Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Allow me to give some background information, so you may understand my situation better.

We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only medium of communication. We do not have a CRM. Customer Service Associates (CSA) can be untrained, or the intended recipients change frequently. As you can imagine, this is kind of an ad-hoc setup.

What I would like to get your suggestions on are, how do we make sure that any file that goes out of my email box is password protected? The second and most important question is, is there anyway that I can share documents in a Dropbox kind of way, where the CSA can only add the link to the document in the email, and later on, if we find that that the person was not supposed to receive the email, we can just delete the file from the Dropbox and no harm done.

share|improve this question

5 Answers 5

up vote 2 down vote accepted

You could always try something simple like YouSendIt and set the policy to require a password to retrieve the file?

However, be aware of the "lost password" problem that you are about to create for your CSA's (and probably ultimately for yourself).

A google search for "secure file attachments" shows many enterprise-level services that purport to solve this problem - sadly, PGP is probably too complex, although PGP enterprise does some automation of outgoing email.

share|improve this answer

OP asks two questions that are related regarding:

  1. Encrypting content.
  2. Ensuring the content can only be viewed by intended recipient(s) - possibly in the cloud.

Given the use-case, while PKI is a good general solution for both issues (encryption for the intended recipient) and is supported out-of-the-box in most email clients (after private-keys are issued/managed) ...

PKI is not a good fit for multiple recipient/cloud posting cases.

For DropBox et al, I would recommend a product like nCryptedCloud. It allows users to define multiple allowed readers, does the encryption invisibly, there are multiple client connectors available, access rights can be revoked/managed, etc.

  • I am not a member of or in any way associated with nCryptedCloud.
  • I just think it is a very good product for this use-case.
share|improve this answer

One possible solution would be to create a volume with TrueCrypt that's a little larger than the file you're sending. Throw the file into the TrueCrypt volume and email the whole volume.

This is over the top, most likely, but it's possible.

share|improve this answer

CyberArk is the product designed for your needs. It provides secure e-mail, file sharing, document safe and password vault with exclusive access. It also could record videos about user activities for evidence management also. Unfortunately it is a commercial product and runs only on Windows Server 2008.

share|improve this answer

There are many products that will detect outbound emails with attachments; simply block all outbound emails with attachments, configure the block to respond to the sender with a message informing them that they must deposit the file and share the link.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.