Email encryption has become almost frictionless

As you loyal readers know (I guess that should just be “readers” since that implies some of you are disloyal), I have been using and writing about email encryption for two decades. It hasn’t been a bowl of cherries, to be sure. Back in 1998, when Marshall Rose and I wrote our landmark book “Internet Messaging,” we said that the state of secure Internet email standards and products is best described as a sucking chest wound.” Lately I have seen some glimmers of hope in this much-maligned product category.

Last week Network World posted my review of five products. Two of them I reviewed in 2015: HPE/Voltage Secure Email and Virtru Pro The other three are Inky (an end-to-end product), Zix Gateway, and Symantec Email Security.cloud. Zix was the overall winner. We’ll get to the results of these tests in a moment.

In the past, encryption was frankly a pain in the neck. Users hated it, either because they had to manage their own encryption key stores or had to go through additional steps to encrypt and decrypt their message traffic. As a consequence, few people used it in their email traffic, and most did under protest. One of the more notable “conscientious objectors” was none other than the inventory of PGP himself, Phil Zimmerman. In this infamous Motherboard story, the reporter tried to get him to exchange encrypted messages. Zimmerman sheepishly revealed that he was no longer using his own protocols, due to difficulties in getting a Mac client operational.

To make matter worse, if a recipient wasn’t using the same encryption provider as you were using, sending a message was a very painful process. If you had to use more than one system, it was even more trouble. I think I can safely say that these days are soon coming to an end, where encryption is almost completely frictionless.

By that I mean that there are situations where you don’t have to do anything, other than click on your “send” button in your emailer and off the message goes. The encryption happens under the covers. This means that encryption can be used more often, and that means that companies can be more secure in their message traffic.

This comes just in time, as the number of hacks with emails is increasing. And it is happened not only with email traffic, but with texting/instant message chats as well. Last week Checkpoint announced a way to intercept supposedly encrypted traffic from What’s App, and another popular chat service Confide was also shown to be subject to impersonation attacks.

So will that be enough to convince users to start using encryption for normal everyday emailing? I hope so. As the number of attacks and malware infections increase, enterprises need all the protection that they can muster and encrypting emails is a great place to start.

What I liked about Zix and some of the other products that I tested this time around was that they took steps to hide the key management from the users. Zimmerman would find this acceptable, to be sure. Some other products have come close to doing this by using identity-based encryption, which makes it easier to on-board a new user into their system with a few simple mouse clicks.

I also found intriguing is how Zix and others have incorporated data loss prevention (DLP) and detection into their encryption products. What this means is that all of these systems detect when sensitive information is about to be transmitted via email, and take steps to encrypt or otherwise protect the message in transit and how it will ultimately be consumed on the receiving end.

DLP has gone from something “nice to have” to more essential as part of business compliance and data leak hacks, both of which have increased its importance. Having this integration can be a big selling point of making the move to an encrypted email vendor, and we are glad to see this feature getting easier to use and to manage in these products.

Finally, the products have gotten better at what I call multi-modal email contexts. Users today are frequently switching from their Outlook desktop client to their smartphone email app to a webmailer for keeping track of their email stream. Having a product that can handle these different modalities is critical if it is going to make a claim towards being frictionless.

So why did Zix win? It was easy to install and manage, well-documented and had plenty of solid encryption features (see the screenshot here). It’s only downside was no mobile client for composing encrypted messages, but it got partial credit for having a very responsive designed webmailer that worked well on a phone’s small screen. Zix also includes its DLP features as part of its basic pricing structure, another plus.

We have come a long way on the encrypted email road. It is nice to finally have something nice to say about these products after all these years.

Network World review: Email encryption products are improving

Email encryption products have made major strides since I last looked at them nearly two years ago in this review for Network World. This week I had an opportunity to revisit these products, and found that they have gotten easier to use and deploy, thanks to a combination of user interface and encryption key management improvements. They are at the point where encryption can almost be called effortless on the part of the end user.

I reviewed five products: the two that I reviewed in 2015 (HPE/Voltage Secure Email and Virtru Pro) and three others (Inky, Zix Gateway, and Symantec Email Security.cloud). The overall winner was Zix (shown here). It was easy to install and manage, well-documented, and the encryption features were numerous and solid. The only drawback was that Zix lacks a separate mobile client to compose messages, but having a very responsive mobile web app made up for most of this issue.

