Securing E-Mail

Total Page:16

File Type:pdf, Size:1020Kb

Securing E-Mail Securing E-Mail Contents Chapter 1 – Introduction and Overview Chapter 2 – E-mail Programs Chapter 3 - What is PGP? Chapter 4 - Set Up Your Gmail Mailbox For IMAP Chapter 5 - Set Up the Mozilla Thunderbird E-mail Client On Your Computer Chapter 6 - Install and Configure PGP with Thunderbird Chapter 7 – Add Public PGP Keys to Thunderbird Chapter 8 – Backup All Your Keys Chapter 9 – Thunderbird and PGP Conclusion Chapter 10 – Confirm it Works Chapter 11 – Setting Up PGP On Another Computer With Thunderbird Chapter 12 – Frequently Asked Questions (FAQ) Chapter 1 – Introduction and Overview If you are in the medical profession then you’re already familiar with Health Insurance Portability and Accountability Act, otherwise referred to as HIPAA. Basically, it has nothing to do with Heath or Insurance. The primary purpose of HIPAA is the protection of personal sensitive medical information that is stored, transferred or transmitted over electronic devices and pathways. Of course, this also includes patient medical information sent via e-mail. Data encryption is one of the most common and effective ways to prevent serious information breaches, such as unauthorized access to PHI. Encryption is such a powerful security measure that breaches of encrypted health information are not considered reportable security incidents unless the encryption key has also been taken. Granted, e-mail encryption is not mandated under HIPAA regulations. However, if a company does not utilize encryption as a security measure, then it must implement an equivalent method for the transfer of sensitive patient information from one entity to another. Presently, many medical professionals utilize 3rd party websites that allowed for controlled protected access to patient information that is uploaded to the third-party server. The uploaded data may or may not be encrypted. Most don’t encrypt the data, but instead allow for controlled access to the data. This leaves the patient’s medical information on a third-party computer that is vulnerable to illegal and unauthorized access by hackers, as well as malicious software that may be on that computer. One method is where the providing MD creates a password protected account on the third-party server, uploads the patient data and then sends a separate notification either themselves or through the third- party server to the intended recipient. That notification contains access instructions for the intended recipient on how to access the uploaded patient data. Generally, this access will expire after a set period of time from say, one hour to 1 or more days. This is all fine and dandy. But the “how to access” instructions sent to the recipient are themselves vulnerable to unauthorized third-party access. There’s also the possibility of those access instructions being inadvertently sent to an unintended recipient. This would be a direct violation of the HIPAA requirements. There needs to be a better way. Well there is. Not only is this better way significantly more secure, it’s also more user friendly for both the sender and the recipient. Sending information via email has always been the most effective and efficient way of sharing data. But e-mail itself has never been a secure way of sending or receiving sensitive information – be it in the form of a text message or as an attachment to an e-mail message. Thanks to recent advances in encryption technology and the integration of this technology into e-mail, it’s now possible to use e-mail for sending and receiving sensitive information that is so user friendly, it’s practically seamless and unseen by either the sender or the intended recipient. Email encryption can be automatic on the sender’s end the instant they click the send button, as well as automatic decryption on the recipient’s end as soon as they open the received e-mail. Additionally, the e-mail remains in its encrypted form for as long as it resides on your e-mail server, as well as on your computer. The decrypted message and its associated attachments if any, are decrypted “on the fly”; meaning that the decrypted e-mail only exists on your viewable screen and not on your hard drive or remote mail server unless you take action to save it there in an unencrypted form. For some e-mail programs the initial setup for automatic encryption and decryption can be a bear. However, once it’s all set up and fine-tuned, you’re basically done. That’s what this document is intended to help you do – set it up and fine-tune it for your specific needs. Chapter 2 – E-mail Programs Many folks are using their web browser to access their email. Could be Internet Explorer, Microsoft Edge, Chrome or even Firefox. There are multiple issues with using a web browser to send and receive e- mail, with the major issue being that it’s just flat out not possible to afford any level of protection to sensitive data sent or received via e-mail. Due to the designed and intended functionality of a web browser to be used for multiple things other than just surfing the web, it’s just flat out not possible for a web browser interface to an e-mail account to provide the level of security necessary by HIPAA. The bottom line is, if you want to be HIPAA compliant you flat out have to stop using any web browser to send or receive email that contains sensitive patient information. You really don’t have a choice if you want to be in full compliance with the law. I highly encourage all medical professionals to use a third-party e-mail program that is designed and intended for primary purpose of sending and