" email security Archives - LuxSci

Posts Tagged ‘email security’

How to Secure SMTP Email Delivery with TLS

Tuesday, August 29th, 2023

Secure email sending is a priority for organizations that communicate sensitive data externally. One of the most common ways to send secure emails is with SMTP TLS. TLS stands for Transport Layer Security and is the successor of SSL (Secure Socket Layer). TLS is one of the standard ways that computers on the internet transmit information over an encrypted channel. In general, when one computer connects to another computer and uses TLS, the following happens:

  1. Computer A connects to Computer B (no security)
  2. Computer B says “Hello” (no security)
  3. Computer A says, “Let’s talk securely over TLS” (no security)
  4. Computers A and B agree on how to do this (secure)
  5. The rest of the conversation is encrypted (secure)

In particular:

  • The conversation is encrypted
  • Computer A can verify the identity of Computer B (by examining its SSL certificate, which is required for this dialog)
  • The conversation cannot be eavesdropped upon (without Computer A knowing)
  • A third party cannot modify the conversation
  • Third parties cannot inject other information into the conversation.

TLS and SSL help make the internet a more secure place. One popular way to use TLS is to secure SMTP to protect the transmission of email messages between servers.

hands on a keyboard sending secure email

Read the rest of this post »

Tags: AES256, email encryption, email security, opportunistic TLS, secure, secure email, smtp, smtp tls, ssl, ssl certificate, starttls, tls
Posted in AAA Featured Articles, LuxSci Library: HIPAA, LuxSci Library: Security and Privacy, Popular Posts
15 Comments »

HIPAA Email Rules: 8 Requirements for Secure Email

Tuesday, August 1st, 2023

The Health Insurance Portability and Accountability Act (HIPAA) is a complicated law that sets the standards for collecting, transmitting, and storing protected health information (PHI). When information is stored or exchanged electronically, the HIPAA Security and Privacy Rules require covered entities to safeguard its integrity and confidentiality. One of the most common ways that PHI is shared electronically is via email. Understanding how HIPAA rules apply to email is essential to meet HIPAA requirements and protect sensitive data.

hands on keyboard checking off tasks

The HIPAA Email Security Rule

It’s important to note that HIPAA does not require the use of any specific technology or vendor to meet its requirements. Generally speaking, the Security Rule requirements for email fall into four categories:

  1. Organizational requirements state the specific functions a covered entity must perform, including implementing policies and procedures and obligations concerning business associate contracts.
  2. Administrative requirements relate to employee training, professional development, and management of PHI.
  3. Physical safeguards encompass the security of computer systems, servers, and networks, access to the facility and workstations, data backup and storage, and the destruction of obsolete data.
  4. Technical safeguards ensure the security of email data transmitted over an open electronic network and the storage of that data.

Below, we discuss some of the main requirements that apply to email and the steps you need to take to secure email accounts that transmit and store PHI.

HIPAA Email Rules-Compliant Email Checklist

While email encryption gets most of the spotlight during discussions on email security, HIPAA regulations for email cover a range of behaviors, controls, and services that work together to address eight key areas.

1. Access: Access controls help safeguard access to your email accounts and messages. Implementing access controls is essential to keep out unauthorized users and secure your data. Some key steps to take include:

  • Using strong passwords that cannot be easily guessed or memorized.
  • Creating different passwords for different sites and applications.
  • Using two-factor authentication.
  • Securing connections to your email service provider using TLS and a VPN.
  • Blocking unencrypted connections.
  • Being prepared with software that remotely wipes sensitive email off your mobile device when it is stolen or misplaced.
  • Logging off from your system when it is not in use and when employees are away from workstations.
  • Emphasizing opt-out email encryption to minimize breaches resulting from human error.

2. Encryption: Email is inherently insecure and at risk of being read, stolen, eavesdropped on, modified, and forged (repudiated). Covered entities should go beyond the technical safeguards of the HIPAA Security Rule and take steps beyond what is required to futureproof their communications. Some email encryption features to adopt include the following:

  • The ability to send secure messages to anyone with any email address.
  • The ability to receive secure messages from anyone.
  • Implementing measures to prevent the insecure transmission of sensitive data via email.
  • Exploring message retraction features to retrieve email messages sent to the wrong address.
  • Avoiding opt-in encryption to satisfy HIPAA Omnibus Rule.

3. Backups and Archival: HIPAA email rules require copies of messages containing PHI to be retained for at least six years. To address these requirements, organizations must consider the following:

  • How are email folders backed up?
  • Are there at least two different backups at two different geographical locations? The processes updating these backups should be independent of each other as a measure against backup system failures.
  • Have you maintained separate, permanent, and searchable archives? While the emails should be tamper-proof, with no way to delete or edit them, they should be easily retrievable to facilitate discovery, comply with audit requests, and support business-critical scenarios.

