For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please correct me if I'm wrong), which most E-mail clients to my best of knowledge support, even though the contacts of the company usually don't use any kind of E-mail encryption.

Use cases: internal communication (not that much) and mainly external communication.

One of the main concerns would be to prevent E-Mail Spoofing, yes.

  • Please explain what you mean with "average company" in terms of customers and sensitivity of information: Are there are customers which might use S/MIME or PGP if offered (they might just don't use it know since it is not offered). Are the information in a way sensitive and need encryption? Is the sender it lucrative target for sender spoofing in or as the claimed origin of phishing? – Steffen Ullrich Sep 14 '20 at 15:00
  • @SteffenUllrich I updated the question, hope it's ok now. Feel free to improve the question if you see fit. – Munchkin Sep 15 '20 at 7:27
  • Essentially you've only added just more "average" without any kind of detail what this really means. This is like having a range of cars with different colors and asking about properties of a car with average color. – Steffen Ullrich Sep 15 '20 at 7:31
  • @SteffenUllrich Updated the question again... Hope it's ok now. – Munchkin Sep 15 '20 at 7:52

... company with sensitive customer relations

Given that many common mail clients support at least S/MIME by default, it actually makes sense to use it. This means that mails should at least be signed by S/MIME. Signing does not cause any problems when mail clients do not support it, but provides solid sender authentication for S/MIME capable clients and thus additional protection for customers against mail spoofing. To make it easy for customers the signing certificate should be issued by a public CA though, which is already trusted by the client.

One might argue that DKIM together with DMARC provide similar protection. But in practice support for these is less common in mail clients, which means that the client must rely on their mail server to properly check both - and most actually don't. Also DKIM+DMARC only cares about the sender domain and not the actual sender. But it makes sense to use DKIM+DMARC in addition to S/MIME signing.

Using PGP instead does not make that much sense. Contrary to S/MIME PGP does not rely on a central PKI and thus there is no easily established trust relationship to the sender. Instead each customer would need to be explicitly trust the senders key, a concept many customers will not properly understand.

For more sensitive B2B communication it makes also sense to not only sign the mails but also encrypt it. There are several mail gateway products which offer centralized automatic S/MIME handling for such use cases so that the whole process is mostly transparent to the employees.

  • 1
    It should also be mentioned that S/MIME signed emails usually include their public certificates. This enables S/MIME aware recipients to immediately start sending back encrypted email. Some email clients automatically extract such certificates from incoming email to offer email encryption to the user when replying. – not2savvy Sep 28 '20 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.