New blog!
GreenviewData's blog has moved to http://community.greenviewdata.com. Please update your bookmarks. This blog is no longer maintained.
Keep Your Information S.A.F.E. with Email Encryption
You already know why you need secure email.
Perhaps you're in a sector that's covered by federal email encryption mandates such as health care or finance, maybe you have statewide mandates to protect consumer data, or you recognize the inherent insecurities of email and want to increase your email security in order to protect your valuable trade secrets from prying eyes. In any case, the decision of which encrypted email service to choose can be a daunting one – one full of technical jargon, shortcuts, incompatibilities, and more.
All you need to remember is to “keep your email S.A.F.E.”.
S is for “Secure”
This seems like a no-brainer. You're encrypting your email, it HAS to be “Secure”, right? Not always.
Password protected files are easily cracked. TLS only protects point-to-point, and there are frequently 3-10 servers that handle each email message you send.
A is for “Accurate”
Accuracy is of utmost importance when dealing with email encryption. The most common reason for sensitive data to be sent in the clear is user error. An email encryption service must provide a “safety net” including filters that can trap data that is commonly accepted as “secure” such as social security numbers, and also highly-targeted filters for HIPAA compliance, Massachusetts and Nevada privacy laws, etc. Try to find out and use what the “big boys” use in your field.
F is for “Fault-tolerant”
If you have a single point of failure for your email encryption schema, and that point breaks (as it will sooner or later), what are you going to do, not send any sensitive email until it's fixed?
The most cost effective way of adding redundancy and reliability to your infrastructure is by moving to the cloud. Economies of scale allow cloud email services to provide all the above benefits and more at a cost that's a fraction of what it would cost to do it yourself. Also, they should include multiple locations and 24/7/365 monitoring and support of their infrastructure.
E is for “Easy”
No matter what the benefit, or how bad the penalty, people won't use a system that is too difficult.
Your users will forget (or say they did) to use a different email client to send encrypted email.
Recipients might not be able to open messages if it takes installing a program on their computer as their IT department may have that locked down.
Try to find an email encryption service that requires minimal setup, almost no maintenance, and works within the SMTP protocol guaranteeing compatibility with virtually every mail server on the planet.
The optimal email encryption service will offer transparent encryption/decryption to a select group of users, and easy access to others (again without compromising “S for Security”). Again, hosted email encryption services are especially well suited to this.
In summary, email encryption is complicated, and should be handled by experts. However, choosing the right solution is as simple as remembering to keep your email “S.A.F.E.”.
All “clouds” are not the same
With the recent disruption of some high profile websites on Amazon's EC2 platform (Reddit, Foursquare, and Moby to name a few), some naysayers are pointing to this as a weakness of cloud based services in general, rather than what it really is, simply a single provider having issues with specific services.
While Amazon locates servers across multiple "availability zones", the fact remains that a single rogue "network issue" was able to bring many associated zones offline simultaneously.
In contrast, we (Greenview) have distributed our servers in such a way that we are not dependent upon any one data center, or even any one provider. Even the famous 2008 data center explosion at "The Planet", where we have many servers, had no noticeable affect on our service. Back in 2003 when our home office and much of the East Coast lost electricity for several days, our service continued uninterrupted. The only issue was that we couldn't update our antispam databases and therefore let a bit more spam through. Our customers without electricity didn't even lose email because we automatically spooled it for them. During these and other data center failures, our service has been unaffected due to our multiple, geographically disparate data centers spanning many different providers not just across several states, but across several countries.
We anticipated and learned that despite advertised claims, even the most reliable and redundant servers inside the most "State of the Art" data centers, can still fail. We kept these lessons in mind when designing and implementing our new Zimbra hosting packages. Our Zimbra clusters have multiple servers per data center, replicated in real time across to a duplicate site with another identical set of clustered servers. We could launch new instances in either data center, or change data centers completely, within minutes if absolutely necessary. This may sound similar to Amazon's claims that "Availability Zones are distinct locations that are engineered to be insulated from failures in other Availability Zones", but we are using two completely independent providers. And that's just part of the package.
