O365 and encrypted mail to other email systems
-
@TAHIN said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
But I will capitulate to the fact that once the email is delivered to the remote server, it's no longer my concern, the question is.. is it my responsibility to ensure that the admin of the remote server can't read it as well? If the answer is yes, then you still can't send plain text messages through the TLS pipe.. it still needs to be encrypted itself so that only the receiver can open it.
The answer is no. It made to a receiving SMTP gateway with all the proper TLS stamps. Your job is 100% done.
Exactly. If you want to be as sure as possible, encrypt at rest on your side on disk and require TLS. Done, wash your hands. It doesn't get to be "less your problem" than that.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
But I will capitulate to the fact that once the email is delivered to the remote server, it's no longer my concern, the question is.. is it my responsibility to ensure that the admin of the remote server can't read it as well? If the answer is yes, then you still can't send plain text messages through the TLS pipe.. it still needs to be encrypted itself so that only the receiver can open it.
Agreed, how do Zix or MS or Barracuda handle that? Anything that uses an account doesn't work. Because, for example, @Minion-Queen can access my O365 account, reset it and access my data. So the MS option does NOT protect against admin access to the data, which was my point earlier. The account admin still has access to everything, just like the Exchange admin did before. So... the whole thing is smoke and mirrors to trick people looking for a "security checkbox" but not looking for actual security.
GPG is what really does what you are looking for and trust me NO end user will do it.
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
I know in the case of encrypted files under a single user in Windows, if you reset the password, all files encrypted under the old one will no longer unencrypt. They are lost. Only through a proper normal password change can the user change their password and not loose access to the encrypted files.
Zix, etc could do the same. Fine unlock the account for future messages, but not past ones.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@TAHIN said in O365 and encrypted mail to other email systems:
I believe Barracuda, from their web interface after you log in and decrypt you email, gives you a Deliver option, that will deliver the unencrypted version to the original destination.
Totally bypassing the whole point and tricking the sender into thinking that they secured something that they did not.
yeah, that's a pretty horrible option if it's really there.
Right, which is why I see it as nearly social engineering and being passed through the lawyer making it negligent to push it.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@TAHIN , so - you guys are using a Barracuda appliance - why? According to Scott's and your arguments, it's completely unnecessary.
I did at my last job in the medical sector, but not any more. This is where Scott and my philosophies may differ a little bit. Even though we weren't required to maintain security on the other end, we did fall into the 'best effort' mindset. If we were sending stuff to a lawyer or doctor's office that we didn't have a close relationship with, we did what we could to guarantee security knowing that their email system may have flaws, especially if we had the means. Would we have done it if it weren't a free feature from our anti-spam provider? Probably not.
-
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
I'm getting confused Scott - Data at rest isn't currently a requirement to be encrypted, but damn, when the next rounds of legislation come, I'm sure it will be.
It literally cannot be. If they did that, every medical practice would just back up and be done. You can't control data at rest for transferred data, ever. Period, it's actually a crime to try to do that as you'd have to hack their systems.
Data at rest on my side, of course I can't force their side.
You don't need this for that. You encrypt at rest using disk encryption, not payload encryption. You are getting less security for more work. Disk encryption would protect even the email addresses and transaction history.
No matter what your security goal is, these weird half assed account encryption things don't solve it.
Agreed, I wouldn't use this for encryption on my side, never said I would though either.
-
@Dashrender said in O365 and encrypted mail to other email systems:
I know in the case of encrypted files under a single user in Windows, if you reset the password, all files encrypted under the old one will no longer unencrypt. They are lost. Only through a proper normal password change can the user change their password and not loose access to the encrypted files.
Zix, etc could do the same. Fine unlock the account for future messages, but not past ones.
So your better hope is that an admin could delete ALL of your data without your permission. Yeah, that sounds like a great idea.
Forget your email password, all of your data is scrapped automatically. Total fail. This isn't the CIA, we don't want to burn our data like that.
-
@TAHIN said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@TAHIN , so - you guys are using a Barracuda appliance - why? According to Scott's and your arguments, it's completely unnecessary.
