Edited to take your clarifications into account: E-mail encryption should keep you safe in this respect (e.g. confidentiality). See the e-mail encryption section below for further details. This should prevent any "listening" hackers from being able to read what is being sent. As far as sending links goes, if the links are within a secure internal company site, this should be a viable option as well, but may be more costly to implement and maintain than using encrypted e-mail if you do not already have such a site.
Attachments in e-mail:
Yes, e-mail file attachments can be unsafe (but so can other methods of transferring files). The problem with e-mail attachments is that they can contain malware that could infect your computer. However, it is oftentimes necessary to send and receive e-mail attachments. Alternate means of sharing attachments (e.g. SharePoint, making CD’s, e-mailing links, ftp, even sftp) have their own benefits and security risks as well. They are not necessarily safer than sending e-mail attachments. Even something as simple as a .jpg picture can be maliciously edited to do unwanted things. Here are some things that help increase security with e-mail attachments (although there are more):
- Train the company employees on how to be more secure, including the items below:
- Only download attachments when they are from a trusted source.
- Have it be company policy that everyone sign their e-mail with a digital signature, and do not download attachments from unsigned e-mail. This step prevents hackers from impersonating a known employee.
- Make sure your antivirus is up to date (e.g. the IT department should push out updates, or have the antivirus software automatically pull updates).
- Do not look at or send attached jokes / e-cards, etc. as they can contain malware.
- If the attachment appears legitimate, download it and scan it with your antivirus software before opening it. Do NOT open it, and do report it (e.g. to your IT department) if the antivirus software detects a virus. If you haven’t opened it, it is usually safe, and best to delete it after your security team (if you have one) has looked at it.
- Certain files, especially executables are especially dangerous (.exe). If you don’t recognize the extension, or if it is an executable, don’t open it (unless it is necessary). An example where it is necessary is if you are a software development business, and you ask an employee to send you their program so you can run and test it on your computer.
E-mail encryption goes a long way in keeping your information secure (e.g. protects confidentiality and integrity), but it does not entirely protect against malware. If you are discussing private business matters, or privacy sensitive information in e-mail, it would be best to encrypt it. Examples of this type of information include, but are not limited to:
- Lists of people’s names and addresses.
- Credit card information
- Details on projects that your business is working on (e.g. proprietary information)
From a security standpoint, it is good to assume that hackers (including possibly competing companies) can see what you are sending in e-mail, unless you encrypt it. At that point, they can only see the encrypted e-mail, but not the contents unless they are able to break the encryption scheme, which is typically not technically feasible if you use a strong encryption scheme. Whatever encryption scheme you use, I recommend selecting the highest key size available for maximum security (e.g. if you have AES 128 and AES 256, use AES 256). Malware can still be sent through encrypted e-mail, so follow the steps listed in the top section to be safer.
Sending links can be just as dangerous as sending attachments. Someone can send a link to a malicious website that will download malware to your computer. To prevent this, don’t follow links that aren’t from people you don’t know. Even if it is from someone you know, if it is a joke, or something not work related, it is still best not to follow the link. One thing that would be safer is to have a company website / SharePoint site that you share links to, but securely setting this up is another huge task.
My recommendation would be to continue to use e-mail attachments if that is working well for you, however, educate the employees of the company of the risks, and train the employees in how to securely download attachments (as discussed above). If your company has the need to make things available to the public, a website would be useful there (it would need to be set up securely). If your company is large, it would probably also benefit from a shared drive or SharePoint site, again, if set up securely.