O365 and encrypted mail to other email systems
-
@coliver said in O365 and encrypted mail to other email systems:
Exchange Online is encrypted from the endpoint to the server. So when a user sends an email from inside your domain to another user inside your domain it is encrypted end-to-end.
More importantly, it is encrypted end to end with any normal user on the other side, as well. Basically all business and most consumer email domains are secured end to end today. So you'd have to find someone who has seriously opted out of the security to not have end to end, user to user security for email today and it would always be at the discretion of the other party. That's what's great about email today, for all intents and purposes, it is totally secure. The "email security" concerns of the past have been solved because of TLS and web interfaces.
-
@coliver said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
Exchange Online is encrypted from the endpoint to the server. So when a user sends an email from inside your domain to another user inside your domain it is encrypted end-to-end.
Correct, I do understand this, but this is not my goal.
The goal isn't user-to-user encryption? I thought that was what you had stated a few posts earlier.
I think that he stated incorrectly. That's what he has. What he actually wants is a non-transparently, individually encrypted payload that has to be decrypted manually by the end user. Like GPG.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
Exchange Online is encrypted from the endpoint to the server. So when a user sends an email from inside your domain to another user inside your domain it is encrypted end-to-end.
Correct, I do understand this, but this is not my goal.
The goal isn't user-to-user encryption? I thought that was what you had stated a few posts earlier.
I think that he stated incorrectly. That's what he has. What he actually wants is a non-transparently, individually encrypted payload that has to be decrypted manually by the end user. Like GPG.
Ah, so the goal is to make email impossible to use so your users go to some other insecure method of communication.
-
Which is not actually email encryption, that's part of why these discussions go this way.
Email IS encrypted and incredibly secure. The issue here isn't based on security.
What Zix, Microsoft's solution or GPG do, actually, is encrypt a separate file that the already secure email delivery system delivers. It's payload encryption, but as the payload itself isn't actually email, the term email encryption makes this confusing. It's literally no different than using 7zip to encrypt want you want to send, just more convenient (barely.)
-
This compares to something like Barracuda Mail Encryption. It's shining point isn't really around mail in transit, but mail at rest at the destination. TLS is great until that email sits unencrypted in a recipients gmail box that 80 hackers and your kids have the password to. It's a legitimate concern as a business owner... you want it to be secure end to end.
That said, there is no requirement, HIPAA or PCI or otherwise, that places the burden of safety of that email in your hands. Once it's over the wire encrypted, it's no longer your problem. But I do understand it's value; we used Barracuda email encryption whenever we would (be forced to) send PHI to another doctor office.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
Exchange Online is encrypted from the endpoint to the server. So when a user sends an email from inside your domain to another user inside your domain it is encrypted end-to-end.
Correct, I do understand this, but this is not my goal.
The goal isn't user-to-user encryption? I thought that was what you had stated a few posts earlier.
I think that he stated incorrectly. That's what he has. What he actually wants is a non-transparently, individually encrypted payload that has to be decrypted manually by the end user. Like GPG.
OK - this ^. Sadly the lawyer only consider this to be "secure email" Without this layer, sending an email is not considered secure, and fails audits.
Yes I understand all the other stated things, but they don't matter, sadly - only the audit matters.
-
I think that the sole benefit of a system like this is that you can secure the email so that your own and their own (sender and receiver) admins cannot view the mail. However, that shifts the entire burden of security management onto the receiver of the email. So it causes huge management issues because the users cannot turn to their IT departments to enable this for them and, if they do, it disables the only goal that the system can have because it reverts it to the same security as TLS before.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@coliver said in O365 and encrypted mail to other email systems:
Exchange Online is encrypted from the endpoint to the server. So when a user sends an email from inside your domain to another user inside your domain it is encrypted end-to-end.
Correct, I do understand this, but this is not my goal.
The goal isn't user-to-user encryption? I thought that was what you had stated a few posts earlier.
I think that he stated incorrectly. That's what he has. What he actually wants is a non-transparently, individually encrypted payload that has to be decrypted manually by the end user. Like GPG.
OK - this ^. Sadly the lawyer only consider this to be "secure email" Without this layer, sending an email is not considered secure, and fails audits.
Yes I understand all the other stated things, but they don't matter, sadly - only the audit matters.
That's fine, thanks for clarifying your goal. We have similar issues here.
-
@Dashrender said in O365 and encrypted mail to other email systems:
Yes I understand all the other stated things, but they don't matter, sadly - only the audit matters.
In that case your question should be worded around that specific context. The issue at hand is not security, email or encryption. It's tricking a lawyer who is unethically doing a job far over his head.
-
@TAHIN said in O365 and encrypted mail to other email systems:
This compares to something like Barracuda Mail Encryption. It's shining point isn't really around mail in transit, but mail at rest at the destination.
