Ask Slashdot: What Is the Best Email Encryption Gateway For a Small Business? 155
Attila Dimedici writes "I am in the process of implementing an Email Encryption Gateway for my company. I checked with my various contacts in the industry and came away with Voltage as the best solution. However, as I have been working with them to implement a solution, I have been sadly disappointed by their lack of professionalism. Every time I think I am one question away from being ready to pull the trigger, I discover something that my contact with them had not mentioned before that has to be ironed out by the various stakeholders on my end. So, my question for Slashdot readers is this: what is your experience with implementing an Email Encryption Gateway for your company and what solution would you recommend?"
Outlook.com (Score:5, Funny)
Re: (Score:1)
I feel dumb, but what is wrong with just Exchange? It can do the ActiveSync policies (passwords, demand encryption, secure erase.) What does a third party product like Good or BES give us except for more management headaches and more money slurped off for licensing fees?
Re:Outlook.com (Score:5, Informative)
BES offers a shitload of benefits if you want to use them. Blocking things like the camera or SMS, limiting WiFi connectivity, security configuration, password requirements, etc, on company owned and paid for phones is a requirement for many large enterprises. Additionally, ActiveSync isn't as feature complete with syncing in most cases (Android doesn't do tasks or notes for example), while BES provides complete bi-directional sync between BlackBerrys and Exchange. Remote software management, an always on administrator controlled VPN connection is another benefit.
We had issues with our Exchange server's gateway and it wasn't able to get to the internet, however the tunnel to our location that had BES was up and it had internet connectivity, so our BBs were receiving email communicating what was going on and who was doing what. Sure we could've done that with personal email or with BBM/GTalk, but this way we didn't need to.
BES is a pain in the ass when you don't need any of the above and all you're doing is syncing email, calendar and contacts. But those are all critical features in many places.
Re: (Score:1)
You have got to be kidding. BES is the biggest turd of an application I've ever worked with in my life. It is slow, bloated, stops working randomly on both the client and server side and is a total security nightmare. You seriously suggest using a program that insists on having read and impersonate access to all of your mailboxes with your encryption? Yikes!
Re:Outlook.com (Score:4, Interesting)
BES is a pain in the ass when you don't need any of the above and all you're doing is syncing email, calendar and contacts. But those are all critical features in many places.
About that... my complaint about BES is that it's this Java application, that requires this huge install of SQL server just to function, you wind up needing a server with 4GB of RAM, to provide 20 users with mail synchronization.
This is almost as many resources as the complete Exchange system requires....
Re:Outlook.com (Score:5, Informative)
I found it much easier to configure Thunderbird with a self-signed certificate and OpenPGP. The email is encrypted on my computer and decrypted on the client's computer. However, it's probably not feasible to train a bunch of tech-challenged workers to do this themselves and would likely introduce too much of a training/support burden for any sizeable IT shop.
I realize that M$ may offer some handy tools for IT managers tasked with managing a large organization -- if you are willing to pay for it. I also find it extremely disappointing that client-based email encryption is not more widespread and easy to implement.
Re:Outlook.com (Score:5, Informative)
THIS. Once it gets off your LAN, there are SO many ways for you to get tapped into. Not counting the illegal ways, look at all the options the govt has and is well known to use, often ignoring or pencil-whipping judicial oversight. They can subpoena your ISP, whoever is doing your email encryption, whoever is providing them with their SSL keys, or their ISP.
If you are serious about protecting your privacy, make darn sure your data is secured before it leaves your property. At least then, if they want to snoop, you're a lot more likely to at least know it's happening. And that will keep out most of your threats, short of spear-phishing, stray bait flash drives left in your parking lot, and internal threats. (malicious employees)
In the short term, get everyone an email certificate, and USE them to sign and encrypt outgoing email. (any decent email client will support signing and encryption) That data could still be subpoenaed from the group you get them from though. You can roll your own if you want to also, but you won't be easily able to revoke if need be.
Re: (Score:3)
It is obvious that once the data leaves your gateway, it is open season, perhaps even sooner if a router or switch gets compromised and a custom firmware uploaded. The endpoint is where the main security should lie.