receiving e-mail. This will give both the sender and recipient better control over the management of e-mail. A third-party e-mail program also allows the implementation of e-mail security protocols that will meet, and more commonly exceed HIPAA requirements. Even the so-called built-in e-mail program included with Windows 10 is basically nothing more than a web browser, as it does use Microsoft Edge. The built-in e-mail of Windows 10 just can’t come anywhere close to meeting HIPAA requirements. Many third-party e-mail programs also include additional functionality you may find useful too. For example, calendar scheduling and to do lists. The two most commonly used e-mail programs are Microsoft Outlook and Mozilla Thunderbird. Both also include the added functionality of calendar scheduling and to do lists. Outlook comes as part of the Microsoft Office 2019 suite and is also included in the online Office 365 suite. Either one you use, the Outlook program gets installed on the local hard drive of your computer, and that’s what you want. Mozilla Thunderbird is another highly popular e-mail program used by many. Not only is this program free, but It too comes with the calendar scheduling as an added function. One can also elect to install many other add-ons that are available free of charge such as to do lists, reminders, and many more. Thunderbird is also considerably easier to set up, use and configure than Outlook is. For both of these programs the added functionality of e-mail encryption is also available. For Outlook, it can be installed and configured as an add-on in such a way that, once installation and configuration is complete it will handle all e-mail and attachments encryption and decryption in the background automatically with no user intervention. Whereas the basic Mozilla Thunderbird program comes by default with e-mail encryption built it. All you have to do is set it up. The most common as well as the most secure e-mail encryption out there is called Pretty Good Privacy, or PGP for short. Best of all it’s absolutely free. Set up of PGP while not intuitive, is somewhat easy with proper guidance. But once you have it set up and configured the way you want, you’re done! It’s all hands off with all the work done automatically in the background. The end user doesn’t notice anything different really. But you do have the piece of mind of knowing that protected patient information sent via e-mail does in fact, meet or exceed the HIPAA requirements for the protection of that information. Chapter 3 - What is PGP? PGP, which stands for Pretty Good Privacy is a software program used to encrypt information on your computer, before it leaves your computer. It also does the opposite and will decrypt encrypted data after it has been downloaded to your computer. PGP consists of two parts. There’s a private key and a public key. The public key is used to encrypt information. That’s the only thing it can do. There is no way possible for a public key to be used for decrypting and reading information that has already been encrypted. The public key is shared with anyone and everyone that you wish to share information with via e-mail. The private key is used to decrypt information which was encrypted with it’s corresponding public key. The private key is never shared with anyone. It remains only in the possession of the person who will be receiving information from others that was encrypted with the public key that corresponds to the private key. For two parties to send encrypted e-mail back and forth, each party must have their own private key which each party will never share with another. Likewise, each party must have the public key that corresponds to the private key of the individual they wish to send sensitive information to.
Recommended publications
  • Learning Outcomes - Email Etiquette Training Program (Part A)
    Learning Outcomes - Email Etiquette Training Program (Part A) By the end of this course, participants will: Develop a heightened awareness of the potential perils of digital communication Master effective email structures to achieve clarity and successful communication Learn to write for the reader, starting with effective subject lines Make the most of 'email estate' Carefully consider the email recipients Learn to work within principles or 'rules of thumb' to ensure professional, clear & effective emails Perfect grammar because it matters Format messages for readability Learn to write professionally and brand Broadcast emails Learn to avoid senders regret by proof reading Understand 'netiquette' Master the inbox using some core principles and email functions Program Outline – Email Etiquette Training Program Topic 1 – Introduction As with any form of communication, there are certain rules of behavior which should be considered when using email. Email is written communication, but it does not have the formality of earlier written forms. It has a much more immediate, less formal feel than paper, pen, and stamp mail. Email is also essentially one - way communication. There is no immediate feedback and interaction. Also, written communication by definition allows far fewer context clues to its meaning as face - to -face and telephone conversation. Any written communication must be carefully considered so that it is not misunderstood, but email lends itself to casual interaction. The potential for real misunderstanding is clear. When you compose an email message, pause and read over it again before you send it. Once it is sent, you can't get it back. Remember that your grammar, spelling, and vocabulary send a message as clear as the words.
