I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the vulnerabilities from an outside source that we can use as part of our "IT Security 101 for non-IT business leaders" training initiative. (I did search both here and on Google first. On Google, I keep getting lengthy articles, and I found good bits and pieces here as well as in my Google searches, but not a full list like I'm looking for.)
The background is that I have various people in the business side that just don't get it. They insist on using email and refuse to accept the fact that it's just not secure.
In my current dilemma, we're implementing SSRS for reporting, and we are expecting people to view the reports on the SSRS site. The reason is that most of the reports we deal with contain sensitive data of one form or another, and we just don't want these reports sent via email. State regulations where we operate identify PID as a last name, first initial or name, and any other form of identifying information, such as an address, SSN, account #, email, etc. The state laws also stipulate that a breach leaking 500 or more records containing such PID has to be reported to the state.
Many of the reports do contain PID by this definition, and most have well over 500 records. So IMO a single report picked up by a sniffer, or accidentally sent to the wrong person is a reportable breach - not something we want to deal with.
However, we have certain upper level management that seems to think that the rules don't apply to them, mostly because they don't understand how real the risk is. The good news is that we're making headway in changing their minds. The bad news is that their eyes glaze over when we get too technical. Also, they don't want to just take our word for it.
Examples I can think of:
- Sniffers can be used to read emails as they are moving across the network.
- Email gets sent through many servers between the sender and the recipient. Any one of those servers could be intercepting and saving that email.
I'm not too concerned about the list being too technical - We can us analogies that the business will understand to explain the technical concepts. I'm more interested in a list that's got all the risks.