Ideally, you want people using PGP or GnuPG with some sort of WOT in the company, and some mechanism of securing private keys (Self generated eTokens, or even just a USB flash drive.) For SOX reasons, an ADK might be needed, but it will be obvious that key is added to E-mail exchanges, and hope
BINGO (Score:2)
The privacy threat that people are MOST LIKELY TO FACE is the government investigating you as a "person of interest" for various reasons. Once they get your private messages, it's fairly easy to become a target for harassment. Sure, they could always get a search warrant and pressure you to decrypt the information. But hardly any of these "investigations" are backed by enough evidence to justify that tactic. The "invisible hand" prefers to work invisibly. Most email providers will quietly hand over you
Develop a Thunderbird extension to automate (Score:3, Interesting)
People fuss to much about the security of the passphrase and such things. The effect is that almost nobody uses encryption.
Make a Thunderbird extension that automatically sets up a default configuration that works from the get-go.
In this default configuration the private key could be stored in a local file encrypted with a passphrase that is hardwired into the program.
Totally insecure if there is a virus that targets this arrangement, but still a million times safer than sending everything over the wire in
Re: (Score:2)
Re: (Score:3, Interesting)
Re:Outlook.com (Score:5, Funny)
Re:Outlook.com (Score:4, Informative)
I know your comment is meant to be funny (and it is), but what I really don't get is why everyone is talking about Outlook (argh) and sharepoint (*shudder*), and not about Lotus Domino. I'm also a bit... confused about why Lotus Domino isn't the default choice for anyone even remotely thinking about secure mail.
Lotus had a place for storing certificates since they were invented. In fact, ALL authorization is done using keys. It's been designed to work with them from the ground up. If the admin manages to remove his ID from the database, he's just as thoroughly holed under the waterline as any user. Inside the company everything can remain encrypted and when going out you can use encryption for everyone you have the certificates for, or make it impossible to send unencrypted mail. Using Lotus there is absolutely no barrier to using encryption (only to using the damn client in the first place - the GUI has issues).
Ofcourse, one can also keep on bolting random software on top of other software, like that factory in Bangladesh: at some point, the foundation can't hold the weight anymore and you're done.
Re: (Score:2)
Outlook Not So Good.
Voltage is pretty good (Score:5, Informative)
I'd ask for a different account rep. I've used Voltage for about 10 employees to great results. I've never encountered this professionalism problem you report.
Re:Voltage is pretty good (Score:5, Insightful)
Re: (Score:1)
And I would recommend not relying on email for critical communications. If you must, just use normal email. Install TrueCrypt, and manually encrypt files by hand and then attach. If your staff can't handle that, then they have no business dealing with sensitive information to begin with.
Re: (Score:2)
Voltage is very good, especially when combined with software/appliances that can scan email for Compliance (Business, HIPAA, ...)
that will then direct the emails to be encrypted.
The "weak" link in PGP or any other manual encryption is always the end user.
I've worked with Voltage, they're very professional and have gone above and beyond on support issues.
Re: (Score:1)
I'd ask for a different account rep. I've used Voltage for about 10 employees to great results. I've never encountered this professionalism problem you report.
I bet the professionalism problem is just him discovering that it actually takes some setup to do(stakeholders at _his_ end). That is, he can't just install a magic piece of sw and expect magically every email communication from his firm to be encrypted.
gmail (Score:1)
gmail supports encryption and you can use feature rich email clients like MS Outlook with it. Do you really need to have a mail server in-house anymore these days?
Re:gmail (Score:4, Insightful)
Do you really need to have a mail server in-house anymore these days?
That really depends on the confidentiality requirements of your email.
If I were the business was healthcare, a law firm, or an accounting firm... yes, I'd feel a need to run the email in-house.
Re: (Score:1)
The email is by default, no matter what you do, is not secure from end to end and at rest. I believe, sending medical information over email is not permitted by HIPA, unless sent as encrypted asymmetrically on the client side. I believe the technologies that meet this requirement are things like PGP/GPG.
I don't believe there is legal standard for legal confidential data, as there isn't a standard for FERPA data, just that it be "secured."
Re:gmail (Score:5, Interesting)
I love the idea of those places running things in house, but in my experience, specifically with law firms, they do not even when they are big enough for it to make a huge difference. They are also some of the most technologically misinformed and lazy people I have met. I've got three really good examples of this.