You can read the complete review in Network World here, and you can watch a screencast video comparing how three of the products handle data leak protection:

Network World review: Check Point Sandblast technology

Check Point has long been known as a firewall company but it is reaching beyond its roots with a new series of protective technologies under its SandBlast line. SandBlast has been around for several years, but received several significant updates over the past year to make it a truly effective endpoint protection product that can handle a wide variety of zero-day exploits across your entire enterprise, such as this backdoor exploit that we detected from China moments after we installed our product.

china-based-backdoor-attack

You can read my full review here (reg. req.)

Redmond magazine: Skype for Business, some assembly required

The on-premises and cloud editions of Skype for Business Server and the Cloud PBX are promising and less-expensive alternatives to traditional phone systems, but come in a complex array of options and require integration. The software has gained some promising features along with growing support for third-party software, hardware and services. In my review for Redmond Magazine, I look at what is involved in getting it setup and how it works with a sample video conference phone from Logitech here (shown above).

WindowsITpro: Choosing among various Slack-like communication tools

We all spend too much time on email, and if your inbox is overflowing with messages from your coworkers, it might be time to investigate another way to communicate. I review for WindowsITpro some of the issues involved in choosing a tool for team communications with intranet-like features, text messaging, workflows and collaboration features. While Slack is a leader in this field, there are lots of other choices (such as Glip, shown below) that could cost less or do more.

iBoss blog: New Windows 10 Anniversary Security Features are Worth the Upgrade

This month the updated Windows 10 Anniversary Edition is now available for download. (Here is a list of offers on Microsoft’s blog.) There are several new security features worth mentioning, including Information Protection andDefender ATP (each of which will require a Windows 10 Enterprise E3 or E5 subscription respectively). I cover what these new features are and suggest that if you are using an earlier version, it might be time to upgrade on my iBoss blog post today.

Network World: Ten new generation endpoint security products compared

Endpoint security used to be so simple: you purchase an anti-malware scanner, install across your endpoints, and you were protected. Not anymore. However, the days of simple endpoint protection are over. Scanning and screening for malware has become a very complex process, and most traditional anti-malware tools only find a small fraction of potential infections.  The attackers have gotten more sophisticated, and so too must the endpoint detection and response (EDR) tools, which need to find more subtle exploits, even ones that don’t leave many fingerprints.crowdstrike flow

This week, I review of ten different endpoint detection and response (EDR) tools for Network World magazine. You can read the complete review package here.

I spent several months running Outlier Security, Cybereason, Sentinel One, Stormshield SES, ForeScout CounterAct, Promisec PEM, Countertack Sentinel, CrowdStrike Falcon Host, Guidance Software Encase, and Comodo Advanced Endpoint Protection. From this experience, I came up with a series of broad trends:

Virus signatures are passé. Creating a virus with a unique signature is child’s play, thanks to the nearly automated virus construction kits that have filled the Internet over the past several years. Instead, many of these products tap into security news feeds that report on the latest attacks such as VirusTotal.com and other reputation management services.

Second, tracking executable programs is also so last year. In the old days of malware, exploits typically had some kind of payload or residue that they left on an endpoint: a file, a registry key or whatnot. Then the bad guys graduated to run their business just in memory, leaving little trace of their activity, or hide inside PDFs or Word documents, or would force your Web browser to a phished site that contained Java-based exploits. Today’s hackers have become more sophisticated, using Windows Powershell commands to set up a remote command shell, pass a few text commands, and compromise a machine without leaving much of a trace on an endpoint.

Many products can track privilege escalation or other credential spoofing. Modern attackers try to penetrate your network with a legit user credential that uses a default setting when you installed SQL Server or some other product, and then escalate to a domain administrator or other more significant user with greater network rights.

Insider threats are more pernicious, and blocking them has become more compelling. One of the reasons why traditional anti-virus protection has failed is because attackers can gain access to your internal network and do damage from a formerly trusted endpoint. To block this kind of behavior, today’s tools need to map the internal or lateral network movement so you can track down what PCs were compromised and neutralize them before your entire network falls into the wrong hands.

In addition to insider threats, data exfiltration is more popular than ever. Moving private user data, or confidential customer information, out of your network is the name of the game today. Look no further than Sony or Target to see the harm of making public some of their data as examples of what the EDR tool has to deal with now.

Many tools are using big data and cloud-based analytics to track actual network behavior. One of the reasons why the sensors and agents are so compact is that most of the heavy lifting of these tools happens in the cloud, where they can bring to bear big data techniques and data visualization to identify and block a potential attack.

The variety of approaches is stunning, and worth a closer look at these tools, to see if you can leverage one or more of them to better protect your endpoints.

