O365 and encrypted mail to other email systems
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
OK - this ^. Sadly the lawyer only consider this to be "secure email" Without this layer, sending an email is not considered secure, and fails audits.
Here is the bigger concern... this means that you have a social engineer in your midst that should not have access to the systems. So much bigger than your concerns around email security is letting someone who is actively scamming your business in to do an audit. This is, to me, an active criminal of sorts allowed in to look at these systems. That person AND whoever let them in are security vulnerabilities that you need to address.
As another auditor... I would flag those two people as serious issues that should not be allowed access to the records.
OK I'll admit that I tossed the lawyer thing out there for a point - I'm not actually being audited nor have I gone to a lawyer to ask (or my company hasn't asked). But i have read plenty - and you're going to tell me it's all wrong - on the internet that this is the requirement.
-
@Dashrender said in O365 and encrypted mail to other email systems:
Perhaps the messages sits encrypted on the server so O365 admins can't read it, but the decryption code is used as part of the end user's logon process.
Here is my thought there. If my boss can access my account, then their admins can access my boss' account since they can reset it. They've got great processes to make sure that no one does that, yes. But you have the security of that, again, just using TLS.
This just goes to show why the TLS end to end system is the only one that makes sense until you jump to GPG. This silly in between stuff is all just for show.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
I'm getting confused Scott - Data at rest isn't currently a requirement to be encrypted, but damn, when the next rounds of legislation come, I'm sure it will be.
It literally cannot be. If they did that, every medical practice would just back up and be done. You can't control data at rest for transferred data, ever. Period, it's actually a crime to try to do that as you'd have to hack their systems.
Data at rest on my side, of course I can't force their side.
You don't need this for that. You encrypt at rest using disk encryption, not payload encryption. You are getting less security for more work. Disk encryption would protect even the email addresses and transaction history.
No matter what your security goal is, these weird half assed account encryption things don't solve it.
-
@TAHIN said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
But I will capitulate to the fact that once the email is delivered to the remote server, it's no longer my concern, the question is.. is it my responsibility to ensure that the admin of the remote server can't read it as well? If the answer is yes, then you still can't send plain text messages through the TLS pipe.. it still needs to be encrypted itself so that only the receiver can open it.
The answer is no. It made to a receiving SMTP gateway with all the proper TLS stamps. Your job is 100% done.
Exactly. If you want to be as sure as possible, encrypt at rest on your side on disk and require TLS. Done, wash your hands. It doesn't get to be "less your problem" than that.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
But I will capitulate to the fact that once the email is delivered to the remote server, it's no longer my concern, the question is.. is it my responsibility to ensure that the admin of the remote server can't read it as well? If the answer is yes, then you still can't send plain text messages through the TLS pipe.. it still needs to be encrypted itself so that only the receiver can open it.
Agreed, how do Zix or MS or Barracuda handle that? Anything that uses an account doesn't work. Because, for example, @Minion-Queen can access my O365 account, reset it and access my data. So the MS option does NOT protect against admin access to the data, which was my point earlier. The account admin still has access to everything, just like the Exchange admin did before. So... the whole thing is smoke and mirrors to trick people looking for a "security checkbox" but not looking for actual security.
GPG is what really does what you are looking for and trust me NO end user will do it.
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
I know in the case of encrypted files under a single user in Windows, if you reset the password, all files encrypted under the old one will no longer unencrypt. They are lost. Only through a proper normal password change can the user change their password and not loose access to the encrypted files.
Zix, etc could do the same. Fine unlock the account for future messages, but not past ones.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@TAHIN said in O365 and encrypted mail to other email systems:
I believe Barracuda, from their web interface after you log in and decrypt you email, gives you a Deliver option, that will deliver the unencrypted version to the original destination.
Totally bypassing the whole point and tricking the sender into thinking that they secured something that they did not.
yeah, that's a pretty horrible option if it's really there.
Right, which is why I see it as nearly social engineering and being passed through the lawyer making it negligent to push it.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@TAHIN , so - you guys are using a Barracuda appliance - why? According to Scott's and your arguments, it's completely unnecessary.
I did at my last job in the medical sector, but not any more. This is where Scott and my philosophies may differ a little bit. Even though we weren't required to maintain security on the other end, we did fall into the 'best effort' mindset. If we were sending stuff to a lawyer or doctor's office that we didn't have a close relationship with, we did what we could to guarantee security knowing that their email system may have flaws, especially if we had the means. Would we have done it if it weren't a free feature from our anti-spam provider? Probably not.
-
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
I'm getting confused Scott - Data at rest isn't currently a requirement to be encrypted, but damn, when the next rounds of legislation come, I'm sure it will be.
It literally cannot be. If they did that, every medical practice would just back up and be done. You can't control data at rest for transferred data, ever. Period, it's actually a crime to try to do that as you'd have to hack their systems.
Data at rest on my side, of course I can't force their side.
You don't need this for that. You encrypt at rest using disk encryption, not payload encryption. You are getting less security for more work. Disk encryption would protect even the email addresses and transaction history.
No matter what your security goal is, these weird half assed account encryption things don't solve it.
Agreed, I wouldn't use this for encryption on my side, never said I would though either.
-
@Dashrender said in O365 and encrypted mail to other email systems:
I know in the case of encrypted files under a single user in Windows, if you reset the password, all files encrypted under the old one will no longer unencrypt. They are lost. Only through a proper normal password change can the user change their password and not loose access to the encrypted files.
Zix, etc could do the same. Fine unlock the account for future messages, but not past ones.
So your better hope is that an admin could delete ALL of your data without your permission. Yeah, that sounds like a great idea.
Forget your email password, all of your data is scrapped automatically. Total fail. This isn't the CIA, we don't want to burn our data like that.
-
@TAHIN said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@TAHIN , so - you guys are using a Barracuda appliance - why? According to Scott's and your arguments, it's completely unnecessary.
I did at my last job in the medical sector, but not any more. This is where Scott and my philosophies may differ a little bit. Even though we weren't required to maintain security on the other end, we did fall into the 'best effort' mindset. If we were sending stuff to a lawyer or doctor's office that we didn't have a close relationship with, we did what we could to guarantee security knowing that their email system may have flaws, especially if we had the means. Would we have done it if it weren't a free feature from our anti-spam provider? Probably not.
My philosophy is different in that I feel that the additional effort is a huge negative and causes people to do really insecure things or just give up and may often give a false sense of security, like to the auditor in question here.
If I needed to secure to the recipient for sure, GPG every time.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
True, but that brings up my other disaster comment. Need a standard reset that people do all of the time and suddenly your data is getting scraped. That's a really bad process. I know why they need to do it to be really secure, but boy is that bad.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
True, but that brings up my other disaster comment. Need a standard reset that people do all of the time and suddenly your data is getting scraped. That's a really bad process. I know why they need to do it to be really secure, but boy is that bad.
You definitely have a point here, but it does remove the counter point you made earlier.
-
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
-
@Mike-Davis said in O365 and encrypted mail to other email systems:
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
Preach it brother!!!!
-
@Mike-Davis said in O365 and encrypted mail to other email systems:
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
That's an excellent point. It makes the users unable to determine what is and is not safe.
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
If you request the data by email, I don't feel that these fulfil that obligation.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
And that's why other people get socially engineered into ransomware attacks so easilyl
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
Imagine if I call you and tell you that a package is in the mail. It would be insane to say that I sent you the info over the phone, right?
Why do people treat it differently there?