First example is Dropbox and other services like it. A local attorney was in a big surprise when Dropbox complied with a subpoena and turned over all documents they had that the attorney and his client had uploaded to their dropbox accounts. The court had a special master review them for confidential information and turned over a ton of documents and data. Suffice it to say, they "lost" the divorce case when the information included pictures of a second home (complete with GPS coordinates), multiple cars and other hidden assets.
The second is that many solos and small firms (about 40% of practicing attorneys) use the email service provided by the state bar association. The email service that does not have SSL or TLS support. Webmail, pop3, IMAP, SMTP, LDAP and the rest are all unencrypted. When I asked the tech guy at the association about why it was unencrypted, he pointed me to the board minutes, where at every meeting, they refused to approve a certificate because, as one put it, "it was a waste of money." During an experiment conducted at a legal education program (which I'll detail below), they came up with quite the large amount of information.
The third is the experiment I mentioned. At a legal education program, they partnered with a security group and they set up a device to log all the attempts to connect to wireless networks as well as real access points. The access points were protected by WPA2, but the password was given with the materials. It then had a screen presented with a TOS and privacy policy that they had to agree to before being granted access. The TOS gave all this away and included a button to click so we could see how many people actually read them (the people who clicked saw a stat page, which included a bar graph so you could see it over time). The access point was setup to log all the traffic (which ended up being gigabytes of data, they said, due to all the videos people watched) as the traffic came in. They then analyzed it for key words and statistics. A team of attorneys and people from the ethics committee cleared all the info that was presented in the speech about safety and being careful online. They talked about all the video, and news people checked, and then it slowly got more personal. They started referencing people's email, a snippet of a person's VOIP session and a document uploaded to some service. They then talked about safety steps like TLS, truecrypt and being careful and that you need to check that you are connecting to who you think you are as well as other things. The best part was right at the end, the speaker said "Jody wants you to remember to pick of a pizza on the way home," and about 25 people all went for their phones to see if they were talking about them. Incidentally, after the presentation, encrypting the bar association's email was added to their 5-year plan for year 5(!), but I guess it is better than nothing.
Last thing I will note is the mixed advice. For example, the latest, or maybe previous issue, of the ABA magazine had an article detailing the dangers of the cloud, especially dropbox as it is unencrypted, they keep your files after you delete them, and you can get them anywhere. Less than 20 pages later was an article that declared dropbox a "MUST HAVE" app for any attorney for the exact same reasons that the previous said were dangerous.
Re: (Score:2)
Please don't knock DropBox, configure up your clients up with Boxcryptor for Windows which uses EncFS (opensource). You can only use the opensource support for windows using Dokan. http://members.ferrara.linux.it/freddy77/encfs.html [linux.it] Under Mac and Linux you can also use EncFS. Assume the cloud is compromised with a limited SLA, but a jolly useful resource.
Re: (Score:2)
You don't need to pay anything to get a certificate. You only need if you want it signed by a major CA. Something with closed membership like the bar association could just publish the fingerprint and have everyone trust the certificate manually.
it might be even wiser.
Re: (Score:2)
Additionally, Google has repeatedly dropped unpaid services without warning or alternative. Not a good match for a business. If you don't run your own e-mail server, you at least want it to be run by someone contractually obligated to meet certain expectations.
Re: gmail (Score:4, Interesting)
And while Google App Engine is less essential to the company future, and is as vulnerable to the axe as Google Wave and Google Reader, there's an open source implementation of the APIs called "AppScale" which offers a migration path if Google shuts App Engine down.
Re: gmail (Score:1)
Google doesn't offer unpaid email to business anymore.
Re: (Score:2)
You can pay for gmail, and then they will be beholden to the contract you have with them.
There is nothing to stop any company dropping a service, even one you pay for and have a contract for... The most you can hope for is that they give you notice that the service will be discontinued and you can migrate.
This is also why you should always have your own dedicated domain... The beauty of email is that it's a standard, so if you need to you can take your domain elsewhere and continue using email just fine. A
Simple (Score:3)
The one that you (or someone you trust) can effectively manage.
Cisco (Score:2)
Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund
I agree (Score:2)
Then I can't (won't) read email from you. (Score:5, Informative)
Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund.
Then I can't (won't) read any email you send me.
To read Cisco IronPort mail you must install software from Cisco.
To install the software from Cisco you must sign an EULA - which makes a BIG POINT of being a binding contract.
