Email is the backbone of business communication. Without it, many businesses would grind to a near-halt. Unfortunately, email is also a leading cause of data breaches and business interruption. In this post, we explore why business email encryption is important and how secure email can protect businesses and their customer data.
Although inbound attacks such as phishing are on the rise, the most common risk to businesses is the messages they send out into the world.
Outbound email risks include:
Outbound email risks are the most common causes of business email compromise, which can lead to reputation damage, regulatory fines.
So how does a business protect itself from sending confidential information unsecured? Let's take a look at how secure email for businesses can help you to avoid outbound email risk.
Secure email is a catch-all term for encryption and authentication solutions designed to protect outbound emails from falling into the wrong hands.
Secure email solutions for businesses offer two primary modes of protection:
Although all email providers offer some level of encryption and authentication, these are designed to protect everyday consumer emails.
For businesses handling sensitive customer information, many will find the features offered by their email provider do not meet certain standards of compatibility, ease-of-use, and regulatory compliance.
Note: Most email providers offer TLS and S/MIME capabilities. These help to protect messages by encrypting data in transit and digitally signing them so organisations can verify they come from the right person. However, they are not fit for purpose when used alone to secure confidential business emails, one reason being that they are not compatible with all receiving email clients. They also lack the multi-factor authentication capabilities to ensure unauthorised parties cannot gain access. Read more about encryption types. |
Let’s take a look at your options for business email encryption and authentication when using Outlook, Gmail, and Apple Mail. We’ll breakdown the pros, cons, and alternative solutions.
Microsoft 365 and Outlook are part of an expansive ecosystem, so your secure email options differ depending on your business’ package. Let’s take a look.
Availability: All 365 plans excluding E1/Basic
Microsoft Purview Message Encryption can encrypt business emails sent both within and outside of your organisation and the Microsoft ecosystem.
Secure emails sent to recipients using Outlook see your message appear within their inbox, auto-decrypted, just like a normal email.
Secure emails sent to recipients using other email clients receive a notification email and click to open the secure Microsoft portal. They must sign in with a Microsoft, Yahoo, or Gmail account to access the message in their web browser.
The requirement to be logged into an email account to gain access to confidential information is enough to prevent many forms of attack.
Most email accounts require you to use multi-factor authentication (e.g., an SMS code) by default. However, this can be turned off, so you are leaving data security in the hands of your recipients.
Pros:
Cons:
Initialisation:
Availability: E3/E5 365 plans (or as add-on to other plans)
Microsoft Purview Message Encryption (Advanced) brings a few additional controls and features to MPME (Basic), including branding, a revoke option, and keyword triggers.
Options to revoke and set expiry periods on secure emails extend your secure business emails with a last-resort lockdown option.
Keyword triggers are useful for initiating security based on your company’s policies regarding personal data and information security. These can be set up so that if particular phrases are detected, an email will be encrypted.
However, the core security that protects messages from unauthorised access is the same in both the Basic and Advanced versions of MPME. If any of your recipients’ email accounts are compromised, so are any confidential emails that they receive.
Initialisation:
Pros:
Cons:
Tip: You can install third-party secure email solutions in Outlook that are designed specifically for business email compliance. These are more likely to give you an expanded set of tools for encryption that you can customise to your business needs (without venturing into the depths of PowerShell!). One of these solutions is Mailock, which is built for UK compliance, though of course, there are other email encryption solutions on the market. Do your research to find the right option for you. Third-party solutions are also likely to be more affordable than upgrading your 365 licence. |
Gmail and Apple Mail offer no secure email functionality that could support a business to encrypt confidential emails at scale without compatibility issues. TLS and S/MIME are offered but neither, used alone, guarantees delivery and security to all recipients.
There is also no authentication capability within Gmail or Apple Mail to make sure that the people receiving a message must verify their identity to gain access. Email sent using its encryption are no more secure than the rest of the emails in a recipient’s inbox.
Few information security regulators would advise using Gmail or Apple Mail’s native capabilities (as of 2022) to secure sensitive information and comply with regulatory guidance. For this reason, we’ll take a look how a third-party tool like Mailock can help.
If you’re using Gmail or Apple Mail for your business, don’t worry - you can still send confidential information by email. You have two options to go secure:
The solution you use will depend on the scale of your operation and the volume of confidential information being shared. If you’re not sure of the best option for your business, we offer free, confidential advice on securing your communications.
The word “secure” can mean a lot of things to a lot of people. It's not just about protecting data from hackers, scammers, and other bad actors.
It's also about preventing the release of sensitive information - like customer names, credit card numbers, addresses - to people who shouldn't see them.
Encrypting an email protects data on its way to an inbox, but it doesn’t make sure it gets to the right person. As we become more reliant on digital communication and more aware of the top email risks, this distinction is increasingly important to recognise.
Here are the most important reasons why multi-factor authentication should play an essential part in securing your sensitive business emails:
At Beyond Encryption, we help businesses secure their communications without compromising the customer experience or operations.
We run live demos for enterprise businesses looking to secure their business emails. You can also sign up for a free trial of our secure email solution, Mailock, to encrypt emails using your browser or Outlook.