A few times a year, I recognise the need for a product where none exists because I hear multiple customers asking for it. This is one of those times. The products that an increasing number of my clients is looking for are e-mail scanning and archiving systems that can handle S/MIME-encrypted messages.
In a normal year, I visit 20 to 40 clients, ranging from small companies to Fortune 10, where I get to see what products they are using and how well these products work in a real-world scenario. Increasingly popular these days is the use of S/MIME and other e-mail encryption methods (such as PGP, proprietary web mail portals, and so on) to protect email both within the enterprise and externally.
S/MIME isn't necessarily the best method to use, but it's a stable, open standard and probably the most common email encryption method I've seen in use.
Every S/MIME customer I have goes through a few phases. First, they need to understand how it works. How do you turn it on? Who gets what keys? How are the keys distributed? What training will end-users need? How to automate its use? It's no small undertaking.
Emailing in the dark
Often in the second phase, S/MIME ends up nearly crippling the company's normal email functionality. S/MIME involves encryption, and when you encrypt email, it is no longer searchable. At the very least, users can no longer retrieve past emails based upon message text keyword searches, although the email subject line and some other information, such as file attachment name, may remain visible.
This may sound merely bothersome at first, but it becomes mission critical when you need that one single email for proof in a disagreement. Some users respond by turning their email subject lines into more descriptive headings that can be more easily found using keyword searches, but at some point, the sender begins to reveal information that should probably be protected within the S/MIME body.
Worse for today's computer security departments is the fact that S/MIME ends up defanging their anti-virus scanners, DLP (data loss prevention) tools, and email archiving and retrieval systems. Outgoing S/MIME-encrypted email can be antivirus scanned before encrypting and sending, but it's more difficult to scan incoming S/MIME messages, where the scanning is done on a gateway or by an external service provider.
Most of the risk from email malware isn't from the stuff you send, anyway. It's from the stuff sent to you. If you use S/MIME and don't have client-side malware detection for email, you now have a problem.
If you have or are thinking of using a DLP product, it won't work so well against S/MIME email. DLP products often look inside network packets for signs of leaking confidential data. Peering inside packets isn't so easy when the email is encrypted. As a matter of fact, it's quite a big hole.
Further, today's enterprises often use professional e-mail archiving systems to store and retrieve email for later analysis. A good email archiving system indexes stored email and makes it easy to locate and retrieve specific messages based upon any field or keyword. And none of the email archiving systems I've reviewed can handle S/MIME encrypted e-mail.
In search of S/MIME
Although the S/MIME standard implies that email should be readable between only the sender and recipients, the owning enterprise often has the legal right to be an included party. Many of my customers are looking for an archiver that can store email, along with the user's S/MIME key (both private and public portions), so that messages can be indexed, searched, and retrieved at a later date. Every S/MIME customer I have is begging for this sort of functionality.
The administrators don't even care if they have to copy the keys manually between the e-mail system and the archiving system, although automation would be better. They just want the archiving system, when supplied with the appropriate S/MIME keys, to perform its normal function.
So today, on behalf of dozens of customers, I ask: Is there an anti-virus scanner, a DLP solution, or an email archiving system that can elegantly handle S/MIME messages? Users and vendors, if you know of such a product, please post the link in the comments section or send your information to [email protected]. If your product can fix this common problem, I'll review it and post my results.