Network World 9-vendor multifactor authentication roundup

Due to numerous exploits that have defeated two-factor authentication, many IT departments now want more than a second factor to protect their most sensitive logins and assets. The market has evolved toward what is now being called multi-factor authentication or MFA, featuring new types of tokens and authentication methods.

For this review in Network World, we looked at nine products, five that were included in our 2013 review, and four newcomers. Our returning vendors are RSA’s Authentication manager, SafeNet’s Authentication Service (which has been acquired by Gemalto), Symantec VIP, Vasco Identikey Authorization Server, and TextPower’s SnapID app. Our first-timers are NokNok Labs S3 Authentication Suite (pictured above), PistolStar PortalGuard, Yubico’s Yubikey and Voice Biometrics Group Verification Services Platform.

All of these products are worthy of inclusion in this review as representative of where the MFA market is heading. In addition, if you want to stay on top of MFA developments, we recommend you follow our Twitter list here.

My review also features a collection of screencaps here, and an overall trends rundown as well here.

 

Network World: Google’s Pixel C Android tablet is sexy but won’t replace your laptop

NexusRYUKey_O_SILVER_TQFPixel C is the first all-Google Android tablet. It has a 10.2 inch screen and is designed to be used with a companion keyboard that also doubles as a protective cover. The tablet isn’t quite a total replacement for your laptop but it could qualify as the sexiest Android tablet on the market. The Pixel C shouldn’t be confused with an earlier Pixel model, which is a fully decked out Chromebook laptop that costs twice as much.

In my review today for Network World, I talk about the pros and cons for this tablet, and the unique magnetic keyboard that is its most interesting feature.

PC Magazine: the evolution of spreadsheet analytics

Like some of you, I got my first introduction to the PC from the spreadsheet. It has been around for more than 35 years in one form or another, and most of us have at least a basic working knowledge of how to use it for rudimentary calculations. In my computing career I have seen numerous spreadsheet abuses – it is amazing what people can force a spreadsheet to do for them. I actually wrote about this in 2014 for Intuit’s blog here.

One of the reasons that Excel and other spreadsheets are so abused is that it can be a very addictive tool, and users are fearful of having to learn something else. Another reason is given by Ron Shaich, the CEO of Panera Bread who says that too often middle managers “manage from the spreadsheet, viewing it as an oracle.They make decisions believing the numbers of the past loaded into the spreadsheet foretell future outcomes.” Sadly, the future is never as certain as we might hope.

If you can break from its charms, you can make use of your computer for a lot more useful activities such as data collaboration and analysis. For the former, you often see the spreadsheet context as a way to share a simple database (not surprisingly, Intuit sells one of these tools) among a work team. For the latter, there is the category of what has been called self-service business intelligence tools. I looked at the best of these for a review I did for PC Magazine last month of ten different BI tools.

The hard part is that these collaboration and analysis tools often have steep learning curves and make it trying to understand their user interfaces. Some products are better at data exploration than data analysis and reporting, so keep that in mind as you look at them. Some tools also cost five or more figures and thus aren’t very appropriate for smaller businesses. Finally, these BI tools come in several different versions, including browser-based SaaS and desktop and server versions: keeping the features straight among them will require some careful study.

Still, spreadsheets are reaching the end of their utility as work teams spread out across the globe and as we want to build better and more useful data models to run our businesses. At their core, the spreadsheet is really a souped-up calculator, not a way to model and share data. Spreadsheets lose their potency when they grow to beyond a single screen to display your calculations or hold a sparse matrix that doesn’t neatly line up in rows and columns.

PowerBI field editorIf you are going to break free of the spreadsheet’s orbit, you probably want to start off with Microsoft’s PowerBI tool (the controls are shown in the screenshot at right). This is free and works both in conjunction and independently from Excel. For a free product, it is amazingly capable. For example, you can query Mailchimp email lists so you can monitor data and trends about your campaigns, reports and individual subscribers, and also query Quickbooks online data. There are both desktop and browser-based versions and a huge collection of learning resources to help you over the hump of getting started.

Besides Microsoft, there are more than several dozen different BI tools: I have looked at a total of ten for PC Magazine, and each has some advantage over a simple spreadsheet. Does this spell the end of the spreadsheet? Hardly. But it does show the beginning of a new market that is worth looking into. As Shaich says in his post, “A spreadsheet is merely a way to organize data. Its numbers generally capture trends of the past, but it is in no way predictive of what’s to come.”