The EULA has anti-reverse-engineering terms that, were I to sign them, would (IMHO) make me unemployable in the computer security field.
Therefore I will not install the software.
Therefore I cannot decrypt "secure" email you send me.
Therefore I will not do business with your company.
Do you REALLY want to FORCE your clients to CONTRACT WITH A THIRD PARTY and SIGN AWAY THEIR RIGHTS in order to exchange important email with you?
Re: (Score:2)
The EULA has anti-reverse-engineering terms that, were I to sign them, would (IMHO) make me unemployable in the computer security field.
Then have your IT administrator install the software for you, so you are not bound by the contract, you just can't install or redistribute the software, only use the application that was installed for you.
Re: (Score:3, Informative)
Complete bunk. What software? We use Ironport, and specifically picked Ironport because it's message based encryption (PostX) didn't require anything more than a web browser and an Internet connection to decrypt messages. If you are talking about the outlook plugin on the sender side to "encrypt" it, that's totally unnecessary - all it does is mark the message (by modifying the subject I believe) so that the Ironport appliance can recognize it and apply encryption. (Rather than using that, we just have
Re: (Score:2)
And what if you don't and/or can't run Outlook?
Re: (Score:3)
They offer numerous ways and plugins for email clients
..which is the sw from cisco that was bitched about with it's eula...
Re: (Score:3)
Cisco IronPort. We use it and rely on it heavily for secure emails regarding pii for our pension fund
Yeah, we did the same [forbes.com] at my company.
Our IT Staff just threw their hands in the air, and now we just use a public bulletin board for our all our internal electronic communications (with private messaging disabled). And once in a while just to be thorough, we let a spammer come in to post viagra ads on it, just to remind all of our employees that our bulletin board is completely opened to the outside world and nothing posted on it will ever be private.
Re: (Score:2)
Proofpoint (Score:3)
It's a small company but have absolutely stellar encryption and archiving products and good service. http://www.proofpoint.com/products/privacy/email-encryption.php [proofpoint.com]
PGP (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
This is exactly what I was thinking. An "encryption gateway" just sounds like one more vector for a problem. This is especially the case when its not needed. Pgp/gpg works and has worked for a long time, and requires no real infrastructure.
Re: (Score:3)
You cannot outsource security and expect to succeed. (Consider, for example, Vendor X. Do you think that every single employee of Vendor X is absolutely trustworthy? Really? You don't think that ANY of them are struggling financially, or maybe having an affair, or perhaps amenable to a payoff in crisp folding tax-free income? Because if there exists a non-empty set of Vendor X employees who are less than absolutely trustworthy, you are completely screwed: eventually someone will figure
Re:PGP (Score:5, Insightful)
Re:PGP (Score:5, Insightful)
What you meantion is a valid problem with the PGP type solution.
Unfortunately, the solution of "let joe do it" opens you up not only to joe, but also to anyone who snoops the unencrypted transmission between Gladys and joe.
In each case you evaluate how much the security matters to you, and to others. The more it matters, the closer to the origin the encryption needs to be done. (You'll have noticed I didn't encrypt this at all.) PGP is pretty good if there's enough importance for you to ensure that it's properly used. If you aren't, then "let joe do it" for, again, varying values of joe. Internal IP is probably more secure than someone outside, but you need to care enough to ensure that they do the job properly. (An easier job then ensuring that every Gladys does her encryption properly, but less easy than delegating it to someone outside.) At every step removed, the security decreases, and the ease increases. Make the trade off that YOU deem appropriate.
Re: (Score:2)
Unfortunately, the solution of "let joe do it" opens you up not only to joe, but also to anyone who snoops the unencrypted transmission between Gladys and joe.
You can still use crypto to secure the transmission from Gladys to Joe; as long as you trust Joe, use a TLS encrypted session from Gladys to Joe. E.g. SMTP over TLS to the gateway, with Gladys' username, and password + OTP token generated key to authenticate Gladys to Joe.
Re:PGP (Score:5, Insightful)
Speaking as someone who's taught Gladys from accounting how to use mutt and GPG -- several thousand Gladys, actually -- it CAN be done. It requires effort, it requires time, it requires budget: but it can be done. Consider it an investment: is it better to spend these resources on Gladys, our valued employee, or is it better to spend these resources on a vendor?