Additionally, every hosting package comes with our 30 day Email Archiving service included for free. This adds not just additional copies of your messages, but adds a completely independent infrastructure, to aid in our disaster recovery plans. Our email hosting customers have the option, for free, to archive the last 30 days of their email into a completely separate service spanning three data centers each with their own internal replication amongst local servers.
What does all this mean for you? More redundancy means higher uptime, and fewer worries. In fact, our services have had a 100% uptime to date since our launch in 2002. Additionally, economies of scale allow you to have these enterprise level features at a rock bottom price, a fraction of what it would cost otherwise. Add to this robust infrastructure our 24/7/365 support team, entirely based from our Ann Arbor Michigan headquarters, and you have a service that you can count on. While no service can claim to be "bullet proof", using multiple providers in geographically disparate data centers gives us a distinct advantage over in-house solutions, single server hosted solutions, or even multi-server solutions that rely on a single provider.
While none of our servers are housed in Amazon's data centers, our thoughts are with their team and their customers as this issue sorts itself out.
For more information on our services, our infrastructure, or just to test our 24/7/365 "No Voicemail" support service, please feel free to give us a call any time.
New office for Matt – Boxcraft?
Come join us on our Minecraft server: minecraft.greenviewdata.com
A few of us here at Greenview Data/SpamStopsHere decided that Matt in our support team needed a new office for April fools day. Since he enjoys playing Minecraft so much, why not make him a block cave for an office?
First step was to build a mockup in Minecraft itself. We decided to go approximately half scale by making each block 1.5' instead of the full 1 meter per block. This let us be a bit more creative with the block arrangement.
We started with some smaller boxes we had on hand. Tried a few different paint schemes.
Had to experiment with many different paint colors.
We finally decided on our paint colors and that free handing it wasn't going to cut it. We proceeded to make stencils. We created an 18x18 grid of 1 inch pixels. The blocks in the game appear to have a 16x16 grid so it matched fairly well with the in game block.
Diamond/redstone and grass stencils:
Here is the stone stencil after we were all done. Caked with paint.
Our first full size prototypes of stone and grass:
The assembly line begins. We needed 50 stone and 12 grass blocks. Since we had to do this in the basement storage area to avoid being noticed, we couldn't use spray paint. We hand painted each stone with the stencil. 
It's 7PM Thursday night, Matt has finally left for the day. We're prepping the ceiling in the adjacent room. Notice the diamond block in the lower left. This is now directly above him at his desk.
Build in progress.
For the ceiling, we bolted each box together with 4 bolts and large washers. One end rests on a 4x4 header mounted to the wall.
One of the center ceiling rows was sagging too much. Fortunately we built in a back up support system. A rope mounted to the top of the center block.
10:20PM a finished product!
Behind the Scenes: Blocking new spam campaigns
Here's a little peek behind the scenes into the details of spam blocking. Last week, I tweeted about a rash of new spam emails we were seeing. There was nothing special about these emails: just the usual prescription pill gibberish. I particularly enjoyed these lines:
"ppikllls for heailth
turkey sandwich toward secretly
gratifying curse over blotched"
What is noteworthy is how quickly our SpamStopsHere team was able to identify and block them (within minutes), so that our customers never even got the chance to read about "turkey sandwich toward secretly." In order to combat the millions of spam emails that are sent everyday, we use multiple filtering methods that are constantly monitored and updated by our SpamStopsHere techs. 24 hours a day.
