okay, so you know that this is okay. It's that easy.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
So I mentioned the TLS only option to my boss yesterday.
I broke it down and told her there are basically two options:
-
get a third party bolt on product like Zix, Barracuda, etc. This will be a subscription service that we have to pay for all of our users forever, but this option does allow for on/off of encrypted user to user email.
-
Force our email server to use TLS for all connections. If we try to send an email to someone who's server doesn't support TLS, we simply can't send to them. Period. This is the free option.
She left the conversation saying that I always leave her between a rock and a hard place.
That's not a rock and a hard place. It's a great option and a horrible one.
It is more like:
-
Buy a non-email proprietary product that doesn't work at all unless you force every remote users to join up with the product that you have forced down their throats. This isn't email and doesn't satisfy any requirement for email and if doing this, you could do any number of random non-email things like running your own FTP server, that's all that they are doing.
-
Use TLS and provide an awesome, transparent, fully secure option that is email based and works for anyone with the slightest care OR anyone that uses free systems. Force it and "maybe" some places that have done ridiculous things to not have TLS "might" not get your email.
-
Use TLS opportunistically and let customers decide if they want security on or off.
Two good options, one bad one. If she feels like choice 1 is a valid option, it's because she is confused. Why does she feel that there is even a reason to be choosing? How is choice one even being considered once you explained it?
First the easy one, #3 isn't HIPAA compliant, so it's out.
#2 is a pain, because when it fails a different solution will have to be found/used to communicate with that contact.
#1 while potentially painful, is more ensuring that there will never be a failure. The use of non TLS email is mitigated by sending an no PHI containing notice that informs the receiver that there is a message for them, but it must be picked up through a secure means.
Now #1 being said, I don't believe that Zix will actually allow for the use of TLS only based encryption - assuming it's available, so all encrypted communications would be the painful type.
#1 is always more painful. You're forcing all users to do this thing, whatever it happens to be, for every customer. Instead of using an industry standard mechanism that may not work for 1-5% of customers... So #2 will work 95% of the time.
-
-
@Dashrender said in O365 and encrypted mail to other email systems:
Disagree Zix does have one Pro: able to send notice of desire to communicate, but TLS isn't available, so you must use another more painful means.
Nope, you can make rules for TLS that allow you to send notification but not the payload.
-
@Dashrender said in O365 and encrypted mail to other email systems:
#1 while potentially painful, is more ensuring that there will never be a failure.
No, it ensures that there is almost always a failure. I know places using these systems right now (hospital) that can't get prompt IT support because they have to send emails to third parties, get them to unencrypt and then transfer over TLS on their behalf because the systems aren't reliable. I deal with this every few days. Reliable is the last thing that these systems are.
-
@Dashrender said in O365 and encrypted mail to other email systems:
#2 is a pain, because when it fails a different solution will have to be found/used to communicate with that contact.
Use non TLS email for that if you want. but you can just send the payload, still safer than faxing. So totally HIPAA compliant.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
First the easy one, #3 isn't HIPAA compliant, so it's out.
That's not true. If that were true, faxing would be out. You know that faxing is okay, so you know that this is okay. It's that easy.
Seriously bro! we need to have a face to face on this one! I understand the insecure portions you talk about, but for some deity's sake - you have yet to convenience me why faxing is so much more insanely insecure than email - But that's for another time!
Leave faxing out of this conversation and give me another example why #3 would be compliant?
-
@Dashrender said in O365 and encrypted mail to other email systems:
Seriously bro! we need to have a face to face on this one! I understand the insecure portions you talk about, but for some deity's sake - you have yet to convenience me why faxing is so much more insanely insecure than email - But that's for another time!
We have. It's covered. Faxing is the well known least secure possible option. Every aspect of it, every one, is the least security possible. You can't make a system less secure without resorting to public broadcast systems like bulletin boards.
-
@Dashrender said in O365 and encrypted mail to other email systems:
Leave faxing out of this conversation and give me another example why #3 would be compliant?
What do you mean? It's not my burden to bear. You have to show why it is NOT compliant as you made the claim. I know that it's safer than faxing, by a LOT. So... either faxing isn't allowed (it is) or email is okay (based on being more secure.) It's that simple.