Re: (Score:2)
So who is going to teach Gladys from accounting how to store her contacts' PGP keys and encrypt her email?
Not to be mention the fact that Gladys is a temp and Harriet is an intern and both will gone within a week.
Re:PGP (Score:4, Informative)
The IT department provides all staff with a client that is already configured to send and receive PGP email...
The client is configured to automatically encrypt when sending mail to a recipient for which it has a public key, and displays a warning if it doesn't have a key available.
When it receives a public key via email it prompt the user to import it.
It's really not terribly difficult if done right, and users will soon be sending encrypted mail without even realising it.
Re: (Score:2)
Maybe PGP is a little on the difficult side, but at my company, we use a dedicated server for any email that needs to be encrypted. It has a little web app (written by a former employee) people can use to send and receive messages, with attachments, if necessary. All the data is transferred through HTTPS. I don't use it, myself, but it must be pretty easy, because we have to follow HIPAA regulations and
Re: (Score:2)
Configuring outlook for encryption is doable. It's doable for techies in Windows mail as well (unless you start using two accounts and don't want to encrypt one of them - the settings are global and unpolished) but I've had a client who wanted encryption and didn't get it working on his client, not even with a manual with screenprints.
As I've said in this discussion before: why not use Lotus Domino? It's been built from the ground up for exactly this. I know it's clunky and expensive but I've worked with a
Re: (Score:1)
Use PGP/GPG for god's sake.
I would suggest S/MIME certificates instead, far more email programs support S/MIME out of the box than PGP.
Do you delegate signatures in sensitive and confidential cases to your co-workers?
Yes. It's quite common for a business to have a recovery key. And sometimes you do want to delegate functions to someone else.
Re: PGP (Score:2)
Re: (Score:2)
Re: (Score:2)
Use PGP/GPG for god's sake. Since when do you delegate encryption and integrity to any gateways? You cannot trust ANYONE except yourself when signing private documents. Do you delegate signatures in sensitive and confidential cases to your co-workers?
I'd go with s/mime, because most e-mail clients will support it without having to install anything else.
Entrust (Score:4, Informative)
I use and like Entrust Entelligence PKI solution. Signed and/or encrypted email, used by most US gov. agencies for easier interoperability.
GPG? (Score:1)
Comment removed (Score:5, Insightful)
Re: (Score:2)
seem like a gimmic
A government-mandated gimmic, depending on your field.
Re: (Score:2)
One issue with encrypted messages however, is that unless your mail filters have the private keys they cannot look inside the encrypted mail for spam or malware...
Re: (Score:2)
Spearfishing is an issue there. Although I'm assuming here that there is a trace to whoever has received email from you in the first place so spearfishing would be risky.
Spam, not so much. I really don't think spammers are going to check public keys before sending out spam. The computational complexity for doing that would raise their mailing cost without increasing profit.
Re: (Score:2)
One issue with encrypted messages however, is that unless your mail filters have the private keys they cannot look inside the encrypted mail for spam or malware...
Don't read encrypted mail that is also not signed. If the signer is not in your contact list, then reject the message. To be clear, this should be done in software, that automatically executes this based on IT defined policies.
In practice, spammers and automatic malware rarely if ever encrypt the message. One of the main reasons would be
Re: (Score:2)
seem like a gimmick. taking steps like ensuring your MTA always delivers using a TLS connection is probably the most interoperable decision
This is a good first step, but protects the transport not the message.
If you want the message to be secure, the end should encrypt the message, then transmit it over a MTA that leverages TLS to further protect the transportation of the encrypted message payload, hop-by-hop, until the encrypted message is downloaded to the authorized reader's computer, AND then, t
Zixmail (Score:2)
I've worked for companies who have used this in the past and it has worked quite well.
Re: (Score:3, Informative)
Re:Zixmail (Score:4, Insightful)
I'm working with one currently. It's postfix under the covers, so you can at least see what it's doing. The app is tomcat. More importantly, many of their business partners use the same solution, so they have an easy, if proprietary way to interconnect.
My e-mail is on the TLS list so it goes through normally, but if I got the "You've got a new message from foo@exmaple.com, go to this website for your message" e-mail instead of a real one, I'd probably just delete it.
I understand why people do this, but the results are too close to phishing and scams for me to participate.
