2

A friend of mine has been running a small non-profit agency for some years now that assists refugees (shelter, food, medical supplies) displaced by war.

Due to current events she has asked me if she and her staff can secure their emails?

Their website is a hosted website on GoDaddy, is there any service that can be used to enhance their emails by adding a form of encryption that can be used by non-technical staff?

All the methods that I can think of would be above their technical skills. I am looking for a service with a trade off between security and user friendliness.

BrokenCode
  • 153
  • 3

2 Answers2

3

Email Encryption? Email is insecure.

That said what would be best for your client is to have all information received on a controlled site or portal. Similar to how many banks and credit companies send you emails, they direct you to retrieve the information via their websites. Users would need to create an account to retrieve the information, you can then track who received what information via ip addresss at time.

You will also need to secure your website, hosting with public/shared hosting providers would be the first change immediately followed by adding SSL.

I would expect other answers such as TLS encryption (transit layer security) or PGP and S/MIME email message encryption, but all of that is complicated.

A 3rd option would be to use a 3rd party email gateway that requires users to access email via a portal, a popular one is ZIX. You would still need to secure all communication between you and the ZIX email gateway (TLS1.2 is common) but there are costs associated with this that may be less than the labor required to build something.

Email Spoofing? If you are looking to secure your email sources, with godaddy you will need to use a 3rd party ESP (Email Service Provider) such as mandrillapp or sendgrid, then implement SPF/DKIM/DMARC to Secure your email sources.

Jacob Evans
  • 7,636
  • 3
  • 25
  • 55
1

Like Jacob said, a simple form of Email Encryption doesn't really exist. However, you can definitely train your users to use S/MIME to encrypt their emails. I find S/MIME to be easier than GPG and is supported by a lot more clients.

To set up S/MIME, you are first going to need your users to get S/MIME certificates. Comodo offers free S/MIME certificates that are quite easy to get. The only downside is that you need all your users to get the S/MIME certs. If some of them don't get the certificates and install them, you'll either end up with unencrypted emails (if sent unencrypted) or unopenable emails (if received encrypted), neither of which are good.

Installation of the S/MIME certificate varies between client, so I recommend looking it for each client that your users use. It's quite easy for OS X Mail, but can be a bit more complicated on something like an iPhone. There isn't much you can do to get around the installation process, but it's more of a trouble for you, than for your users. Your users shouldn't be accessing corporate email on their personal iPhones or devices if the emails are sensitive anyways. Note that if there are different mail programs installed (OS X Mail, and Outlook), the certificates would need to be installed for each client that you want to send and receive encrypted emails.

Now, once certificates are installed on all client machines, the fun starts. Because S/MIME relies on public/private key technology (same as GPG), there is some public key exchanging that needs to happen. The first time the sender (User A) wants to send an encrypted message, he needs to get the public key of the recipient (User B). Now, this is accomplished essentially by having User B send a signed message over to User A. An example exchange is below.

From: User A

To: User B

Hey! I want to send this document to you encrypted. It's the first time I've sent something encrypted to you, so can you reply with a signed message? I've signed this message so your replies to me are also encrypted.

From: User B

To: User A

Hey! I have signed this message and you should now have my public key.

From: User A

To: User B

Great! Here's the document that's been encrypted with my private key.

Now, once the keys are exchanged, there is no need for this exchange again. The keys are stored in the computer's "keychain" and are saved. It's recommended to back up the keychain if important, but it's not necessary. You don't need to exchange keys for every single user at first. You can always have them do it when they need to send encrypted stuff.

That's the basics for sending encrypted emails with S/MIME. It's a little bit complicated but not too much so. The hardest part is just getting the certificates installed on each individual mail client.

EDIT: You should get SSL certificates for your website too, not just your email. You can use Let's Encrypt for free, valid SSL certificates, as long as you have root access to the server. There are also implementations of Let's Encrypt that don't require root access, but I can't personally vouch for those. Some shared hosting providers also support Let's Encrypt, so ask them about it.

Felix Jen
  • 403
  • 4
  • 17