Security of faxes vs emails

Question

Background

The other day a friend who works in healthcare asked me which method of communication was more secure, faxing or email. He qualified his question by saying that his office faxes patient records all day, every day, which should not surprise anyone.

I scratched my head and rattled off some considerations, private vs hosted email service, but his question really got me thinking.

My Question

Is a sending a fax more secure or less secure than sending an email when communicating sensitive data?

Consider the following simple variations:

1. Self-hosted private email server vs fax.
2. Hosted private email server (collocated server for instance) vs fax.
3. Hosted GMail (for instance, not picking on Google) service vs fax.

Qualifications

For the sake of this question imagine that in each email instance above, basic best practices are being followed.

I am wondering does one method have a greater attack surface than the other. Is 'getting it right' on the security footprint easier in one instance vs the other, fax vs email?

Update

For the purposes of comparison consider the emails / faxes to be coming from patients to healthcare providers and from providers to other providers.

Example:

jane@me.com -> provider@provider.com 

or

provider@provider.com -> provider@otherProvider.com

So 'best practices' would cover what the healthcare providers should be doing to guarantee that they are running as secure a system as they can given this scenario.

Answer 1

If you're asking whether sensitive information is safer when sent over the phone vs. over the Internet, you're probably looking for protection at the wrong layer.

If "basic best practices" are being followed, then any sensitive information that you don't want to be disclosed to third-parties is going to be protected by end-to-end encryption during transmission. At that point, it really doesn't matter whether the data is transmitted via fax, Internet, or homing pigeon. The encryption is what you rely upon for protection - not the transmission medium or infrastructure.

To address concerns of malicious attachments via e-mail vs. fax, cryptography still comes into play. Only this time, you don't use encryption. You use digital signatures. Then you trust that the sending party won't sign a package that contains a malicious attachment. Arguably, e-mail can be differentiated from faxes here, in that even with cryptography one might still receive a malicious attachment - and it has much more impact on a computer than it does on paper.

In either case, you do need to make sure that parties on both ends have the appropriate cryptographic tools and keys available to them. Again, this goes regardless of the transmission format. You're probably more likely to be able to coordinate support for encrypted & digitally signed e-mails than you are faxes, and that is what gives e-mail a distinct leg up in this discussion.

But again, the point remains that your transmission medium should not be what you rely upon for protecting sensitive data. Protect it before it goes out of your system, and you don't have to worry about the weak link(s) - or any hawks - that may be in between.

And in the end, much of the difference can become moot anyway. What you put into your fax machine is just as likely (if not more likely) to land inside of someone's e-mail inbox these days as it is to actually get printed by another fax machine.

Answer 2

Like most things in security, it depends on what you're trying to protect.

Faxes are less susceptible to remote attackers, but more vulnerable to local ones.

Many fax machines sit in a shared environment where anyone in the office might have access to the fax. A fax isn't thought of as secure and generally aren't in secure areas. This makes them subject to simply hanging out near the Fax machine and intercepting a fax.

Faxes are printed to paper which then needs to be disposed of. Disposal isn't always done in a secure way and could be subject to dumpster diving. In addition, some faxes still use a thermal transfer mechanism where getting ahold of ribbon from the fax makes it trivial to see what was transmitted in all the previous faxes.

Email however is more subject to remote attackers. Email is connected to the internet, so there's a far larger pool of attackers, and far greater avenues of attack. It's also MUCH easier to ex-filtrate large amounts of data through email than fax.

Look no further than the massive email breach of Sony. It's not even possible for this volume of data to have spilled through Fax.

Faxes offer little or no means of authentication, compared to email

Spoofing email isn't difficult, but there's several technologies that are designed to identify people trying to spoof an email address like SPF and Domainkeys. There's no technology designed to verify the person who claims to have sent the fax is actually the person who sent it.

.

Answer 3

I'm not in total agreement with either current answer.

TLDR; You should have both, ZIX is great, You'll have providers & 3rd parties that require fax.

FAX originally was a point-to-point direct line between 2 devices across a controlled network governed by the FCC.

Today, Faxing can be done across 2 main systems, Analog and Digital, or a combination of both.

The problem is control, if you use the internet you give away control to 3rd party hosted systems, some are certified for such use as medical records, these companies maintain massive T1 connections to terminate your eFax to PSTN, and vise versa, so in this instance, I send an email via SMTP (TLS/SSL) to their servers, their servers convert it to a tiff and fax it out their system. When I receive an email from them I either download the TIFF from an HTTPS Site, or they configure a TLS partnership with my premise mail system.

Email it is much harder to control your path, so you would look into a solution that can do this for you, we use ZIX, ZIX maintains a list of controlled gateways that they communicate with via PGP type encryption across the internet. For any destination that is not on this controlled network, they initiate contact with the end user, prompting them to create an account on this controlled network portal, aka ZIX Portal or ZIX Messaging Center.

It's all about access control.

Sources:

• http://www.zixcorp.com/email-encryption/zixdirectory/
• http://www.faxlogic.com/pricing/enterprise-hosted-internet-fax-server-overview.php

Good Luck.

P.S. MITM Attack for Fax...the fax prints out, and the UPS guy picks it up on his way out.

Answer 4

Security of Faxing, should be questioned. Especially if third party fax servers are used. A fax may be sent to a server for multiple distribution or as storage for local display to terminals.

These local and remote fax servers may not be encrypted and subject to unauthorized use.

Answer 5

Fax-to-fax over traditional POTS telephone circuits is generally thought of as being much more difficult to attack than any messaging system over the internet. It's more difficult for an attacker to gain a eavesdropping or MITM position on the PSTN network than it is for him to do so on a WAN or LAN.

Answer 6

FAX machine to FAX machine communications is still more secure than e-Mail. Further, to my knowledge NSA does not record and store FAX Transmissions. A good practice when using FAX transmission is be in contact with the recipient prior to or during the transmission process. The process requires real-time synchronization between machines and while nothing is 100% secure including snail mail, the analog FAX is growing at 12% per year, in spite of the fact that the technology is nearly 100 years old.