One of these methods, a content filter, is what allowed us to block this particular set of spam. Content filters work by pattern matching many different parts of an email, including the headers and body of the message. This is actually what allows us to properly pass legitimate email containing words like "Viagra" while blocking actual spam, making SpamStopsHere incredibly effective for organizations like hospitals that may need to receive email with "spam-like" words. For the above spam emails, this content filter matched 13 different components of the email. Here's a sample of the code that's been edited to be more readable:
(num_newlines >=18) & (num_newlines <=20);
num_font_tags = 4;
In this case, the spam had some very specific traits: there would be a big block of 18-20 empty lines (newlines), and the html of the messages contained four <font> tags. Even though the messages were short and obscuring the normal spam keywords - for example "ppikllls" - these characteristics can uniquely identify instances of this spam campaign.
Once the filter is in place, any more spam of the same type is automatically caught and disposed of. In the next Behind the Scenes, we'll take a look at how we discover spam in the first place.
What would you like to learn more about? If you've got a question or an idea for a Behind the Scenes post, just send an email to blog@greenviewdata.com, or send us a message on twitter or facebook!
Security Tradeoffs
Bruce Schneier wrote an excellent summary the other day about the trend in Corporate IT to relax security standards in favor of convenience and flexibility when it comes to new consumer technology. He points out that cloud computing is making this easier, by taking the security burden off of individual devices and operating systems. But the main point he makes at the end is really key:
Security is always a tradeoff, and security decisions are often made for non-security reasons... Corporations want their employees to be able to work from anywhere, and they're going to have loosened control over the tools they allow in order to get it.
For me, this goes back to the idea of a Culture of Security. While I was the IT manager for a small business, the level of compromise I was willing to make regarding devices and security changed depending on my assessment of each individual's "IT savvy." Of course I was totally content to let the programmer use whatever hard- and software he pleased, while the call center reps. were limited to a strictly controlled terminal environment. But my true preference would have been to let everyone use whatever they were comfortable with.
Slowly, we're getting there. More and more hosted services that are platform agnostic and do the security work for you are making the dream of the hottest new toys in the workplace a reality. But as Schneier says, "we'll muddle through, as usual." Invest in a culture of security, and find solutions that remove the burden of security from the users, and we'll reach a corporate gadget utopia in no time.
What Digital Security Really Means
Let's get one thing straight: if you're dealing with sensitive information online then that data should be encrypted. If it isn't, you could be making a big mistake, possibly to the tune of millions of dollars. Every company should be working to secure their digital data. There is no such thing as perfect security; never has been, never will be. But good security is definitely better than none. And yet, there's been a disturbing trend, in the wake of RIM's struggles with foreign governments over the privacy of its encrypted network, to lambaste "the cloud" in a misrepresentation of what we mean when we talk about digital security.
Here's an analogy. In the days before the internet (ok, and still even today), important documents were printed out on paper. And that paper was stored in filing cabinets. And those filing cabinets lived in an office. Hopefully they had drawers that locked, or were behind a door that locked, and only certain people had the keys. If somebody did something bad, hopefully that wrongdoing wasn't recorded on paper, but if it was then you could always try to burn the paper before it was discovered. It certainly wasn't the case that just because you'd locked your paper in a cabinet in your office that the legal system couldn't see it if they asked for it. Or maybe that an enterprising journalist with some lockpicking skills couldn't get to it. The only way to truly secure your data was to not print it out and put it in a filing cabinet in the first place.
Today, digital documents like email have replaced the paper, computers the filing cabinets, and servers (in "the cloud") the locked offices. In the United States, practically the same laws of discovery apply to digital data as physical. In this absurd article on eSecurity Planet, the author quickly concludes that no wireless email is safe from government spying. Well, uh, yeah. Neither is your paper mail. Your landline phone calls are just as at risk as your cell phone calls. The article goes on to explain how wireless networks can be hacked, and that using encryption is essential for your data security. It leaves off the part about how locks can be broken, and keys (physical or digital) can be requested by judges.
