" encryption Archives - LuxSci

Posts Tagged ‘encryption’

New Feature: Secure Email Tagline

Thursday, June 23rd, 2022

LuxSci is introducing a new email tagline feature to inform recipients that email messages are secured. This helps build trust and increase confidence with less tech-savvy recipients who do not understand how email encryption works.

secure email tagline

TLS Encryption

TLS encryption is now widely supported by the most popular email providers. As a result, more organizations are choosing to send emails containing sensitive data with TLS encryption. There are a few reasons for this:

  1. TLS encryption is permitted under HIPAA and most compliance regulations.
  2. It’s easier to use and does not require recipients to log in to portals to access their messages.
  3. The open and response rates are higher on TLS encrypted messages.

However, using only TLS to encrypt emails can be confusing to the laypeople receiving them. While it’s easy to use and “invisible,” that can be concerning when transmitting sensitive information. If it looks like a regular email, recipients may be concerned that the organization does not care about the security of their personal information. This perception can negatively impact the business and dissuade people from using digital channels.

Introducing a New Email Tagline

For these reasons, all Email Hosting, Secure Connector, Secure High Volume Email, and Secure Marketing customers who send emails encrypted via SecureLine will have a small tagline at the bottom of the email that indicates the message is secure. It looks like this:

message secured by LuxSci tagline

This tagline builds trust and lets the recipient know that the company has taken steps to secure sensitive data. If you are an existing customer, visit your email settings or contact Customer Support to enable this feature. New customers will automatically have the tagline enabled when sending SecureLine encrypted emails.

Implementing Zero Trust Architecture

Tuesday, March 8th, 2022

The US Government has released its zero trust strategy to help government agencies implement zero trust architectures. It requires federal agencies to meet certain standards before the end of the 2024 fiscal year.

zero trust architecture

The zero trust strategy aims to improve the nation’s security posture and reduce the potential harms from cyber attacks. It assumes that attackers cannot be kept outside of network perimeters and sensitive data should be protected at all times.

The move toward zero trust architecture is a significant undertaking for the federal government, and this strategy aims to outline a common path for agencies to take, as well as limit uncertainty about transitioning.

It will require agency heads to partner with IT leadership in a joint commitment to overhaul the current security architecture and move toward a zero trust model. The strategy encourages agencies to assist each other as they work to implement zero trust architecture, exchanging information and even staff where necessary. Ultimately, the zero trust strategy aims to make the federal agencies stronger and more resilient against cyber attacks.

What Does The Zero Trust Architecture Strategy Include?

The Cybersecurity and Infrastructure Security Agency (CISA) created a zero trust maturity model to guide the strategy. The model contains five pillars including:

  • Identity
  • Devices
  • Networks
  • Applications and Workloads
  • Data

There are also three themes that cut through each of these areas:

  • Visibility and Analytics
  • Automation and Orchestration
  • Governance

Identity

First, the strategy includes a number of identity-related goals. Federal agencies must establish centralized identity-management systems for their employees. These systems must integrate with common platforms and applications.

Another core goal is for agencies to use strong multi-factor authentication throughout the organization. However, it must be enforced at the application layer rather than at the network layer. Password policies no longer require the use of special characters or frequent password changes.

The new strategy will also require that user authorization also incorporates at least one device-level signal. This could include confirming the device is authorized to access the application and has up-to-date security patches.

Devices

Under the Devices pillar, federal agencies must participate in CISA’s Continuous Diagnostics and Mitigation (CDM) program. This allows them to create reliable asset inventories. The other major goal is for each agency’s Endpoint Detection and Response (EDR) tools to be deployed widely and to meet CISA’s technical requirements.

Networks

Among the network-related measures, agencies need to use encrypted DNS to resolve DNS queries wherever it is technically supported. They must also force HTTPS for all web and API traffic. On top of this, agencies also need to submit a zero trust architecture plan that includes their approach to environmental isolation to the Office of Management and Budget.

