Ask Slashdot: What Is the Best Email Encryption Gateway For a Small Business?

Attila Dimedici writes "I am in the process of implementing an Email Encryption Gateway for my company. I checked with my various contacts in the industry and came away with Voltage as the best solution. However, as I have been working with them to implement a solution, I have been sadly disappointed by their lack of professionalism. Every time I think I am one question away from being ready to pull the trigger, I discover something that my contact with them had not mentioned before that has to be ironed out by the various stakeholders on my end. So, my question for Slashdot readers is this: what is your experience with implementing an Email Encryption Gateway for your company and what solution would you recommend?"

Re:gmail

[egcagrac0]

Do you really need to have a mail server in-house anymore these days?

That really depends on the confidentiality requirements of your email.

If I were the business was healthcare, a law firm, or an accounting firm... yes, I'd feel a need to run the email in-house.

PGP

[koinu]

Use PGP/GPG for god's sake. Since when do you delegate encryption and integrity to any gateways? You cannot trust ANYONE except yourself when signing private documents. Do you delegate signatures in sensitive and confidential cases to your co-workers?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Voltage is pretty good

[Obfuscant]

I'm not sure that I'd rate a failure of the account rep to predict every issue that a "stakeholder" might come up with and tell the purchaser how to deal with it in advance a "lack of professionalism". That sounds a lot like trying to aim at a moving target to me. "Oh, can your product also do X? It has to do X, which I just thought of..."

Re:Zixmail

[bill_mcgonigle]

I'm working with one currently. It's postfix under the covers, so you can at least see what it's doing. The app is tomcat. More importantly, many of their business partners use the same solution, so they have an easy, if proprietary way to interconnect.

My e-mail is on the TLS list so it goes through normally, but if I got the "You've got a new message from [e-mail], go to this website for your message" e-mail instead of a real one, I'd probably just delete it.

I understand why people do this, but the results are too close to phishing and scams for me to participate.

My e-mail systems can all do end-to-end and transport-layer encryption; the gateways are so often so others don't have to bother with a decent setup. And often the others are customers of large ISP's who don't know any better. But the problems aren't technical so much as ease-of-use and integration.

Re:PGP

[SpaceCadetTrav]

So who is going to teach Gladys from accounting how to store her contacts' PGP keys and encrypt her email? And are you also going to train everyone she sends email to, as well? Out here in the real world we have to support non-techies and gateways are the most reasonable compromise.

Re:PGP

[HiThere]

What you meantion is a valid problem with the PGP type solution.

Unfortunately, the solution of "let joe do it" opens you up not only to joe, but also to anyone who snoops the unencrypted transmission between Gladys and joe.

In each case you evaluate how much the security matters to you, and to others. The more it matters, the closer to the origin the encryption needs to be done. (You'll have noticed I didn't encrypt this at all.) PGP is pretty good if there's enough importance for you to ensure that it's properly used. If you aren't, then "let joe do it" for, again, varying values of joe. Internal IP is probably more secure than someone outside, but you need to care enough to ensure that they do the job properly. (An easier job then ensuring that every Gladys does her encryption properly, but less easy than delegating it to someone outside.) At every step removed, the security decreases, and the ease increases. Make the trade off that YOU deem appropriate.

Re:PGP

[Arrogant-Bastard]

Gateways are NOT a "compromise": they are total failure. That say to the world "we care about the appearance of security/privacy/integrity; we just can't trouble ourselves to actually, really, truly, provide those things."

Speaking as someone who's taught Gladys from accounting how to use mutt and GPG -- several thousand Gladys, actually -- it CAN be done. It requires effort, it requires time, it requires budget: but it can be done. Consider it an investment: is it better to spend these resources on Gladys, our valued employee, or is it better to spend these resources on a vendor?

Re:Sophos Gateway

[dskoll]

One thing I don't understand about these things: If an adversary can intercept your email, he/she can intercept the email asking for registration and create a password.

Without an out-of-band way to register, I fail to see how these things add security.