Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Allow me to give some background information, so you may understand my situation better.

We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only medium of communication. We do not have a CRM. Customer Service Associates (CSA) can be untrained, or the intended recipients change frequently. As you can imagine, this is kind of an ad-hoc setup.

What I would like to get your suggestions on are, how do we make sure that any file that goes out of my email box is password protected? The second and most important question is, is there anyway that I can share documents in a Dropbox kind of way, where the CSA can only add the link to the document in the email, and later on, if we find that that the person was not supposed to receive the email, we can just delete the file from the Dropbox and no harm done.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

You could always try something simple like YouSendIt and set the policy to require a password to retrieve the file?

However, be aware of the "lost password" problem that you are about to create for your CSA's (and probably ultimately for yourself).

A google search for "secure file attachments" shows many enterprise-level services that purport to solve this problem - sadly, PGP is probably too complex, although PGP enterprise does some automation of outgoing email.

share|improve this answer

There are many products that will detect outbound emails with attachments; simply block all outbound emails with attachments, configure the block to respond to the sender with a message informing them that they must deposit the file and share the link.

share|improve this answer

CyberArk is the product designed for your needs. It provides secure e-mail, file sharing, document safe and password vault with exclusive access. It also could record videos about user activities for evidence management also. Unfortunately it is a commercial product and runs only on Windows Server 2008.

share|improve this answer

One possible solution would be to create a volume with TrueCrypt that's a little larger than the file you're sending. Throw the file into the TrueCrypt volume and email the whole volume.

This is over the top, most likely, but it's possible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.