    [Show full text]
  • Email Policy & Procedures
    EMAIL POLICY & PROCEDURES Issued by: Technology Steering Committee Applies to: All members of the University granted an Email account Effective date: March 2003 Introduction New Jersey City University (NJCU) recognizes the need for efficient communications with its students, faculty, and staff. This policy was established to enable official email communications with students, faculty, and staff. Revised April 2018 1 PURPOSE Electronic Mail (email) is recognized as one of the most effective ways to disseminate information of importance, relevance and interest to members of the University and larger, global community in a timely manner. It is therefore important to define the University’s policy on email and offer appropriate procedures on the use of this technology. This document serves as the University’s policy on email and distribution lists, as well as appropriate procedures and guidelines for their use. SCOPE This information is for all members of the University who are granted an official NJCU email account. In addition to general policy and procedures that apply to all members, specific responsibilities and procedures are provided for both employees and students. DEFINITIONS Email – Electronically delivered messages addressed to specific email account holders. Email Account – A username and password assigned to a user that allows access to email services. Listserv – Software that creates email distribution lists. Email Server – A server-class computer that has been configured to accept and forward email messages on behalf of a registered account holder (the sender), and to receive and deliver messages to members registered to a server (the receiver). MS Exchange® Server – A specialized Microsoft email server that provides extended enterprise capabilities through Microsoft Office Outlook.
    [Show full text]
  • Using MCP EMAIL
    Using MCP EMAIL Using MCP EMAIL Paul Kimpel 2009 UNITE Conference Session MCP-4005 Wednesday, 11 November 2009, 10:30 a.m. Copyright © 2009, All Rights Reserved Paradigm Corporation Using MCP EMAIL 2009 UNITE Conference Minneapolis, Minnesota Session MCP-4005 Wednesday, 11 November 2009, 10:30 a.m. Paul Kimpel Paradigm Corporation San Diego, California http://www.digm.com e-mail: [email protected] Copyright © 2009, Paradigm Corporation Reproduction permitted provided this copyright notice is preserved and appropriate credit is given in derivative materials. 2009 UNITE MCP-4005 1 Using MCP EMAIL Presentation Topics Overview of Email Concepts Email Sending Methods for the MCP MCP OBJECT/EMAIL Utility What is it? Installation and configuration Running the utility Parameter string syntax SEND options Using the EMAIL API Errors, retry, and troubleshooting So, What Good Is It? MCP-4005 2 Today I would like to discuss what is to me one of the nicest facilities of the MCP – the ability to send email messages from MCP-resident applications. I'll start with a brief overview of email in general – the components, protocols, and message formats used. Next, I'll briefly discuss a few methods for sending email from MCP applications, using both bundled and third-party solutions. The bulk of this presentation will be devoted to one of those methods, the OBJECT/EMAIL utility that is bundled with the standard MCP release. I will discuss how to install and run the utility, the components of its command parameter syntax, options it supports for sending email messages, how it can be called from application programs in addition to run as a utility program, and how it handles errors and retry operations.
