Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.

We have tested the pdf's through the usual cast of internet mail providers, and to my surprise they are not blocked.

I believe that this is dangerous and I suspect that encrypted content may be blocked routinely by mail gateways in future, because virus scanners cannot verify if there is malware in the file. So these services fail-open vs fail-closed when observing these PDFs.

What do you-all think? Is this a danger? Has anyone else had this problem?

I am quite frankly surprised by this behavior.

share|improve this question
2  
To take this to the logical extreme: "We have a solution that will serve encrypted HTTP to our many clients, and to my surprise this (so-called HTTPS) is not blocked. I believe that this is dangerous and I suspect that encrypted content may be blocked routinely by web gateways in future, because virus scanners cannot verify if there is malware in the file. Is this a danger?" How is this different from your scenario, except for the transport protocol used? Also: is the alternative "oh, we'll just transmit confidential data in the clear, the internet is a safe place; what could possibly happen"? –  Piskvor Sep 2 '11 at 18:20
    
Haha @Piskvor, good point, but push is a lot more dangerous than pull protocols. –  Andrew Russell Sep 3 '11 at 3:08
    
Push is more dangerous than pull? Most phishing is pull. The user pulls down e-mail and then clicks on a malicious link. –  this.josh Sep 4 '11 at 18:24
    
@this.josh just the pop3/imap part is pull, smtp is push and the overall theme of email is push since the specific instigator to an email is the originator and not the receiver. –  Andrew Russell Sep 4 '11 at 21:06
    
@Andrew Russell: What does it matter to an intermediate server, which side of the conversation initiated it? Also, any more specific rebuke to my point than "haha"? –  Piskvor Sep 6 '11 at 13:03

3 Answers 3

up vote 6 down vote accepted

Obviously the safest option is to block it, but this annoys the business as it impacts the work they can do. So what really happens depends on the policies implemented by each organisation.

  • The most common approach I see in financial services is to block encrypted messages and then forward on a message saying "If this is an expected mail for business purposes please click here/contact IT to have it sent onwards"

  • The next most common is a flat-out block at perimeter

  • And I have worked at organisations that allowed encrypted comms straight through - mostly in smaller organisations, and in non-regulated industries.

The solution which does give the best of both worlds is for organisations to have encryption at the gateway or organisational escrow keys so the communications pathway across the internet is encrypted, but the mail gateway can still scan the file on arrival.

share|improve this answer

Mail providers don't (necessarily) block encrypted attachments, but every IT organization has policies on this sort of thing. You really need to do some research on your target market to find out if their mail servers (or their settings for things like Postini) are configured to strip these attachments. Just asking mail providers and/or places like Postini isn't enough.

share|improve this answer
    
Good clarification, not really in the mail providers best interest to scan. –  Andrew Russell Sep 3 '11 at 3:09

Email attachments are evil. A sensible (although probably unworkable) suggestion is to remove any attachments on incoming email and place that in some kind of vault for scanning. (Or just delete it.)

Merely scanning email for malware misses 0-day exploits or undisclosed exploits.

See, for example, RSA being hacked by malware delivered by email: http://www.f-secure.com/weblog/archives/00002226.html

Already in April, we knew that the attack was launched with a targeted email to EMC employees (EMC owns RSA), and that the email contained an attachment called "2011 Recruitment plan.xls".

"Don't open attachments in email" is common security advice, yet it's often ignored.

It is better to teach users to be suspicious of any email, especially email with an attachment.

See also historical problems of attachments in archived files.

share|improve this answer
1  
This post is a great example of how bad the security of standard computer systems really is. You can't even exchange files anymore.. –  pepe Sep 3 '11 at 20:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.