I did at my last job in the medical sector, but not any more. This is where Scott and my philosophies may differ a little bit. Even though we weren't required to maintain security on the other end, we did fall into the 'best effort' mindset. If we were sending stuff to a lawyer or doctor's office that we didn't have a close relationship with, we did what we could to guarantee security knowing that their email system may have flaws, especially if we had the means. Would we have done it if it weren't a free feature from our anti-spam provider? Probably not.
My philosophy is different in that I feel that the additional effort is a huge negative and causes people to do really insecure things or just give up and may often give a false sense of security, like to the auditor in question here.
If I needed to secure to the recipient for sure, GPG every time.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
True, but that brings up my other disaster comment. Need a standard reset that people do all of the time and suddenly your data is getting scraped. That's a really bad process. I know why they need to do it to be really secure, but boy is that bad.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
You're assuming that that Zix, MS and Barracuda solutions allow you to reset them.
It's account based. And MS at least allows account resets.
What is account based? the encryption? so what? The account could have a key inside it that is lost if there is a forced reset by admins - Damn I'll have to dig up the dialog boxes that say this. Just because you can reset the password does not mean you have access to the past stuff, only future stuff.
True, but that brings up my other disaster comment. Need a standard reset that people do all of the time and suddenly your data is getting scraped. That's a really bad process. I know why they need to do it to be really secure, but boy is that bad.
You definitely have a point here, but it does remove the counter point you made earlier.
-
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
-
@Mike-Davis said in O365 and encrypted mail to other email systems:
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
Preach it brother!!!!
-
@Mike-Davis said in O365 and encrypted mail to other email systems:
The thing I don't like about the third party options is we have been telling our users for years not to click or run stuff inside of emails... This forces them to do that to get their message. In that regard it makes the users less secure because now they are a little more click happy.
That's an excellent point. It makes the users unable to determine what is and is not safe.
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
If you request the data by email, I don't feel that these fulfil that obligation.
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
And that's why other people get socially engineered into ransomware attacks so easilyl
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
Imagine if I call you and tell you that a package is in the mail. It would be insane to say that I sent you the info over the phone, right?
Why do people treat it differently there?
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
And that's why other people get socially engineered into ransomware attacks so easilyl
You get a +1 and a Thumbs up for that!
-
@scottalanmiller said in O365 and encrypted mail to other email systems:
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
And honestly, if you said "well I emailed you the info" I'd say "Um, no, you emailed me an announcement that I could get the info elsewhere, that's not the same."
This is something few others than Scott would say.
Imagine if I call you and tell you that a package is in the mail. It would be insane to say that I sent you the info over the phone, right?
Why do people treat it differently there?
I don't think that's a good example. If you want to use mail - then I'd say something close would be the note left on your door that the package wasn't left because your porch wasn't a secure location, so we left it at the PO for you to pick up.
-
@Dashrender said in O365 and encrypted mail to other email systems:
@scottalanmiller said in O365 and encrypted mail to other email systems:
@TAHIN said in O365 and encrypted mail to other email systems:
@scottalanmiller said in [O365 and encrypted mail to other email systems](/topic/9231/o365-and-encrypted-mail-to-other-email-the user almost certainly does not have a Microsoft account and instead of sending them their data we've are forcing them to sign up with a third party vendor who is holding their data until they get them as a customer (even if only as a free one.)
Yeah, the fact that it has to be an entire MS account on the part of the recipient would be a dealbreaker for me.
Yeah, I don't like that "a third party owns your data" thing. It is the same with Zix and everyone else. I'd find that very distasteful as a customer. It's my data, you have a secure way to send it to me already, why do I have to make an account with a third party to get my own data over a channel that is already secure?
Because it's not really secure. The admins of the system of email you use have full access to that data.
You are contradicting yourself. You just said a few posts up that Zix does exactly this anyway it the recipient's domain is also a Zix customer. What is on the other end simply does not matter. We all keep telling you that. It only matters that you send from your server to theirs are encrypted.
