So, since you are using email, consider the following facets of your email usage while you read through the sections below. The facets in questions here can help you determine which path or direction you can to take with regard to your optimizing your email decisions, such as its initial setup, how access works, your (and your teams and colleagues') usage, your information storage, and continuing administration of the email system(s) you use. 
  • who are you emailing with? (this inputs into access and comms security )
  • what is the content and its sensitivity? (this inputs into usage--encryption, storage, setup, admin)
  • where are you with respect to each other (physically? <-yes in terms of deciding VPN/encryption/Hosting)? (this inputs into setup, comms sec)

Setup

  • Where do you host it?
  • Which country/s you work in/on? What is the relationship between hosting provider and gov of countries you work in/on? Some organizations are concerned that their adversary has access to their emails (because of local or country-based internet providers or email providers).
  • Do you trust the company? Do you trust technical ability of administrators of the hosting company to protect your emails?
  • What features does this email has: 2fa, encryption (in-transit: SSL , e2ee), spam protection, 

Access

  • Can all members/partners use the same email provider (have the same domain to minimize traffic)?
  • How do you (need to) access it: browser, email client, computer, phone, ..?
  • If you need to access your email via an email client, how do you pick the best client?
  • USAGE functionality:
  • calendaring
  • filtering
  • key management
  • signature/forward
  • archiving
  • prioritization
  • trustworthiness - open source 
  • usability/documentation
  • If you need to access your email via browser, what settings/add-ons to use for protection of info?

Storage

  • Where do you host it? (see "setup" above)
  • Where do you keep emails? 
  • Is it Pop or IMAP?
    • (pop means no storage at server)
    • (imap meaning leaving at server)
  • How do you archive emails? 
  • Will archived emails need to be accessed in the future?
  • How will you organize these emails?
  • How will you store them and keep them secure?

Usage

Communication security

  • Will you use email to communicate with the most confidential actors/agents and most sensitive topics?
  • Do you use email encryption (GPG)? 
  • Do you have a policy on this?
  • Do you centrally manage keys?
  • Do you need to use anonymous email accounts?
  • Different email accounts for different groups you work with?

Productivity

  • Do you need to have shared, function-based email accounts (like contact@ or info@)? Some staff are concerned about their identity being connected to their employer. To address this, an organisation might use a function-based email account instead of a name-based email account. 
  • How to make it happen securely (eg. forwarding instead of sharing the password). 
  • If using email encryption, how will you store the key information so that multiple people will have access to it, but it is still secure? 

  • Best practices on how/when to use shared accounts

  • Do you need to have internal mailing lists?
  • Does your email provider manage this or do you use other 3rd party services?
  • If you use encryption, how do 
  • you manage lists with encryption?
  • Per-recipient rules
  • Do you need to have external mailing lists?
  • Do you have the capacity to manage them yourself?
  • If not, do you trust the provider?
  • How do you extract information and documents from your emails into a proper file system (knowledge base etc.) ?
  • How do you make use of some productivity tools of your email client (if there)
  • USAGE functionality:
  • calendaring
  • filtering
  • key management
  • signature/forward
  • archiving
  • prioritization

Administration

  • How do you determine if someone new needs an email address? (contractors etc.)
  • Who is in charge of backups and recovery of lost/old emails?
  • What happens to email accounts no longer in use? (left org, or compromised, or...)
  • Is 2 factor authentication available? Is it enabled? Some organizations are concerned that their staff's email accounts are easy to hack into. Enabling 2fa can be a good step to securing email. 
  • Independent (from hosting provider) email encryption - why bother to do it? what you gain? how does this play with different devices and programs you use to access email (eg. perhaps you can decrypt emails on computer but not on the phone)



What would a secure email decision tree look like?

During one of our writing sprints in April 2016, we explored the possibility of create a secure email decision tree for an organisation. This is a list of questions that we thought might provide a good start. 

