Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Email Encryption

Posted on 2013-01-07
Medium Priority
Last Modified: 2013-02-14
Hi Experts,

I need the ability for my users to send encrypted emails, there seems to be a lot of options TLS PGP. I understand that outlook can also do this with certificates....

Is anyone aware of a simple way of doing this, we dont mind buying a product but it needs to be easy at the recipients end too.

Or is there any good documentation on how to use the Outlook version. We run Office 2010 Pro atm.

Kind Regards,

Question by:carlnys
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 13

Accepted Solution

imkottees earned 1000 total points
ID: 38753315

Assisted Solution

jodiddy earned 1000 total points
ID: 38753347
I have done work with a few financial institutions. Those institutions have always used a third party product to encrypt the messages.  Of course the most secure is not send at all, but to send a message with a link to a protected system that your recipients log into to access the messages sent to them.  Much like your banks that have a secure mailbox for you. ZixCorp offers a box like this that I have found works very well.

Barracuda's Spam & Virus Firewall includes an encryption service.
Appriver - Outlook Encryption in One-Click
ZixCorp is another service I have used.
LVL 83

Expert Comment

by:David Johnson, CD, MVP
ID: 38753751
It will be the security vs convenience sliding scale..
you can use certificates but there must be a way of each user and recipient exchanging certificates, same with pgp you need the recipients public key and they need yours.

you could use winrar/winzip to encrypt a file which contains the message and pass the password to the recipient via different method of communication (would be worthless if sent in the same message)
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

LVL 33

Expert Comment

by:Dave Howe
ID: 38753950
Ok, the key is always, not what the sender can send, but what the recipient can accept.

jodiddy is correct in that most large institutions use what is called an "oracle" based solution (not related to the database company) of which the three big names are pgp inc (now owned by symantec), zixcorp and cisco - for the pgp enterprise gateway, zixmail, and CRES (ironport) solutions respectively

the down side of many such solutions is that the data (or at least the keys to the data) are held by a third party; that is good in many respects (in that the recipients don't need to remember different logins for different sites) but bad in others (in that there is then a single point of failure, a single basket containing all the eggs most attractive to hackers).  PGP do offer the option of having a local server to hold the keys *and* data, but that gets you back to the downside (of users having to set up and maintain an account on your server, in addition to the hundreds of others they have to maintain)

Seriously though, go with setting up your own internal CA and issuing keys to your own outlook users - that is free, and if you use the MS CA and group policy, can be done transparently (so your users find it "just works"). From there, they can get experience on sending and receiving mails between themselves. Then, investigate your intended recipients, see what THEY can support. It is possible they can do the same thing, saving them (and you) the expense of buying in a solution.


you may need to bear in mind any regulatory requirements you might have on discovery, s/mime is notoriously hard to gain authorized administrative access to, as it was not designed with corporate access "built in" - but that's true of almost anything other than the corporate version of pgp, and even there, there is a "gentleman's agreement" that the sender won't deliberately strip the corporate recovery key from the target list before sending.  Gateways are more efficient for that (in that they encrypt/decrypt at the network boundary, so that your internal mailstore remains unencrypted for discovery and/or DLP) but are significantly more expensive than desktop solutions.
LVL 59

Expert Comment

ID: 38838860
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
LVL 33

Expert Comment

by:Dave Howe
ID: 38838861
Three posters (myself included) each gave meaningful information; If you delete on the basis that there isn't enough to "confirm" a given answer, you could delete 90% of the questions on here without giving out any points, and alienate most of your experts.

Might I suggest you get someone with experience in this area (such as Tolomir?) to review?
LVL 33

Expert Comment

by:Dave Howe
ID: 38843253
Not sufficiently arrogant to vote for myself , so I recommend


as the answer (as the queriant explicitly asked for info on setting up outlook) and


as an assisted answer, as oracle based crypto is a better solution than s/mime (almost nobody ends up using s/mime in the real world, as it requires the recipient to create and distribute the key in advance, usually once per year, and getting your customers to do that is a nightmare)

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.
how to add IIS SMTP to handle application/Scanner relays into office 365.
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question