How Reliably do mail systems transmit Encrypted PDFs

Question

We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.

We have tested the pdf's through the usual cast of internet mail providers, and to my surprise they are not blocked.

I believe that this is dangerous and I suspect that encrypted content may be blocked routinely by mail gateways in future, because virus scanners cannot verify if there is malware in the file. So these services fail-open vs fail-closed when observing these PDFs.

What do you-all think? Is this a danger? Has anyone else had this problem?

I am quite frankly surprised by this behavior.

Answer 1

Obviously the safest option is to block it, but this annoys the business as it impacts the work they can do. So what really happens depends on the policies implemented by each organisation.

• The most common approach I see in financial services is to block encrypted messages and then forward on a message saying "If this is an expected mail for business purposes please click here/contact IT to have it sent onwards"

• The next most common is a flat-out block at perimeter

• And I have worked at organisations that allowed encrypted comms straight through - mostly in smaller organisations, and in non-regulated industries.

The solution which does give the best of both worlds is for organisations to have encryption at the gateway or organisational escrow keys so the communications pathway across the internet is encrypted, but the mail gateway can still scan the file on arrival.

Answer 2

Mail providers don't (necessarily) block encrypted attachments, but every IT organization has policies on this sort of thing. You really need to do some research on your target market to find out if their mail servers (or their settings for things like Postini) are configured to strip these attachments. Just asking mail providers and/or places like Postini isn't enough.

Answer 3

Email attachments are evil. A sensible (although probably unworkable) suggestion is to remove any attachments on incoming email and place that in some kind of vault for scanning. (Or just delete it.)

Merely scanning email for malware misses 0-day exploits or undisclosed exploits.

See, for example, RSA being hacked by malware delivered by email: http://www.f-secure.com/weblog/archives/00002226.html

Already in April, we knew that the attack was launched with a targeted email to EMC employees (EMC owns RSA), and that the email contained an attachment called "2011 Recruitment plan.xls".

"Don't open attachments in email" is common security advice, yet it's often ignored.

It is better to teach users to be suspicious of any email, especially email with an attachment.

See also historical problems of attachments in archived files.