Applications and Workloads

In addition, there are a number of application and workload-related goals for agencies, including:

  • Operating dedicated application security testing programs.
  • Undergoing third-party application security evaluations.
  • Running a public vulnerability disclosure program.
  • Working toward deploying services that employ immutable workloads.

Data

When it comes to data, agencies must follow a zero trust data security guide created by a joint committee made up of Federal Chief Data Officers and Chief Information Security Officers. Agencies must also automate data categorization and security responses, with a focus on tagging and managing access to sensitive documents. They must also audit any access to encrypted data in commercial cloud services. Another goal is for agencies to work alongside CISA to implement logging and information sharing capabilities.

Zero Trust Architecture and the Future

The federal government isn’t just pushing toward a zero trust architecture model as a fun new hobby. Instead, it is a response to the increasing sophistication of cyber attacks, especially those originating from nation-state level groups.

These complex and well-resourced cyber attacks aren’t only a threat to government agencies. Other organizations face similar threats in the ever-changing threat landscape. The reality is that businesses also need to move toward the zero trust model in order to effectively defend themselves in the future.

LuxSci can help your organization make the change through services such as our zero trust email options, or our zero trust dedicated servers. Contact our team to find out how LuxSci can help your organization prepare for a zero trust future.

HIPAA-Compliant Email Hosting or Outbound Email Encryption?

Tuesday, January 25th, 2022

There are many ways to protect ePHI in email. HIPAA is technology-neutral and doesn’t make specific recommendations for how to protect email communications. This article explains the difference between a HIPAA-compliant email host and an email encryption gateway. These are just two of the options for securing email accounts.

email encryption

Read the rest of this post »

HIPAA Compliance Checklist

Tuesday, January 11th, 2022

This HIPAA compliance checklist was designed to help organizations understand their obligations under the law. The checklist items are not a complete list, just a starting point for your compliance program. HIPAA requires a yearly risk analysis to identify new vulnerabilities. Any business process change or new technology usage introduces new risk into an organization’s security program, so it’s important to review the standards regularly.

hipaa compliance checklist

Read the rest of this post »

5 Ways to Prevent Human Impacts on Your Cybersecurity Program

Tuesday, October 12th, 2021

There are multiple ways that humans impact cybersecurity and can put data at risk. From being tricked by phishing emails to choosing easily guessed passwords, insider fraud and mistakenly classifying the security level of emails and other content, the actions of your employees can make your data vulnerable.

While the impact of human errors can’t be eliminated entirely, there are steps that can be taken to minimize the effects humans can have on your cybersecurity. Five of these steps are detailed below.

prevent human effects on cybersecurity

1. Adopt an “Opt-out” approach to encryption

At LuxSci, our philosophy is to limit risk by taking basic security choices out of employee hands. Instead of relying on employees to encrypt emails with sensitive contents, we automatically encrypt every message by default. This makes it more difficult for an employee to carelessly send out sensitive emails without the proper safeguards.

Conversely, when taking an opt-in approach to cybersecurity, employees are responsible for remembering to encrypt each email before sending. Anytime an employee forgets to take this step, it represents a potential security breach with all the liability that entails. Adopting an opt-out approach to encryption reduces this risk significantly. While many companies use opt-in processes because of their convenience, they introduce a high degree of risk. LuxSci’s SecureLine encryption technology enables a new generation of email encryption that features both flexibility and security.

2. Implement strict email filtering and network firewalls

Are you familiar with the aphorism “an ounce of prevention is worth a pound of cure”? By taking steps to prevent malicious threats from reaching your systems and networks, your employees will not have to spend their time trying to figure out what is a threat.

Email filtering

Phishing is one of the greatest threats to cybersecurity. Rather than relying strictly on human judgement with regard to which emails to open, using a sender policy system that filters or flags suspicious incoming emails can appreciably improve cybersecurity. Don’t count on your busy employees to know when an email is suspicious. Instead, use email filtering to keep those emails from even entering their inboxes.

