0

I know we're not going to like this question because it has some obvious answers, but I am looking for a thorough breakdown, and I could not find another mention of this topic on this site. Paper Security is still Information Security. If this is a duplicate question, please point to the original and this one will be deleted:

For some pet peve, I still submit certain sensitive documents in paper through the mail. Obviously, this puts the information at risk of physical theft during transit and only circumevents the https portion of the journey. However, almost all systems that offer an electronic submission process will enevitably be scanned and input to the system. And then we must trust them to shred the original. Also, an electronic submission may go immeditelly to its final destination or it may need to traverse some sort of 'handling process', viewable by many, which may not be traversed by paper copies. Lastly, electronic submission could be vulnerable to local client-side attacks... sure we scan and practice safe habits, but can we ever be sure our systems are always completely clean?

I would like a definite answer: is there any security gained (or lost) by submitting a hardcopy instead of an electronic copy?

1

I'd say this all depends on how much you trust the end point and your carriers. For example, if you need to submit a payroll document to a HR manager at another site within your firm then that's a good example of sensitive information. You likely wouldn't want it being handed over to, say, a receptionist and then being passed in a chain to the HR manager.

If you send the document by paper then you can instruct your carrier to only hand over the envelope to the intended recipient him/herself, you can get their signature for confirmation of reciept, and you can use anti-tamper envelopes to demonstrate that no one has accessed the data in transit. Obviously if the recipient then leaves the document laying around then anyone can read it, so you'd need to trust them to keep your data secure. You shouldn't really be sending sensitive data to someone you don't trust anyway.

An electronic submission means that anyone with access to the recipients computer can likely access your data. I'm not sure about other workplaces, but at my work and in my places of study username/IDs and passwords are frequently shared among co-workers. If this is the case then it's entirely possible that anyone within that department (or anyone else that knows their ID and password) could easily read your data. It's also entirely possible that the government or your ISP or any other third party involved in your internet connection could intercept your communication and, unlike with an anti-tamper envelope, you'd likely have no way of telling if this has happened or not.

Really, which is more secure depends entirely on how much you trust your carriers, who you're sending data to and who is going to be involved in transmitting your data.

  • Isn't trust for this kind of thing hard to determine? And aren't we usually forced into selecting a service from a select few choices, of which we know nothing of the backend? If a company doesn't have any 'incidents', should they then be considered trustworthy? I suppose I will end up trusting that a company or government department will have the same diligence to handle their physical data as securely as they handle their electronic data. Do I trust the hardcopy handler or do I trust the programmer? – user58446 Jan 21 '15 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.