Home > Ask the Security Experts > Application Security Questions & Answers > How to prevent poor e-mail practices
Ask The Security Expert: Questions & Answers
EMAIL THIS

How to prevent poor e-mail practices

Michael Cobb EXPERT RESPONSE FROM: Michael Cobb

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 14 December 2005
How can I "prove" that sending confidential information to customers across the Internet without encryption is a poor business practice?

>
EXPERT RESPONSE
The Internet is a high-risk environment and according to the FBI's International Computer Crime Squad, one of the most common cyber crimes committed against businesses over the Internet is theft of trade secrets. While many businesses shred their sensitive paper documents to combat dumpster diving, very few encrypt their sensitive digital documents and e-mails to combat cyber espionage.

Sending an e-mail is the equivalent of sending a postcard – anyone can read it. Once an e-mail leaves a computer, it travels over multiple online services and open networks to reach its destination. It can be intercepted and read anywhere during its journey. It can also be read from the numerous backup devices and will be stored by various routing services. For example, co-workers can easily intercept an e-mail sent from an office computer as it travels through the corporate network. In addition, external e-mails travel to and from a computer via an Internet Service Provider (ISP), making ISPs one of the easiest places to intercept traffic. Broadband users share the local loop, which means neighborhood Internet traffic shares the same physical wires. With certain bits of hardware and some know-how, a hacker can easily intercept an e-mail on its way across the local loop. Finally, wireless network traffic is susceptible to interception at the base station for the antenna.

These examples are by no means the only places e-mail can be compromised, and with thousands of hackers on the Internet and so many vulnerable points, never assume an e-mail is private, unless it is encrypted.

Your clients not only need to encrypt their e-mail, but all their sensitive files and data too. They should also be enforcing a security policy aimed at securing their computers against spyware and malicious code to prevent computer-hacking and illegal eavesdropping by hackers and their competitors.


More Information

  • Attend Lesson 3 of E-mail Security School to learn about e-mail policy control.


  • Sound Off! -   Be the first to post a message to Sound Off!


    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Application Security
    Protecting exposed servers from Google hacks (and Google 'dorks')
    Which automated quality assurance tools can be used to test software?
    Has proof-of-concept mobile device malware translated into any meaningful attacks?
    How to test the security of personal details submitted to a website
    Is security improved when the number of Internet gateways is reduced?
    Are Internet cafe users' email credentials at risk?
    Which operating system can best secure an FTP site?
    Will firewall technology have to adapt to applications that use port 80?
    How secure is a mobile phone platform that has an open source framework?
    What ports should be opened and closed when IPsec filters are implemented?

    Email Encryption (SMIME & PGP)
    Tumbleweed merger seen as a negative for email security customers
    Secure messaging complications result in limited protection
    Information security book excerpts and reviews
    ING hopes to cut phishing attacks with encryption software
    Companies still monitoring email manually, survey finds
    Should iPhone email be sent without SSL encryption?
    Can the symmetric encryption algorithm for S/MIME messages be changed?
    Security vendor Postini acquired by Google
    Which email encryption products can be released internationally?
    What are the pros and cons of using an email encryption gateway?
    Email Encryption (SMIME & PGP) Research

    Acceptable Use Policy
    Can DHCP be used to selectively block instant messaging clients?
    Can watching online videos present enterprise security risks?
    What are the best security practices to consider when developing a corporate blog?
    Database authentication, encryption getting priority in some businesses
    Online game exploits threaten IT security
    Boston Celtics face off against spyware
    Blocking Web anonymizers in the enterprise
    Veterans Affairs data theft should be 'call to arms'
    Survey: Women more likely to download spyware
    Scam artists flocking to MySpace
    Acceptable Use Policy Research

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    asymmetric cryptography  (SearchSecurity.com)
    cryptographic checksum  (SearchSecurity.com)
    data encryption/decryption IC  (SearchSecurity.com)
    deniable encryption  (SearchSecurity.com)
    elliptical curve cryptography  (SearchSecurity.com)
    Escrowed Encryption Standard  (SearchSecurity.com)
    MPPE  (SearchSecurity.com)
    Quiz: Cryptography  (SearchSecurity.com)
    session key  (SearchSecurity.com)
    Twofish  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice

    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineWebcastsWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts