Email Encryption

Posted on 2013-01-07
Last Modified: 2013-02-14
Hi Experts,

I need the ability for my users to send encrypted emails, there seems to be a lot of options TLS PGP. I understand that outlook can also do this with certificates....

Is anyone aware of a simple way of doing this, we dont mind buying a product but it needs to be easy at the recipients end too.

Or is there any good documentation on how to use the Outlook version. We run Office 2010 Pro atm.

Kind Regards,

Question by:carlnys
LVL 13

Accepted Solution

imkottees earned 250 total points
ID: 38753315

Assisted Solution

jodiddy earned 250 total points
ID: 38753347
I have done work with a few financial institutions. Those institutions have always used a third party product to encrypt the messages.  Of course the most secure is not send at all, but to send a message with a link to a protected system that your recipients log into to access the messages sent to them.  Much like your banks that have a secure mailbox for you. ZixCorp offers a box like this that I have found works very well.

Barracuda's Spam & Virus Firewall includes an encryption service.
Appriver - Outlook Encryption in One-Click
ZixCorp is another service I have used.
LVL 79

Expert Comment

by:David Johnson, CD, MVP
ID: 38753751
It will be the security vs convenience sliding scale..
you can use certificates but there must be a way of each user and recipient exchanging certificates, same with pgp you need the recipients public key and they need yours.

you could use winrar/winzip to encrypt a file which contains the message and pass the password to the recipient via different method of communication (would be worthless if sent in the same message)
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

LVL 33

Expert Comment

by:Dave Howe
ID: 38753950
Ok, the key is always, not what the sender can send, but what the recipient can accept.

jodiddy is correct in that most large institutions use what is called an "oracle" based solution (not related to the database company) of which the three big names are pgp inc (now owned by symantec), zixcorp and cisco - for the pgp enterprise gateway, zixmail, and CRES (ironport) solutions respectively

the down side of many such solutions is that the data (or at least the keys to the data) are held by a third party; that is good in many respects (in that the recipients don't need to remember different logins for different sites) but bad in others (in that there is then a single point of failure, a single basket containing all the eggs most attractive to hackers).  PGP do offer the option of having a local server to hold the keys *and* data, but that gets you back to the downside (of users having to set up and maintain an account on your server, in addition to the hundreds of others they have to maintain)

Seriously though, go with setting up your own internal CA and issuing keys to your own outlook users - that is free, and if you use the MS CA and group policy, can be done transparently (so your users find it "just works"). From there, they can get experience on sending and receiving mails between themselves. Then, investigate your intended recipients, see what THEY can support. It is possible they can do the same thing, saving them (and you) the expense of buying in a solution.


you may need to bear in mind any regulatory requirements you might have on discovery, s/mime is notoriously hard to gain authorized administrative access to, as it was not designed with corporate access "built in" - but that's true of almost anything other than the corporate version of pgp, and even there, there is a "gentleman's agreement" that the sender won't deliberately strip the corporate recovery key from the target list before sending.  Gateways are more efficient for that (in that they encrypt/decrypt at the network boundary, so that your internal mailstore remains unencrypted for discovery and/or DLP) but are significantly more expensive than desktop solutions.
LVL 59

Expert Comment

ID: 38838860
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
LVL 33

Expert Comment

by:Dave Howe
ID: 38838861
Three posters (myself included) each gave meaningful information; If you delete on the basis that there isn't enough to "confirm" a given answer, you could delete 90% of the questions on here without giving out any points, and alienate most of your experts.

Might I suggest you get someone with experience in this area (such as Tolomir?) to review?
LVL 33

Expert Comment

by:Dave Howe
ID: 38843253
Not sufficiently arrogant to vote for myself , so I recommend

as the answer (as the queriant explicitly asked for info on setting up outlook) and

as an assisted answer, as oracle based crypto is a better solution than s/mime (almost nobody ends up using s/mime in the real world, as it requires the recipient to create and distribute the key in advance, usually once per year, and getting your customers to do that is a nightmare)

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
A quick guide on how to use Group Policy to create a custom power plan and set it active on Windows 7.
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to:…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question