4. Defense: Cyber threats against healthcare organizations are continually increasing. Some may be surprised to learn that HIPAA secure email requirements mandate that organizations take steps to defend against possible attackers. To defend against malicious messages, consider implementing the following technologies:

  • Server-side inbound email malware and anti-virus scanning to detect phishing and malicious links
  • Showing the sender’s email address by default on received messages
  • Email filtering software to detect fraudulent messages and ensure it uses SPF, DKIM, and DMARC information to classify messages
  • Scanning outbound email
  • Scanning workstations for malware and virus
  • Using plain text previews of your messages

5. Authorization: A crucial aspect of HIPAA secure email requirements is ensuring that bad actors cannot impersonate your company or employees. Configuring your domains with SPF and DKIM is essential to verify your identity as an authorized sender of mail from your domains. Also, ensure that users cannot send messages through your email servers without authentication and encryption.

6. Reporting: Setting accountability standards for email security is essential to establishing and improving your HIPAA compliance posture. Some important steps to take include:

  • Creating login audit trails.
  • Receiving login failure and success alerts.
  • Auto-blocking known attackers.
  • Maintaining a log of all sent messages.

7. Reviews and Policies: Humans are the greatest vulnerability to any security and compliance plan. Create policies and procedures that focus on plugging vulnerabilities and preventing human errors. Some ways to reduce risk include:

  • Inviting independent third parties to review your email policies and user settings. Fresh, unbiased eyes can weed out issues quickly.
  • Disallowing the use of public Wi-Fi for devices that connect to your sensitive email.
  • Creating email policies prohibiting users from clicking on links or opening attachments that are not expected or requested.

8. Vendor Management: Most people do not manage their email in-house. Properly vetting and researching whoever will be responsible for your email services is essential. Perform a yearly review of your email security and stay on top of emerging cybersecurity threats to take proactive action when necessary for sustained HIPAA compliance.

LuxSci’s secure email solutions were designed to help organizations tackle complicated HIPAA email rules. Contact us today to learn more how we can help you secure sensitive data.

Tags: email security, email security in the cloud, hipaa, hipaa security, hipaa-compliant email
Posted in Email, LuxSci Library: HIPAA
No comments »

The Security Risks of Staffing Challenges

Wednesday, March 29th, 2023

The cybersecurity talent shortage is a known issue that the government, industry groups, and educators are working to address. But as CISOs are asked to do more with fewer resources and support, it can risk healthcare organizations’ cybersecurity. The “Implications of Stress on CISOs 2023 Report” by Cynet found that many security teams faced retention challenges due to work-related stress that could put their data at risk.

The Security Risks of Staffing Challenges

When security teams are understaffed, they can become overworked and burnt out. As a result, they have less time to focus on updating security policies, training staff, and monitoring the attack surface. The impacts of staffing challenges can significantly affect the ability of security teams to detect and respond to threats. The survey found that 65 percent of CISOs stated that work-related stress affected their capacity to safeguard their organization. In addition, 77 percent of CISOs believed their insufficient bandwidth and inadequate resources caused critical security initiatives to be neglected. These lapses are not going unnoticed. Seventy-nine percent of CISOs have received complaints from colleagues claiming security tasks are not being adequately handled.

the security risks of staffing challengesWith limited choices, organizations must be wise and strategic in the technology they employ. When asked about the technology initiatives that could positively impact their work-related stress levels, 57 percent of the respondents cited consolidating multiple security technologies on a single platform or interface as a possible solution. Additionally, 51 percent of the respondents believed automating time-consuming and repetitive manual tasks would help reduce their workloads.

Candidate Quality Staffing Challenges

When security teams cannot find qualified candidates to fill open positions, crucial tasks are left incomplete, and other team members must pick up the slack. In turn, this can lead to compounding issues with employee satisfaction and retention. Of the surveyed CISO teams, 74 percent reported losing team members due to work-related stress issues.

According to the report, nearly half of the teams had more than one CISO resign over the last 12 months. The impact of stress levels is seen in retention rates and recruitment efforts, with 83 percent of CISOs admitting they have had to compromise on the quality of new hires to fill vacancies left by departing employees.

Solving retention and recruitment issues is essential to improve your organization’s security posture. Rethinking the hiring process and investing in entry-level talent is just one approach to filling the cybersecurity talent pipeline.

Ways to Alleviate the Security Risks of Staffing Challenges

While solving staffing challenges will take time and investment from the public and private sectors, there are ways to streamline and automate tasks to reduce the burden on security teams.

