We use an email almost every day as a mean for sending important documents to other people. Usually we send documents outside the security perimeter of an organization. It means the documents are being sent to external recipients. In this paper, we will not discuss how internal information is protected inside the enterprise. But what about the documents that leave the organization? We cannot control in any way how they are used.

Conventional DLP (Data Loss Prevention or Data Leak Prevention) systems control the transfer of information outside a company and, in theory, prevent confidential information from leaving the company. But if we need to send confidential information to an external recipient, how can we be sure it remains secure?

Let us outline several key requirements to confidential information transfer:

• a document should not get to third parties;
• the recipient should be the person we send the document to;
• it is necessary that the secured document cannot be viewed on a computer or a device that does not belong to the recipient;
• the secured document should not be printed (if there is no permission for printing);
• it should be impossible to make a screen capture of the document.

In other words, we want the protected document to remain confidential.

Email is convenient and fast. A couple of mouse clicks and a document attached to the message is sent to the recipient. That is why people everywhere use this method to send electronic data over a distance. There can be different ways to provide confidentiality of the attachments.

Let us consider several ways to protect email attachments.

1. Make a password for the document. Provide the recipient with the password.

+ It is quite fast and convenient.
- Information protection is extremely unreliable.
- The secured attachment is stored by the recipient in plain text form.
- The attachment can be opened on another computer with the same password.

2. Encrypt the file and attach it to the email. Provide the recipient with the key to decrypt the information.

+ Reliable information protection.
- Certificates of the public keys are to be paid for. It is not easy for a person or an organization to obtain them.
- Decrypted attachment is stored by the recipient in plain text form.
- The attachment can be opened on another computer if the decryption key is available.

3. Create a protected communication link between the sender and the recipient.

+ It is relatively reliable.
- You do not always know whom to you will send the important information to.
- Information is stored by the recipient in plain text form.
- The attachment can be opened on another computer.

4. Send a sealed (and possibly notarized) copy of the document with a delivery man.

+ It is relatively reliable.
- The paper document is stored in plain text form.
- It is less convenient to store a physical object than an electronic one.
- The process is long and means more trouble.
- The documents can be stolen and viewed by the third parties.

5. Implement DRM into attachment before sending it.

+ Reliable information protection.
+ It is quick and convenient: no additional actions from the sender are required.
+ Information is stored by the recipient in a protected form.
- Extra costs are required to install the attachment protection module on the mail server.

Now let’s summarize:

It is obvious that methods 1 to 4 can be of interest in some cases. In everyday business, however, they complicate the transfer of a confidential document significantly.

But there is a chance to use a secure email with DRM for free. The advantages are no pay, report of protected emails opening and additional features. For more details please visit www.sfletter.com.

If the task is to secure an email attachment reliably and quickly, the natural choice is to install special attachment protection module on the enterprise mail server. The method has a number of clear advantages as compared to other methods and solves all the pressing problems including the viewing of the statistics on the attachment usage. Furthermore DRM implementation allows security mechanism to travel together with document and guard it where ever it is.

We have asked the experts of the information security market to comment on the review.

Michael Kalinichenko, SafenSoft CEO:
“It is highly important for a sender not to be involved a lot in technical issues of the process of transferring a message with a secured attachment. In other words, the process of sending a confidential message should not differ from sending a common, unprotected message. I often send important information that is of commercial value for both corresponding parties. It would be convenient to just attach a confidential document to a message and send it, so that the recipient receives the message with the protected attachment.”

Madina Yunusova, Marketing director for StarForce Technologies:

Personally I would be interested in controlling who, when and where has got access to the secured document. I need to be sure that the recipients use confidential information according to its nature and do not allow leakage to third parties.

In any case, every person selects the method of transferring protected email attachments. Nevertheless, one should not disregard the features of the modern systems that allow secured email attachments quickly and reliably and sending them to the required person. With the usage monitoring available, confidential information control raises to a whole new level.