My e-mail systems can all do end-to-end and transport-layer encryption; the gateways are so often so others don't have to bother with a decent setup. And often the others are customers of large ISP's who don't know any better. But the problems aren't technical so much as ease-of-use and integration.
Not really the best practice (Score:5, Informative)
Rather than an encryption gateway, having your email client handle encryption avoids the problem of man-in-the-middle attacks between the gateway and the client.
I don't have much reason to encrypt, but Thunderbird has my certificate installed and does my digital signing. This is not unusual for a modern email client.
Re: (Score:2)
Re: (Score:2)
But getting folks to understand security and encryption is pretty hard.
Hybrid solutions are what you often want for a business. If the client has encrypted the message, then great - forward it through. If it has not, then encrypt it on the gateway. If it can't figure out how (missing keys), then reject the message.
It's a shame there isn't a commonly used encryption standard. I blame the US government for making this basically illegal to implement without worrying about who a person is and what country t
Re: (Score:2)
EXACTLY... SMIME is Standard ! (Score:2)
please pretty please kill these gateway "hacks" just send mail correctly using a standard http://en.wikipedia.org/wiki/S/MIME
Re: (Score:2)
I totally agree this is the ideal situation. The problem is, many e-mail clients don't provide easy-to-use encryption; they require a lot of work from the end user, they don't make it simple enough -- and they don't implement both S/MIME and GPG / OpenPGP, so there are two conflicting standards.
S/MIME has a higher barrier to entry, due to the need for the end user to purchase, or otherwise obtain a personal X509 certificate; typically requiring a formal certificate enrollment process, then the c
Email Encryption (Score:4, Interesting)
Sophos Gateway (Score:1)
Re:Sophos Gateway (Score:5, Insightful)
One thing I don't understand about these things: If an adversary can intercept your email, he/she can intercept the email asking for registration and create a password.
Without an out-of-band way to register, I fail to see how these things add security.
Re: (Score:2)
Also, an email asking you to visit a website in order to register looks very much like a phishing scam...
How about SSL? (Score:2)
Most SMTP servers can communicate over SSL or TLS with each other these days and if you set it up correctly (eg. Postfix), it will do so and fallback on non-encrypted methods.
For message encryption, you're better off giving each person a personal SSL certificate (setting up a PKI should've been done for other purposes already) and all of the clients I know off support SSL encryption.
Enigmail for Thunderbird (Score:2)
To ease the GPG pain*. Enigmail does a great job but it's only half the battle. How you are going to reconfigure every Recipients client without causing sheer panic is going to be interesting. Please report back when you do.
[*] - http://www.enigmail.net/home/index.php [enigmail.net]
Beware of blackboxes (Score:3)
Trusting in someone that could be forced by law to give your encrypted communications [slate.com] (after all they have the right to see all your mails [cnet.com]), or modify packaged software to let them in [pcpro.co.uk] is risky this days. You maybe could trust in the FBI as in a concept, an entity that won't be interested in your trade secrets, but there are people working for them, and people and corporations giving orders to them directly or indirectly that have no problem abusing the power they have.
Open source, widely tested encryption and secure channels are your best options.
Re: (Score:3)
Depends on the needs (Score:3)
I've dabbled with a variety of solutions, but it really depends on what it is you are trying to secure, between whom, and where.
GPG/PGP has been around a while, but it usually requires some third party software/plugins. I seems a little clunky to me as most email clients already have S/MIME support built in which brings me to...
S/MIME requires you get a cert through a third party (Thawte used to provide free email certs). By just sending a signed email to somebody they will then have your public key.
If you are talking about securing email between two email relays, then you can just configure the relays to enforce TLS.
If you are talking about securing the link between clients and email sending/receiving, you can just configure the mail server (if it isn't already) to only accept connections on pop3s/imaps/smtps/etc.
Other ideas is setting up encrypted tunnels between relays (like how ssh can do port forwarding), etc.
Happy to help - Voltage Security (Score:1)
If you are not getting what you need from your contact, please feel free to reach out to me directly.
There are millions of happy users across thousands of enterprises around the world using Voltage SecureMail either on-premise or from the Voltage SecureMail Cloud to secure emails and files end to end. Banks from the likes of Wells Fargo and JPMC use it universally, Cloud providers for Exchange including Microsoft use it as a security option for Office365 cloud offerings, and smaller businesses such as lawf
Open source (Score:1)
Djigzo email encryption gateway is open source, you can download a free version from www.djigzo.com. It supports S/MIME, it has a lot of cool features. Used by major corporations all over the world. Just give it a try, it's free.
