So I am an intern at a local software company and I was asked to do some research into improving the current secure email system that my employer uses. They want to integrate into the current web api login system that I have created for our website.

I don't even know where to begin on this subject, firstly I don't fully understand if any current secure email providers offer any form of an embedded iframe or anything of that nature. I don't know if any current secure email providers offer integration into another login system.

Has anyone dealt with something of this nature and has anyone had to create something like this? My company wants to create a centralized place for customers to go to talk about secure matters, but they don't want me to code it all myself. I have doubts that such a system exists and can be integrated into my current system.

I am looking for links, or articles, as well as input from members of the information security community. I am only in my second year of college and security isn't my specific major in school.

  • 2
    What do you mean by "current secure email system"? Are they just using regular email, with authenticated access? Or is it really more like some sort of application-level messaging system that generates email notifications? If it's the former, you're looking for an email solution that integrates with your app, you probably want to search for "single sign-on" (SSO). If it's the latter, you probably want a "customer engagement platform", likely with an API you can consume - sort of a SaaS option. In either case, I don't think there's a clear, specific security question at this point. – user18519 May 30 '17 at 14:51
  • 1
    Well we use different software depending on certain customers. For example, some use ZixMail - zixcorp.com/products/zixmail While others use Symantec - symantec.com/campaigns/endpoint-encryption My company wants a single place to sign in and perform all these operations with secure email. – Bailey Miller May 30 '17 at 14:53
  • Okay, that's clearer. So basically PGP-encrypted email solutions. And are these supported because the customers have implementations of them? Or is your org specifying them? The main point being whether you have to support all of these, or whether it's within your power to migrate the customers to a unified solution. – user18519 May 30 '17 at 15:11
  • We could unify them, we adopted conforming to how they liked to do things, but with some work they'd move to a single platform. – Bailey Miller May 30 '17 at 15:56
  • A web-based portal leveraging a third-party service (assuming you're still not writing it from the ground up) and leaning on TLS for encryption would be my approach here. That probably means both your customers and your company log into to respective web interfaces and do their messaging there. Here are a couple to look at to get you started: twilio.com/chat layer.com There may be a good way to do a PGP-based option as well, but I think someone else might be better to speak to that. – user18519 May 30 '17 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.