  • What are the different ways to secure email messages in transit, and how do I choose the right approach?
  • What are the different ways to secure email messages in "at rest", and how do I choose the right approach?
  • Do you need to be able to securely communicate with others outside of your organization?
  • How do you decide where you should host your email?
  • Do you need to use your existing client?
  • Are you stuck using MS Exchange to host your email and security is a concern? 
  • Yes: here are some options for how to make your org emails more secure:
  • Change from MS Exchange to an open mailserver (that supports IMAP), either run it with the help of a trusted provider (think about jurisdiction & data retention) or run it yourself.
  • Enable IMAP support on the MS Exchange mailserver (might increase serverload, check if your machine is still 'fit' enough). 
  • Make mail from MS Exchange server accessible in Thunderbird by:
  • Using the Exquilla Plugin for Thunderbird. ($10/user/year or $25/domain/year+$5/user/year)
  • DAVmail - is a well-maintained translation system - it speaks Outlook Web Access (OWA) or Exchange Web Services (EWS) to the exchange server and offers LDAP/CardDav/CalDav/IMAP for standards-based client; "Releases are tested on Windows, Linux (Ubuntu) and Mac OSX. Tested successfully with the Iphone (gateway running on a server)." - http://davmail.sourceforge.net/ 
  • Make PGP encryption possible in Outlook email client using:
  • GPGOL (GPG for Outlook) in addition to GPG4Win - this is a complicated solution and often doesn't work right. This solution can't send/receive PGP/MIME (Note: PGP/MIME is the next generation of PGP that encrypts the entire message so you can't see the name of attachment) . 
  • Outlook Privacy Plugin – this solution can't send PGP/MIME.
  • PGP Desktop - $100/user/year this is a very difficult system to wield; it has a tendency to both send email that doesn't "need" encryption encrypted (via it's "opportunistic" setting) and to fail in very unpredictable ways and send email meant to be encrypted in the clear. It also "MITMs" your email traffic (Outlook <-> PGPD <-> VPN/Network <-> Exchange), and interacts in a very confusing way when you use VPNs. 
  • Mailvelope – this is a browser-based email encryption tool that uses your PGP key. Note: this tool does not encrypt attachments
  • No: Great! You have lots of options:
  • Linux server (ask someone who knows about this stuff to write about these options)
  • Now that you know which *type* of email hosting you want/need, you can explore where to host your email:
  • Will you host your org email internally, on your own self-managed server? OR
  • Will you host your org email with a third party?
  • How do you select your email host...
  • How will your staff access their email? Which devices?
  • This will help determine how your emails are stored/archived. Some email services are only available through a web portal or are better viewed on a mail client. If you need to access emails on mobile phones, then encrypting your email would present a problem (it is not recommended to keep your key on mobile phone) 
  • [ Explain why someone would want to use a local email client or not]
  • Determining your email needs:
  • How do you decide your organisation's approach to email addresses? When do you use general accounts (accessible by multiple people) versus personal accounts (accessible only by individual)?
  • Questions to ask:
  • Is your staff concerned about their identity being connected to the work of the organisation?
  • Yes: Change name-based email addresses to initials or function-based emails if staff are concerned about their identity being connected to their work.
  • No:
  • Are you concerned about maintaining access to emails after your staff has left the org for institutional memory?
  • Yes:
  • No:
  • List the pros/cons, scenerios when it might make sense
  • Name-based
  • Full-name or just first name or initials
  • Function-based email
  • Could be an alias email that points to individual accounts, or using a function-name as your individual email address (for institutional memory)



Organisational Email Encryption

Email encryption tools

Considerations

Centrally storing PGP keys and/or revocation certificates

In some situations, organizations may want their staff to use PGP email encryption, but they are concerned that some staff may lose their private key and/or their passphrase to decrypt email. To address this concern, some organizations centrally store the PGP keys of their staff.
Some reasons why this approach might make sense for an organization:

How would this approach be implemented?

Considerations related to centrally storing revocation certificates
Having access to the staff's revocation certifications will ensure that even if staff lose access to their emails because they lose their passphase or keys, the organization will be able to revoke the faulty PGP key on the key server. If the organization didn't keep a backup of the revocation certificate and the staff lost access to their key, there would be no way to revoke this key which causes confusion for those who want to use this person's key.

How would this approach be implemented?
One way to do this is require that staff email their revocation key to revocation@organization.org once they set up their PGP keys. If this (PGP protected) email get compromised, the damage is still within bounds: the attacker cannot read or access email, and the only thing needed to be done is create a new key.
Note: This is not a replacement for good backup strategies!

Organizational vetting and authentication of staff PGP keys

Secure email policies

Common challenges

The organization uses MS Exchange Servers

Many organizations use Microsoft Exchange (as opposed to Linux) servers. Unfortunately, Thunderbird doesn't play well with Exchange. Here's why:
There are two mail protocols: IMAP and POP3.

For more info on POP3 vs IMAP:  http://www.hyperoffice.com/pop3-vs-imap/
MS Exchange does not by default support IMAP which is why it doesn't work well with Apple Mail or Thunderbird. It "can" support IMAP but does so very poorly (a lot of timeouts and throttling of connections) leading to a very annoying mail experience.
Note: Some tech teams prefer to use POP3 because they may feel that they have more support over the email information (it isn't on multiple devices). But it's important to consider all of the other consequences, such as the ability to back up the information if it only lives on each staff's computer, and difficulties using email encryption.
If you're working with an organization on MS Exchange, here are some options:

  1. Change from MS Exchange to an open mailserver (that supports IMAP), either run it with the help of a trusted provider (think about jurisdiction & data retention) or run it yourself.
  2. Enable IMAP support on the MS Exchange mailserver (might increase serverload, check if your machine is still 'fit' enough) .
  3. Make mail from MS Exchange server accessible in Thunderbird by using the Exquilla Plugin for Thunderbird.
  4. Make PGP encryption possible in Outlook email client using:

    1. GPGOL (GPG for Outlook) in addition to GPG4Win - this is a complicated solution and often doesn't work right. This solution can't send/receive PGP/MIME (Note: PGP/MIME is the next generation of PGP that encrypts the entire message so you can't see the name of attachment) . (https://dejavusecurity.github.io/OutlookPrivacyPlugin/)

    2. Outlook Privacy Plugin – this solution can't send PGP/MIME . 
  5. DAVmail - is a well-maintained translation system - it speaks Outlook Web Access (OWA) or Exchange Web Services (EWS) to the exchange server and offers LDAP/CardDav/CalDav/IMAP for standards-based client

Training staff on PGP email encryption

For in-person trainings, it will likely take at least one day to get people on to PGP (minimum 2 hours). You could have people working in small groups, so they could help each other out and practice sharing and receiving keys, etc.

Your training process may include the following components:

Mobile phones and encrypted email

In general, this is a bad idea. Mobile OS platforms are still immature. Mobile phones are inherently insecure because the baseband processor on your phone always has potential access to your data. And here are some other reasons why this is a bad idea:

Resources