According to Deloitte, email is a significant vector of security risk for many healthcare organizations. 91% of all cyber attacks begin with a phishing email. Healthcare organizations have more to worry about than cyberattacks. They are also vulnerable to insider threats and have serious data compliance obligations. Employees must understand data loss prevention and how to protect sensitive information that is shared externally.

By using LuxSci’s best-in-class secure email technology, it can drastically reduce the burden on security teams. Protect from external threats by employing advanced email filtering to stop cybercriminals from even reaching inboxes. In addition, LuxSci’s email encryption is enabled automatically to protect sensitive data in transit. It’s easy to administer and doesn’t require security and IT teams to spend hours developing keyword lists, analyzing gaps, and training employees. By reducing the risk of your email communications, security teams can focus their limited resources on critical security initiatives.

Contact LuxSci today to learn how our experienced team can help alleviate the burden on your security and IT teams.

Tags: ciso, cybersecurity, cybersecurity risk, email encryption, email filtering, email security, operational efficiency, phishing, risk assessment, secure connector, secure email, security risk, staffing
Posted in LuxSci Library: Security and Privacy
Comments Off on The Security Risks of Staffing Challenges

Futureproof Your Data Loss Prevention Strategy with Always On Email Encryption

Wednesday, March 1st, 2023

The threats to sensitive data keep increasing, and organizations are struggling to stay secure. With the government considering new cybersecurity requirements for critical infrastructure, many organizations are reviewing their data loss prevention policies and are looking for ways to improve their security stance. This article reviews standard data loss prevention methods, their shortcomings, and how adding always-on email encryption to your toolbox can help futureproof your communications.

data loss prevention gaps

What is Email Data Loss Prevention?

Data loss prevention, also known as DLP, ensures that sensitive data is not lost, misused, or accessed by unauthorized users. DLP software allows users to classify business-critical data and take specific actions when those data are present in email messages. If sensitive data is identified, data loss prevention tools take some action to prevent users from accidentally or maliciously sharing data that could put the organization at risk.

How does DLP Technology work?

There are two main types of data loss prevention tools available:

  • Rules-based DLP
  • AI and Machine Learning based DLP

We will primarily discuss rules-based DLP in this article. But first, DLP tools that use AI or machine learning are trained on an extensive data set to identify when email messages sent by your employees contain sensitive information.

In rules-based DLP software, administrators create rules that trigger the data loss prevention technology to take a particular action. Some examples of rules include:

  • Encrypting emails that contain social security numbers.
  • Not sending emails that contain health data (as identified by the organization).
  • Flagging emails that include specific keywords like “contract,” “financial report,” or “confidential information.”

Once the rules are in place, the DLP software will scan every outgoing email message to search for data that meets the criteria. When the DLP detects sensitive data, it takes an action that the administrator also determines. Some common protective actions include:

  • Not sending the email at all.
  • Adding a warning label or sending a notice to the email sender.
  • Encrypting the email and sending it to a web portal.

Why is DLP technology insufficient for security and compliance?

While DLP technology may capture most sensitive data, it is not infallible. In industries like healthcare and finance, even one mistake could lead to a breach with severe financial penalties.

PHI data risk

Looking at how most data loss prevention software works, it’s easy to see how it can fail. Rule-based DLP requires administrators to thoroughly document and catalog every possible variation of the keywords and number formats that could indicate the presence of sensitive data. Even one typo could throw off DLP software and cause data to be sent without protection. Sensitive healthcare and financial data do not always fall cleanly into pre-determined categories, and there are always exceptions to rules.

Conversely, false positives from extremely strict rule-making can result in delayed business communications and inefficiency. If DLP rules are too restrictive and too many messages are not sent or locked behind a portal, employees may use less secure channels to get around DLP technology.

How to Close Data Loss Prevention Gaps with Always-On Email Encryption

Highly regulated industries should consider sending all messages with a baseline of TLS encryption instead of relying on DLP technology to trigger it. TLS encryption is secure enough to meet most compliance requirements and has added usability benefits. TLS-encrypted messages appear just like regular, unencrypted emails in the recipient’s inbox, making them easy to read and respond to but without the risk of interception or eavesdropping. When all messages are automatically encrypted, you can worry less about DLP failure and data leakage.

DLP scanning can also trigger web portal pick-up encryption for more sensitive messages. Sending highly confidential information like financial statements, medical records, and board meeting minutes requires added security that can be triggered by DLP technology. Reducing the number of rules required makes data loss prevention tools easier for administrators to manage. Also, removing encryption choices from employees improves their productivity and reduces risk.