This is the fallacious leap being made: that somehow handing your data off to S(P|I)aaS cloud solution fundamentally changes the security of that data. Just take this quote from a sensational article over on GigaOm:
Either way, your data could be at risk. If you send messages over the BlackBerry network, use Skype to call overseas, or send email or use the new voice-calling options from Google, theoretically what you say could be monitored by a foreign government, if India gets its way.
Really? Guess what: if you send a regular letter through the mail to another country, theoretically it could be read by that government. In some countries, that isn't even theory, it's fact. Going back to our analogy, this is really no different than if you were to store some of your locked filing cabinets full of sensitive paper documents in some other company's warehouse, maybe because you didn't have enough space in yours. Which is actually not an uncommon practice; just ask IronMountain.
I see the main source of people's fear with putting their data in the cloud is that it's no longer completely within their control, and that it's consolidated. If the government wants to see what you've locked in those filing cabinets, at least you know they're looking, and they have to come to your office to do it. But if instead everyone keeps their cabinets in one big warehouse and the government is handed the key by the warehouse owner, it might feel like some security has been compromised.
But of course, that's pretty much a fallacy too. The data passed around the web is never more secure than any physical letter bouncing around the post offices. Data gets passed around servers randomly and with little or no regard for who or what may be lurking there. Corporations harbor legions of computers infested with malware. Data breaches from emails sent to the wrong people, laptops stolen from hotels, usb drives disappearing, employees posting indiscriminately on social networks, etc. etc. highlight that your company's privacy is probably more at risk from itself than any enforced government espionage.
Do I think governments should be given free access to any network data? Certainly not. And it's unfortunate that the increasingly consolidated world of the internet (coupled with this new millenium's climate of terrorism-fueled fear) has perhaps shown some true colors of many governments that we had hoped weren't there. But that isn't an indictment of the cloud or those who trust in its security. We should be happy that hosted solutions mean the data whose privacy we're fighting for is now at least encrypted, where even a few short years ago there would have been no barrier at all to government access.
Because that's what we really mean when we talk about digital security. We mean that the data is being protected from simply being read by anyone who feels like it. That at rest or in motion (in the filing cabinet or in the mail), your sensitive data is not going to be read by anyone who shouldn't read it. That may or may not end up including certain governments, but leave the cloud out of it and remember this common sense: if you really don't want something to be read, don't write it down.
Rustock Botnet Wisely Abandons TLS
The big email spam news from last week was regarding MessageLabs' August Intelligence report, and the revelation that the Rustock botnet had risen to account for nearly 41% of all spam being sent. At over 46 Billion messages sent per day, that's a lot of spam. But the interesting part of the story is that the increase came after the botnet shrunk to about half its former size. How was this possible?
The reason most likely lies in the fact that the botnet operators dropped their use of TLS encryption on the spam they were sending out. Using TLS to encrypt email causes a significant processing overhead, so by eliminating its use the botnet was able to send out more email per infected computer - in fact, over two times more - allowing greater volume even with the reduced number of hosts.
It was actually unclear why Rustock was using TLS to begin with. Speculation is that the operators may have hoped to get more of their spam past filters by encrypting it, which turns out to be a pretty useless tactic. Because TLS only encrypts the session and not the actual email content, then spam blockers have no problem identifying the malicious email once it arrives at the source. For example, with a hosted anti-spam service like SpamStopsHere, there's nothing stopping our software from accepting the encrypted connection, receiving the "secure" email, reading it and clearly recognizing it as spam, and discarding it before it ever reaches the customer's inbox. After losing a large chunk of their botnet, it's no wonder Rustock reverted back to unencrypted spam and "quantity over quality."
But this anecdote serves to highlight a larger issue, which is the use of TLS for encrypting email in the legitimate business world. It may seem absurd to compare the email choices and habits of the most prolific spammer in the world with those of, say, a healthcare provider, but there are some relevant points to be made. While the HITECH Act has made secure communications a priority for any company handling sensitive information, how to properly handle email encryption is still pretty murky. The important distinction to make is that there are two cases to consider: data at rest and data in motion. Using TLS only covers data in motion, which is why using it to encrypt spam doesn't actually help a botnet get more past the filters. To do that, they'd need to use encryption for the data at rest.