How about smtp.nsa.gov? (Score:1)
Please contact me to fix this (Score:4, Informative)
Re: (Score:2)
Regardless, I'd like to solve the original poster's problem. I'd ask that he contacts me at Voltage, and I'll handle any issue he's having at the moment.
If you do not already know who he is and therefore you can't contact him then; Are you sure that he is real?
I would be curious to know if he is a real customer of yours first. Just post the reply to my message here.
Re: (Score:2)
It does seem in poor taste that the original author choose to vent over a personal experience with some contact at Voltage in an Ask slashdot article, having perhaps done inadequate research, and/or asked inadequate questions to learn sufficiently about the solution before presenting to stakeholders.
I don't understand that... taking a trial of an enterprise software product, or at least reading all the technical manuals, should be key, before presenting it to stakeholders within one's own organization,
Barracuda Networks (Score:2)
Can work through their or standalone web service. They also have just about the best customer service of any company I have ever worked with.
https://www.barracuda.com/products/emailsecurityservice [barracuda.com]
Totemo (Score:2)
www.totemo.ch - somewhat pricy, but very nice handling:
based upon a ruleset, it can send mails encrypted with PGP or S/MIME (if keys are known), as encrypted PDF (sender gets password for manual transmission) or store the message on a webserver and just give login/password to the recipient.
if no prior key exchange happened, the PDF-solution creates a PGP-key and a S/MIME cert and sends both public keys with the PDF, so the recipient can choose whatever they want.
when receiving mails with attached PGP/SMIME
Re: (Score:2)
I can only second totemo. Their product is really very good.
Another one I can recommend is http://www.seppmail.ch/en/home/ [seppmail.ch] (If you have Blackberries then totemo is the better choice.)
What is the best? (Score:2)
The one that satisfies your needs. It's like on /g/ when someone says "What's the best Linux distro" to start a flamewar (it works), or what's the best motorcycle to ride, or what's the best chef's knife to wield in your kitchen.
The answer is always "It depends."
It depends on how much you want to spend and your technical expertise - whether you want to farm it out or DIY. There are arguments for and against both. To ask third parties that aren't intimately knowledgeable of your situation what's the "best
The Perfect Solution (Score:2)
-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.14 (MingW32) hQIOAy7t6bIA+H1sEAf7BBJ/h/p1oGgPcpLDPChJu99apWYTPGxThrgrFLS1o5N5 Sr8b+fFcTGVByvKGvrfDQTr2vnCJ7ezLyLyBnj2H+C/RdKOqFfp8PWjWpzhVXquW JAA4eLVC5B9eLQKcYFufvtS/Ad0I1SRc/vlDcrtezcZf5ify8SRLKIRxMMuRhunw WktClayAGrhgfofg3wN2B6F6TB3afpPL4HQLqaz7PL8ZrDcwqof0ExJw8kx+Jx2t Q58YBtwnKuN4ynXTxImjpZBncsWsRztIQa53Xt00gy2yhdWHaIdoEtif5u6AhiP8 GVLYvmJNKBUozsyO2HyKuCwh6phaQMlPts8boL3pvAgA5RMWxAmrXDE+D0Il
No complaints here (Score:2)
We use Voltage here, the Outlook plug-in is what users see, and it is trouble-free.
But we have 65,000 users. YMMV.
Re:Not Voltage's problem: buyer error. (Score:4, Interesting)
Voltage is a slimeball company though. They typically sell to really big institutions for many times the original quoted costs once you figure in all the 'appliances', upgrades, support contracts, implementation engineers and contractors and then their product usually doesn't deliver. They're the PWC, PeopleSoft or Gartner of e-mail.
Re: (Score:2)
But then again, which one is the typo?
Re: (Score:1)
/me goes to decode the above message to find out what he TRUELY said...
Re: (Score:2)
PKI (Score:2)
1) You encrypt with the public key(s) of the recipient(s). Then, only him can decrypt the content using its private key.
2) You sign with your private key. Then, anybody can verify your signature using your public key. The content really comes from you as long as your private key wasn't compromised.