    [Show full text]
  • (12) United States Patent (10) Patent No.: US 7,194,515 B2 Kirsch (45) Date of Patent: *Mar
    US0071945.15B2 (12) United States Patent (10) Patent No.: US 7,194,515 B2 Kirsch (45) Date of Patent: *Mar. 20, 2007 (54) METHOD AND SYSTEM FOR SELECTIVELY (56) References Cited BLOCKING DELIVERY OF BULK U.S. PATENT DOCUMENTS ELECTRONIC MAIL 5,815,665 A * 9/1998 Teper et al. ................ 709,229 (75) 6,195,698 B1* 2/2001 Lillibridge et al. ......... 709/225 Inventor: Steven T. Kirsch, Los Altos, CA (US) 6,199,102 B1* 3/2001 Cobb ......................... TO9,206 (73) Assignee: Google Inc., Mountainview, CA (US) * cited by examiner (*) Notice: Subject to any disclaimer, the term of this Primary Examiner Viet D. Vu patent is extended or adjusted under 35 (74) Attorney, Agent, or Firm—Fenwick & West LLP. U.S.C. 154(b) by 588 days. (57) ABSTRACT This patent is Subject to a terminal dis The origin address of an e-mail message is validated to claimer. enable blocking of e-mail from spam e-mail sources, by preparing, in response to the receipt of a predetermined (21) Appl. No.: 10/407,586 e-mail message from an unverified source address, a data key encoding information reflective of the predetermined (22) Filed: Apr. 3, 2003 e-mail message. This message, including the data key, is then issued to the unverified source address. The computer (65) Prior Publication Data system then operates to detect whether a response e-mail US 2003/O1673 11 A1 Sep. 4, 2003 message, responsive to the challenge e-mail message, is received and whether the response e-mail message includes Related U.S.
    [Show full text]
  • The Enigmail Handbook 1.0.0
    openpgp email security for mozilla applications The Handbook V 1.8 Adaptations by Ludwig Hügelschäfer Based on Version 1 by Daniele Raffo with Patrick Brunschwig and Robert J. Hansen. Enigmail Handbook Contents 1. Setup and usage.......................................................................... 5 1.1. What do you need?................................................................................... 5 1.2. How to install Thunderbird.........................................................................5 1.3. How do I install Enigmail?......................................................................... 6 2. Quick start guide......................................................................... 8 2.1. The Setup Wizard......................................................................................9 2.2. Start using Thunderbird with Enigmail.....................................................28 3. Key management....................................................................... 30 3.1. Operations on your key pair.................................................................... 31 3.2. Distributing your public key..................................................................... 35 3.3. Importing public keys...............................................................................36 3.4. Validity of public keys.............................................................................. 37 3.5. Importing an existing key pair..................................................................42 3.6. Generating
    [Show full text]
  • Docusign Signature Appliance Client User Guide Version 8.0
    1 DocuSign Signature Appliance User Guide DocuSign Signature Appliance Client User Guide Version 8.0 221 Main Street, Suite 1000, San Francisco, CA 94105 Ι Tel. 866.219.4318 Ι www.docusign.com Ι © DocuSign, Inc. DocuSign Signature Appliance User Guide 2 Copyright ©2003-2016 DocuSign, Inc. All rights reserved. For information about DocuSign trademarks, copyrights and patents refer to the DocuSign Intellectual Property page (https://www.docusign.com/IP) on the DocuSign website. All other trademarks and registered trademarks are the property of their respective holders. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of DocuSign, Inc. Under the law, reproducing includes translating into another language or format. Every effort has been made to ensure that the information in this manual is accurate. DocuSign, Inc. is not responsible for printing or clerical errors. Information in this document is subject to change without notice. DocuSign Signature Appliance Client User Guide, version 8.0 If you have any comments or feedback on our documentation, please send them to us at: [email protected]. 221 Main Street, Suite 1000, San Francisco, CA 94105 Ι Tel. 866.219.4318 Ι www.docusign.com Ι © DocuSign, Inc. DocuSign Signature Appliance User Guide 3 Table of Contents Chapter 1: Overview ............................................................................................................................ 1 Requirements
    [Show full text]
  • United States Patent (10) Patent No.: US 7,194.618 B1 Suominen (45) Date of Patent: Mar
    US0071946.18B1 (12) United States Patent (10) Patent No.: US 7,194.618 B1 Suominen (45) Date of Patent: Mar. 20, 2007 (54) ENCRYPTION AND AUTHENTICATION 5,509,071 A 4, 1996 Petrie, Jr. et al. ............... 380/4 SYSTEMIS AND METHODS 5,533,123 A 7/1996 Force et al. ................... 380/4 5,544,045 A 8, 1996 Garland et al. ........ 364/419.03 (76) Inventor: Edwin A. Suominen, 3355 E. Jump Off Siswk - A 5E, E.Ollill et al.. ..... .- -. .- S. Joe Rd., Valley, WA (US) 99181 5,638,446 A 6/1997 Rubin ........... 380.25 (*) Notice: Subject to any disclaimer, the term of this 5,727,0625,646,992 A 3/19987/1997 Subleris et alsoal. .................. ... 38037380/4 patent is extended or adjusted under 35 5,748,738 A 5/1998 Bisbee et al. ................. 380.25 U.S.C. 154(b) by 593 days. 5,761,686 A 6/1998 Bloomburg .... ... 707/529 5,768,384 A 6/1998 Berson ........................ 380.23 (21) Appl. No.: 10/092,943 (Continued) (22) Filed: Mar. 5, 2002 FOREIGN PATENT DOCUMENTS Related U.S. Application Data EP O 880 254 A2 11/1998 JP 2000224407 A 8, 2000 (60) Provisional application No. 60/273,862, filed on Mar. WO WO 98.17029 4f1998 5, 2001. WO WO O1/35253 5, 2001 (51) Int. Cl. OTHER PUBLICATIONS G06F I/24 (2006.01) “CryptoEx Office; Signature for Electronic Documents.” Web page (52) U.S. Cl. ...................... 713/155: 713/161; 713/168; printout from http://www.cryptoex.com/crytoexv3/office. 713/169; 713/182 aspx?lang=en.