Network firewalls

Firewalls help prevent attackers from gaining easy access to your network. They prevent suspicious connections or messages from connecting to the network or reaching their intended destination. By serving as a first line of defense, a firewall plays a major part in shielding your network from cyberattacks. By preventing external threats from accessing your applications, you don’t need to count on your employees to recognize when something isn’t right.

3. Prevent human impacts on cybersecurity by training staff

Almost every modern workplace relies on internet-connected devices to get work done. However, just training staff to use your technology effectively is not enough. With cyberattacks growing in frequency, keeping your staff aware of the latest cybersecurity threats is essential to protect your business. With data breaches, denial-of-service (DoS), and ransomware attacks accounting for tremendous financial losses, failing to prepare your staff for the danger these attacks pose to your IT operations can be costly.

Your employees can prevent security breaches if they are properly trained in the latest cybersecurity best practices. Some complex security breaches can evade even the best automated security measures. If your staff knows what to look for, they can play a crucial role in augmenting your existing security measures.

In addition, hackers often target employees as their first access point for gaining entry to a network. As a result, restricting cybersecurity training to just the IT department can leave your employees vulnerable to social engineering, phishing emails, and other exploits used by hackers to dupe them.

A cybersecurity training program can help reduce risks by familiarizing employees with the tricks used by hackers to gain access to their accounts. As part of the training program, it’s important to test employees on core concepts to ensure the message is retained.

4. Enforce strong password and access control policies

To reduce the risk of security breaches, a robust password protection program is necessary. One of the key elements is enforcing password complexity. Simple passwords are vulnerable to brute force hacking, enabling hackers to easily access employee accounts.

Requiring staff to use unique, complex passwords makes it much harder for hackers to gain access to an account. A complex password can include multiple types of characters (numbers, letters, capitalization, special characters) and minimum character lengths. Learn more about creating secure passwords in our blog archives.

Multi-factor authentication (MFA) is another key element of a robust security policy. By requiring more than a single action to access an account, you can drastically cut down on security breaches due to lost or stolen passwords. Given that compromised passwords are a significant cause of security breaches, using MFA is a powerful tool for bolstering network security.

In addition, setting up time-based access controls for your sensitive systems can prevent bad actors from gaining unauthorized access. For example, if you have an employee who works a 9am-5pm shift, you can prevent her from accessing the system from 6pm-8am. That way if a bad actor did get her credentials, they would be unable to login when she was offline. This could prevent someone from taking over your systems overnight.

5. Adopt the Zero Trust security stance

What is Zero Trust Architecture? Essentially, it is a policy for guarding against cyberattacks by assuming that every aspect of a network is subject to attack. This includes potential insider threats from employees or attackers who have infiltrated your network. This contrasts with other security approaches that assume that traffic within a network’s security perimeter can automatically be trusted. Instead, Zero Trust Architecture minimizes the security perimeter as much as possible to reduce the chance of a security breach and evaluates the credentials and actions of users at all levels of access to identify any actors inside the network who may pose a threat.

By providing a more granular level of threat detection and limiting access within the network, a Zero Trust security approach is more rigorous than existing security models focused primarily on perimeter security.

ZTA improves security without imposing unduly burdensome requirements. It gives users access to just the minimum level of data and services needed to fulfill their role. This can help stop insider threats from employees. If a lower-level employee with little access to sensitive data has their credentials compromised, it is less threatening to the organization’s data security. The attacker will not be able to penetrate other parts of the network without additional identity verification.

Limiting human impacts on your cybersecurity to decrease risk

Humans can amplify cybersecurity risks in many ways. Between careless mistakes and intentional sabotage, there are a number of things that employees can do to expose your company to cybersecurity risks. The steps listed above comprise a comprehensive set of measures you can take to minimize negative human impacts on cybersecurity. In conjunction with a robust security solution, these measures can significantly enhance your cybersecurity defenses.

Secure your organization by contacting us to find out how to get onboard with LuxSci.