In the next few weeks, we'll have a few follow-up articles that go a little more in depth with how TLS and alternate solutions can work to encrypt your emails and get your organization HIPAA compliant. If there's anything specific you'd like to see discussed, please let us know in the comments.
Extending Encryption Wednesdays
Today is the last Wednesday in August, also marking the end of our Encryption Wednesdays promotion where we gave free consultations to businesses interested in email encryption.
Or at least, it was planned to be the end. But we got such a huge response that we didn't have time to fit everyone in and we're still getting new signups. So we took it up with the top brass and we've decided to extend the service for the rest of the year. That means every Wednesday until December 29th we'll be offering free consultations on email encryption. Just use our handy form to sign up. We'll still only be allowing signups up to one month in advance at a time, mostly for our own sanity so we don't get backloaded. Of course, there are no obligations and no costs to you, so even if you're a few months away from making a decision on email encryption, it really doesn't hurt to make the call now and be prepared for later.
Thanks to everyone who participated and made Encryption Wednesdays such a big success. We're looking forward to talking to a lot more of you.
Encryption Wednesdays in August
We recently attended Hosting Con 2010 in Austin, TX., a conference which brings attendees from all over the world to discuss the current and future state of the hosted service landscape. We had a great time there both sharing and learning about all the ways that hosted email services are improving business, and had a lot of discussions on how hosting solutions have emerged to replace the time consuming and costly traditional software/appliance model. But the key topic was definitely the increased necessity of encryption over the past year.
Years ago when Greenview Data first began to offer a hosted email encryption solution, encryption was most prevalent in the health care sector due to the type of data transmitted and of course the HIPAA laws. However, in most other environments it was a frequently overlooked "best practice" due to the monumental effort involved. We recognized this need and began working with key players to produce a hosted service that was simple, cost effective, easy to implement and maintain, and satisfied all regulatory requirements.
Over the past year we have seen a tremendous increase in the demand for this service in response to the changing business landscape. Five years ago, our focus was on the large hospital market; now our email encryption customers extend to every facet of the healthcare and financial sectors, as well as many other organizations that either simply want to keep their data safe or are required to by state-wide mandates. We have added numerous encryption specialists to respond to this growing demand and to ensure we have top-notch support to cater to your needs when you need us. Today, we're extremely proud of our hosted encryption service, and especially the strong and dedicated customer support team behind it.
We understand how important, but often cumbersome and time consuming, email encryption can be. And we also believe that it's important for everyone to be well-informed on the topic and aware of all their options, because email encryption isn't just a vanity service - it's a vital step in ensuring our safety and privacy on the internet. To help with this situation, we are pleased to announce Encryption Wednesdays for the entire month of August. Each Wednesday during August, our encryption team will be available for scheduled appointments to discuss email encryption with any interested organization, with the same manner of personalized attention our customers have come to expect from Greenview Data since 1980. Best of all? We're doing this completely free of charge.
These consultations are a time where we can discuss your unique situation, determine your needs, explore possible solutions, and give you honest answers to any questions you may have. To schedule an appointment simply fill out this form with information about your environment and your available times. One of our encryption specialists will be in touch shortly to confirm your details, and finalize the appointment.
If you determine that our hosted email encryption service is a part of your encryption solution, we can initiate your setup while we're on the phone and have you up and running in under 48 hours. You may also determine that your organization doesn't have a need for email encryption at this time, or that our service just isn't the right fit (although we doubt that - we've got something for everyone). That's fine. We just think it's good for everyone to have all the facts to make an informed decision about an issue that is so important.
Tags
Categories
Archives
Follow us on Twitter!
- Ugh, twitter is whaling again