Are file attachments "unsafe"?

Question

The management at work are asking, "How can we send files easily and safely to each other?", arguing that:

• Putting attachments in email is not safe. They want to send links instead
• They want to refer to a central, latest version of a file, rather than sending a copy
• They want to be able to read the file both on laptops and iPads
• They want to share files with people outside the company

The problem is:

• Sending links (to a shared network drive) is not straight forward in Microsoft Office. You need OneDrive for this, and sometimes you don't get the file:// prefix. Also, links won't work on Macs.
• iPads don't have access to the shared network drive. You could use http, but how do you refer to this while working from Office? Plus, you don't want to expose your network drive on the Internet.
• We can't grant external people access to our systems

A possible solution is to use Sharepoint, but this is a big step. Same goes for Google Drive. It would take forever to convert our document base.

What is the recommended approach? Are we stuck with attachments? Does mail encryption or file passwords make any major difference as far as security goes?

UPDATE: Based on replies, I should point out that by "unsafe", the management isn't referring to the risk of clicking a malware attachment, but to the fear of their sensitive files getting in the hands of the wrong people. They argue that it's easier for an attachment to get lost or intercepted, than for a link. This would assume that the security regime for the server hosting the link is stronger than that for the email client on whatever device they are using. I'd like to hear comments on this.

Answer 1

There is no obvious difference in transporting malware directly as attachment or let the user retrieve it by visiting a link within the mail. But it might make a difference depending on which other security policies and tools are in use in your company:

• If the mail is not encrypted and the link does not point to an https side it might be better to use links, if the firewall (which you hopefully have) is able to protect against malware on the web, but not or less capable to do the same for mails.
• If you allow and support encrypted mails (PGP or S/MIME) the firewall is usually not able to look into the mails, because they would need the private key of the recipient. So links might be safer, especially if the firewall is also able to intercept and analyze https traffic (most better firewalls do).
• If you have a policy of not sending attachments within mails it might be accompanied by a policy to not accept attachments in incoming mails. This would make it easy to weed out lots of malware (or even targeted attacks) which you get today as mail.
• The policy of not sending attachments can be accompanied by a central storage which you have to use instead of attachments. With the right permissions on the folder you can trust the links to the storage you get, because only authorized (and trusted) users have access to it. This is in contrast to mails, where you can easily spoof the senders address so that you cannot trust the sender info of the mail.

In summary: with the right security concept behind it such a policy might actually make sense.

Answer 2

Edited to take your clarifications into account: E-mail encryption should keep you safe in this respect (e.g. confidentiality). See the e-mail encryption section below for further details. This should prevent any "listening" hackers from being able to read what is being sent. As far as sending links goes, if the links are within a secure internal company site, this should be a viable option as well, but may be more costly to implement and maintain than using encrypted e-mail if you do not already have such a site.

Attachments in e-mail:

Yes, e-mail file attachments can be unsafe (but so can other methods of transferring files). The problem with e-mail attachments is that they can contain malware that could infect your computer. However, it is oftentimes necessary to send and receive e-mail attachments. Alternate means of sharing attachments (e.g. SharePoint, making CD’s, e-mailing links, ftp, even sftp) have their own benefits and security risks as well. They are not necessarily safer than sending e-mail attachments. Even something as simple as a .jpg picture can be maliciously edited to do unwanted things. Here are some things that help increase security with e-mail attachments (although there are more):

• Train the company employees on how to be more secure, including the items below:
• Only download attachments when they are from a trusted source.
• Have it be company policy that everyone sign their e-mail with a digital signature, and do not download attachments from unsigned e-mail. This step prevents hackers from impersonating a known employee.
• Make sure your antivirus is up to date (e.g. the IT department should push out updates, or have the antivirus software automatically pull updates).
• Do not look at or send attached jokes / e-cards, etc. as they can contain malware.
• If the attachment appears legitimate, download it and scan it with your antivirus software before opening it. Do NOT open it, and do report it (e.g. to your IT department) if the antivirus software detects a virus. If you haven’t opened it, it is usually safe, and best to delete it after your security team (if you have one) has looked at it.
• Certain files, especially executables are especially dangerous (.exe). If you don’t recognize the extension, or if it is an executable, don’t open it (unless it is necessary). An example where it is necessary is if you are a software development business, and you ask an employee to send you their program so you can run and test it on your computer.

E-mail encryption:

E-mail encryption goes a long way in keeping your information secure (e.g. protects confidentiality and integrity), but it does not entirely protect against malware. If you are discussing private business matters, or privacy sensitive information in e-mail, it would be best to encrypt it. Examples of this type of information include, but are not limited to:

• Lists of people’s names and addresses.
• Credit card information
• Details on projects that your business is working on (e.g. proprietary information)

From a security standpoint, it is good to assume that hackers (including possibly competing companies) can see what you are sending in e-mail, unless you encrypt it. At that point, they can only see the encrypted e-mail, but not the contents unless they are able to break the encryption scheme, which is typically not technically feasible if you use a strong encryption scheme. Whatever encryption scheme you use, I recommend selecting the highest key size available for maximum security (e.g. if you have AES 128 and AES 256, use AES 256). Malware can still be sent through encrypted e-mail, so follow the steps listed in the top section to be safer.

Sending links:

Sending links can be just as dangerous as sending attachments. Someone can send a link to a malicious website that will download malware to your computer. To prevent this, don’t follow links that aren’t from people you don’t know. Even if it is from someone you know, if it is a joke, or something not work related, it is still best not to follow the link. One thing that would be safer is to have a company website / SharePoint site that you share links to, but securely setting this up is another huge task.

Conclusion:

My recommendation would be to continue to use e-mail attachments if that is working well for you, however, educate the employees of the company of the risks, and train the employees in how to securely download attachments (as discussed above). If your company has the need to make things available to the public, a website would be useful there (it would need to be set up securely). If your company is large, it would probably also benefit from a shared drive or SharePoint site, again, if set up securely.

Answer 3

You can safely share files in any circumstance when you meet the following requirements:

1. The mode of transport should not be relevant since the internet/cloud is not in your control. regard the file to be transported to be copied by another party to play safe. 99.9% chance it won't, but why bother to think about it? Same: regard a thumb drive as lost when using it.
2. Make sure point 1 doesn't matter: employ good file encryption. AES256 for instance with a STRONG password (minimum 64 characters long).
3. Communicate the passwords in a safe way and authenticate the receiver. face to face in advance is good.

You can now safely lose your files, and also safely transport them in any way possible. Of course now the password has to be protected like it is the file, but this is better since it can be memorized (partly) or encoded in unsuspicious ways.