" encrypt Archives - HIPAA News, Web & Email Security Tips & News - Plus More | LuxSci
LuxSci

Posts Tagged ‘encrypt’

Next Generation Data Loss Prevention (DLP) with LuxSci Secure Email

Tuesday, September 29th, 2015

Data Loss Prevention (DLP) describes a plan for companies to control the sending of sensitive data.  E.g. this can include controls to stop the flow of sensitive data or to ensure that sensitive data is always well-encrypted (for compliance) when sent.

In the context of email, DLP is usually achieved through the following formula:

  1. Construct a list of words, phrases, or patterns that, if they are present in an email, signify an email message that may contain sensitive information.
  2. Have all outbound email scanned for these words, phrases, or patterns
  3. For messages that match, take action:
    1. Block: Refuse to send the message, or
    2. Encrypt: Ensure that the message is encrypted
    3. Audit: (and maybe send a copy of the message to an “auditor”)

This classic DLP system is available through many email providers and has been available at LuxSci for many years as well. However, it does have a glaring limitation — no matter how complete and complex your DLP pattern list is, it is almost certain that some messages containing sensitive information will not quite match (or the information will be embedded in attachments that can’t be searched properly).  If they do not match, then they will escape in a way that may be considered a breach.

Read the rest of this post »

Secure: Does LuxSci Hold the Keys to Unlock your Secure Email Data?

Wednesday, December 18th, 2013

For many different reasons, customers have asked us if we hold the keys to unlocking their email data. Why?

  1. Compliance / Emergencies: Customers with compliance needs, such as HIPAA, need to have emergency access to data … and that can mean appealing to LuxSci to access data to which the customer has otherwise lost access.  Having the keys in this case, is very important.
  2. Privacy: On the other end of the spectrum, some customers want to do as much as possible to ensure that no one, not even LuxSci staff, can access their email data.

Both considerations are extremely valid in their own context.  The answer is that “it depends”.  For security and flexibility, LuxSci presents customers a variety of email encryption options that span the complete range from “completely unencrypted” to “LuxSci has no possible access“.  It is up to the customer to choose where in that spectrum they fall … often balancing ease of use with security needs.

In the following sections, we will consider to what degree LuxSci can assist customers in accessing email (and WebAides) data, based on what encryption options the customer has chosen.  We also discuss where and how your trust of LuxSci comes into play. Understanding if and when LuxSci can access encrypted data is different from understanding when messages are encrypted at rest

Read the rest of this post »

How Does Secure Socket Layer (SSL or TLS) Work?

Monday, July 22nd, 2013

The Secure Socket Layer, SSL for short, is a protocol by which enables services that communicate over the Internet to do so securely.

SSL has recently been replaced by TLS (Transport Layer Security).  TLS is newer and more secure than SSL (See TLS vs SSL: What is the difference?); however, from a lay-person’s perspective of “how does it work,” they are functionally the same.  We use the term “SSL” to refer to both TLS and SSL in this article for simplicity.

Before we discuss how SSL works and what kinds of security it provides, let us first see what happens without SSL.

Life on the Internet without SSL

This is, for example, what happens when you go to any web page whose address begins with “http://” (and not “https://”).

Let us compare communications on the Internet and communications between people over the telephone. Without SSL, your computer-to-computer communications suffer from the same security problems from which your telephone communications suffer:

Read the rest of this post »

Ensuring all data is encrypted at rest with LuxSci

Friday, May 10th, 2013

Email and other data is either being “transmitted” or “processed” or is “at rest.”  I.e., it is moving from one computer to another, or it is stored/at rest on a computer, or it is preparing to be transmitted or stored.

While most types of compliance regulation, such as HIPAA, specifically require that data be transmitted securely, not all regulations require that data be stored in an encrypted form while at rest.  I.e., HIPAA does not require at-rest encryption, though it is recommended to decrease risk and potential liability in some situations

Having your email and other data encrypted while at rest can potentially increase the security of that data, even if that level of security is not explicitly required.  As a result, many LuxSci customers have asked about how to ensure that all of their email and other data is encrypted while at rest.

Read the rest of this post »

How to Install S/MIME (and PGP) Encryption Certificates into Major Email Clients

Wednesday, May 27th, 2009

We at LuxSci are always being asked questions about various email programs and their usage.  With HIPAA compliance becoming more and more important, we get a lot of inquiries regarding secure email. One of the most frequently asked questions is how to install S/MIME security certificates in various email programs that our servers support. Sometimes finding instructions on installing security certificates in various email clients is difficult, even with the help of search engines. To make your search easier, we have complied instructions for several of the the major email clients:

  • S/MIME for Outlook 2003
  • S/MIME for Outlook 2007
  • S/MIME for Mail.app
  • S/MIME for Entourage
  • S/MIME for Thunderbird
  • PGP for Thunderbird via the Enigmail Add-on.

Read the rest of this post »