1. Security Awareness
If so many leaks involve employees accidentally sending out documents to the wrong recipients, or ignoring governance controls, then why not train them to do the right thing? This technique is known as security awareness.
Unfortunately, one of the more common responses to security awareness training is an eye roll. People don't believe that they, specifically, are going to be the one making a mistake. Even if security awareness training does sink in for one person, all it takes is for the person next to them to sleep through the class, and you're back to square one.
Here are just a few accidental email breaches that have occurred recently:
- A glitch in the FSU email system leaked code of conduct complaints to over 13,000 students.
- The North Carolina Department of Health and Human Services sent unencrypted emails that leaked PHI from over 500 individuals and later the same department exposed over 1600 people.
- UC Health exposed the data of over 1000 people by accidentally sending emails to a site with a similar-looking domain.
In these cases, a more technological approach is needed to prevent employees from sending outgoing emails full of sensitive information.
2. Email Governance
When security awareness can't fully secure a company against accidents, email governance picks up the slack. One might limit certain accounts to only sending emails to other corporate domains. Alternatively, one could scan outgoing email for certain kinds of valuable data, such as personal health information (PHI), social security numbers, W2 forms, and so on. Once this data is classified, it can be restricted from being sent outside the corporate perimeter.
The difficulty with email governance solutions is that they tend only to work well when an email exchange is hosted in an on-premise server. If your company is one of the many that uses a cloud solution, DLP might not be able to recognize a potentially compromising email attachment. Even if it does, hackers might have other avenues out of a corporate network, such as a File Sync and Storage (FSS) solution.
3. Unify Email Exchange and Data Exchange Under a Single Solution
In order to truly secure corporate email exchanges, whether they’re in the cloud or on-premise, the system that defends email cannot be outflanked. That is to say, a system might prevent an employee from sending secure documents while they’re sitting at their desk. However, that same system might be defeated if an employee is sitting in Starbucks, sending email from a web-based client. A system that can be defeated that easily is a wasted investment.
Safe-T Box is a holistic solution that plugs into hosted email, webmail, and cloud storage. When users send email, Safe-T Box automatically diverts the document, and then runs it past an enterprise’s DLP solution. Safe-T Box can plug into outlook, run as a standalone web client, or even as a mobile app. Lastly, Safe-T Box can either replace or integrate with popular cloud storage solutions, meaning that neither malicious insiders or legitimate users can evolve workarounds that avoid data loss prevention.
Don’t let vulnerable employees or malicious insiders use email to pilfer secure documents from your enterprise. To learn more about how Safe-T helps seamlessly lock down email without impinging on users’ productivity, check out our Secure Email Brochure today!