Message encryption may only be optional for a little while longer. In 2022, CISA issued Cross-Sector Cybersecurity Performance Goals, which recommended TLS encryption as part of prioritized cybersecurity practices that critical infrastructure owners and operators can implement to reduce the likelihood and impact of known risks and adversary techniques. Prepare for the future and protect your sensitive data by using LuxSci’s easy-to-use email encryption tools today.

Tags: content filters, data loss prevention, dlp, email encryption, email security, financial data, futureproof, keyword filtering, phi
Posted in Email, LuxSci Library: Security and Privacy
Comments Off on Futureproof Your Data Loss Prevention Strategy with Always On Email Encryption

The Cybersecurity Risks of Mergers and Acquisitions

Thursday, February 2nd, 2023

In tough economic times, many businesses go through mergers and acquisitions to improve their financial prospects. However, this process can put organizations’ sensitive data at risk. In this article, we discuss the cybersecurity risks of mergers and acquisitions. According to a report by Forescout, 62 percent of participants agreed that their company faces significant cybersecurity risks by acquiring new companies and expressed that cyber risk is their biggest concern post-acquisition.

cybersecurity risks of mergers and acquisitions

Before M&A: Assess Cybersecurity Risk

Even before mergers and acquisitions are announced, it can be a vulnerable time for a company’s data. Leakage of sensitive company data, like confidential financial information, can be catastrophic to negotiations. As a result, this makes companies considering a merger or acquisition highly susceptible to hacking.

Internal threats are also likely to increase. Employees not involved in negotiations may learn about merger talks and have some incentive to leak data to the press or to criminals to stop the process. It is essential to protect all communications relating to merger discussions.

The most significant risk of a merger is not doing cyber due diligence on the company being acquired. Risk analysis needs to be a part of negotiation talks. Most organizations being merged or acquired are smaller, with low levels of sophistication, and may lack mature cybersecurity programs. You need to understand the potential risks your company may be inheriting to prepare to address them properly. Security personnel need to be included in M&A talks to ask the right questions, audit systems, and prepare for integration.

Addressing Risk During Integration

Once a company merges with another, the risks to sensitive data increase. Highly sophisticated threat actors target M&A activities because, with operations in transition, high-value data is often vulnerable. 

The Technology Risks of Mergers and Acquisitions

In 2019, the IBM Institute for Business Value surveyed 720 executives responsible for the merger and acquisition functions at acquirer organizations. More than one in three said they experienced data breaches that can be attributed to M&A activity during integration.

IT changes may be extensive and cannot all take place at once. It’s essential to take time to fully understand inherited policies, equipment, and procedures before making rapid changes. Enterprise IT projects take time to plan and complete without disrupting day-to-day operations.

IT teams will deal with a new mix of assets, technologies, processes, and organizational culture during integration. Risks continue to evolve during the initial period of change as they learn more about inherited systems and processes. They may also be overwhelmed by integration tasks integral to day-to-day operations, so that security tasks may be a lower priority. It’s incredibly important to prioritize security and have a well-organized transition to ensure that sensitive data is not exposed.

The Personnel Risks of Mergers and Acquisitions

Changing personnel can also create gaps in your security program. Employees with institutional knowledge may leave the company, meaning crucial processes and procedures must be re-documented and updated. If teams are understaffed in essential areas, they may take shortcuts that leave sensitive data exposed.

Staff burnout and uncertainty from the transition can also lead employees to make mistakes. Phishing and business email compromise threats are prevalent in the early days of a merger or acquisition. People may report to new managers and fall prey to social engineering-style attacks because of their unfamiliarity with new reporting lines and company hierarchy.

It’s important to prioritize security training and update all employees on policies after a merger occurs. Clearing up ambiguity helps to reduce risk and builds trust in the organization.

How to Reduce Cybersecurity Risk During a Merger or Acquisition

Utilizing basic email security features like filtering and message encryption can go a long way to protect sensitive data and limit risks. Whenever confidential information is shared, it should occur through secure or encrypted channels. Leaked information can lead to negative consequences and volatility.

The best way to reduce risk is to plan for it. It’s critical to thoroughly understand the risks you will inherit by merging with or acquiring another company. This should include thoroughly reviewing risk assessments and IT systems and even bringing in a third-party to assess their cybersecurity. The time to find out about these liabilities is before the merger occurs, not on day one. 

Tags: business email compromise, cybercrime, cybersecurity risk, email encryption, email filtering, email security, hacking, phishing, risk reduction
Posted in Business Solutions, LuxSci Library: Security and Privacy
Comments Off on The Cybersecurity Risks of Mergers and Acquisitions

« Older Entries