No, that doesn't hold up. Encryption at rest is yet a third issue. Both of these mechanisms decrypt along the chain. Only the recipient, literally only they, can decide to be encrypted at rest. That's never something that you can force. You can force it on the sender's side, and this isn't doing that here. But you have to trust the recipient to store it in an encrypted fashion and... none will.
-
@Dashrender see my note above regarding compliance. You can compare it to FAX.
If I send PHI over fax to a fax machine in a remote location, it is the responsibility of the remote party to keep it secure. -
@TAHIN said in O365 and encrypted mail to other email systems:
That said, there is no requirement, HIPAA or PCI or otherwise, that places the burden of safety of that email in your hands. Once it's over the wire encrypted, it's no longer your problem.
Exactly, offer it to them securely, after that, it is ALL their problem.
-
@TAHIN said in O365 and encrypted mail to other email systems:
That said, there is no requirement, HIPAA or PCI or otherwise, that places the burden of safety of that email in your hands. Once it's over the wire encrypted, it's no longer your problem. But I do understand it's value; we used Barracuda email encryption whenever we would (be forced to) send PHI to another doctor office.
Interesting - I'll agree that it's not my concern about the PHI after it's received, but you can't ensure that all data being sent to other email servers is being sent over TLS short of disabling your server's ability to send except over TLS. And while I agree that the failure rate would be low, it's no lower than the desire from my management to be able to send 500 MB files over email to people. So the failure rate is there, and will be noticed and problematic.
But then also comes the part when the first time some one is sued because you emailed their PHI to them, and they didn't secure it, and because it was sitting unencrypted in their easy to guess gmail account - the courts will sadly rule against us saying that we're the ones with the money so we should be the ones making sure they secure their shit.. SIGH
-
@Dashrender said in O365 and encrypted mail to other email systems:
But then also comes the part when the first time some one is sued because you emailed their PHI to them, and they didn't secure it, and because it was sitting unencrypted in their easy to guess gmail account - the courts will sadly rule against us saying that we're the ones with the money so we should be the ones making sure they secure their shit.. SIGH
Is there precedence for this? I've never heard of this.
-
@coliver said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
But then also comes the part when the first time some one is sued because you emailed their PHI to them, and they didn't secure it, and because it was sitting unencrypted in their easy to guess gmail account - the courts will sadly rule against us saying that we're the ones with the money so we should be the ones making sure they secure their shit.. SIGH
Is there precedence for this? I've never heard of this.
No, not yet... I was simply ranting
-
@TAHIN said in O365 and encrypted mail to other email systems:
@Dashrender see my note above regarding compliance. You can compare it to FAX.
If I send PHI over fax to a fax machine in a remote location, it is the responsibility of the remote party to keep it secure.See my reply/rant
-
@scottalanmiller I might understand the O365 offering wrong then. I thought it was like
- Sender chooses to encrypt via 3rd party O365 service.
- Email sends securely over TLS. The recipient receives a link.
- Recipient clicks link, verifies their identity via a MS account, and can interact with the email in the cloud. The email contents never touch their local email service.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@TAHIN said in O365 and encrypted mail to other email systems:
That said, there is no requirement, HIPAA or PCI or otherwise, that places the burden of safety of that email in your hands. Once it's over the wire encrypted, it's no longer your problem. But I do understand it's value; we used Barracuda email encryption whenever we would (be forced to) send PHI to another doctor office.
Interesting - I'll agree that it's not my concern about the PHI after it's received, but you can't ensure that all data being sent to other email servers is being sent over TLS short of disabling your server's ability to send except over TLS. And while I agree that the failure rate would be low, it's no lower than the desire from my management to be able to send 500 MB files over email to people. So the failure rate is there, and will be noticed and problematic.
You think that the failure rate of a system like this will be lower? Guess who can't open these emails... anyone. Because it's a separately encrypted system. You are going to have so many people pissed off because you are withholding their personal data until they set up accounts with some third party who controls their data. That's going to be a much bigger issue, I guarantee it.
And ensuring secure deliver is zero concern to you. Offering it is all that you care about.
-
@Dashrender said in O365 and encrypted mail to other email systems:
But then also comes the part when the first time some one is sued because you emailed their PHI to them, and they didn't secure it, and because it was sitting unencrypted in their easy to guess gmail account - the courts will sadly rule against us saying that we're the ones with the money so we should be the ones making sure they secure their shit.. SIGH
Then you sue them, not they sue you. They are the ones violating PHI, not you.
If you have this concern, why not force TLS? When do you want to send when TLS is off... that's the real question?
-
@Dashrender said in O365 and encrypted mail to other email systems:
But then also comes the part when the first time some one is sued because you emailed their PHI to them, and they didn't secure it, and because it was sitting unencrypted in their easy to guess gmail account - the courts will sadly rule against us saying that we're the ones with the money so we should be the ones making sure they secure their shit.. SIGH
In all honesty I don't think that could ever happen. The judge would be putting unlawful burden on an organization and the appeal would last about 3 minutes.