    [Show full text]
  • Netwire Remote Access Trojan (RAT)
    Netwire Remote Access Trojan (RAT) Overview On 22 October, we observed an email campaign distributing the Netwire remote access trojan (RAT), also known as Recam and NetWiredRC.1 Since 2012, threat actors and at least one advanced persistent threat (APT) group2 have been using this publicly available, multiplatform tool in campaigns targeting a variety of systems and industries in the Middle East. Customer Impact Netwire’s capabilities include keylogging and credential stealing, as well as reading, writing and deleting victim data. On 23 September, Fortinet reported finding a new variant that uses anti-sandboxing and anti-debugging techniques to evade attempts at analysis. One of the checks Netwire conducts is to wait for the victim to move their mouse and produce two different cursor positions before continuing to run.3 Fortinet also found that among the software credentials stored on a victim’s computer, Netwire focused on stealing those for 360Chrome, Opera, Mozilla Firefox, Mozilla SeaMonkey, Google Chrome, Comodo Dragon browser, YandexBrowser, Brave-Browser, Mozilla Thunderbird, Microsoft Outlook, and Pidgin. Campaign Analysis In the campaign we observed, the emails spoofed a message from a trading company and claimed to contain a purchase order for October. The body sought to lure the recipient into opening the attached file by requesting that they return the invoice with a corrected number to the manager in the signature block. All the email attachments in the campaign had the same file SHA256 hash. The attachment was a tape archive (TAR) file that was named to look like a Microsoft Excel file, and which decompressed to an EXE of the same name.
    [Show full text]
  • Docusign Signature Appliance Release Notes September 2016
    DocuSign Signature Appliance - Release Notes | September 2016 1 DocuSign Signature Appliance Release Notes September 2016 This file is part of DocuSign Signature Appliance distribution and is covered under the same License Agreement This document contains technical release notes for all DocuSign Signature Appliance versions and complements information written in the DocuSign Signature Appliance User Manual. Please read through the DocuSign Signature Appliance documentation and the release notes before installing the DocuSign Signature Appliance. Updated: October 5, 2016 DocuSign Signature Appliance - Release Notes | September 2016 2 Table of Contents Table of Contents 2 Release Notes – DocuSign Signature Appliance Version 8.2 4 Known Problems/Limitations/Warnings 7 Release Notes – DocuSign Signature Appliance Version 8.3 8 Release Notes – DocuSign Signature Appliance Version 8.1 9 Release Notes – CoSign Version 8.0 13 Release Notes – CoSign Connector for SharePoint 7.3.2 19 Release Notes – CoSign Version 7.5 20 Release Notes – CoSign Version 7.4 26 Release Notes – CoSign Connector for SharePoint 7.3 31 Release Notes – CoSign Connector for SharePoint 7.2 32 Release Notes – CoSign Version 7.1 33 Release Notes – CoSign Connector for SharePoint 7.1 39 Release Notes – CoSign Connectors for SharePoint 6.5.4 41 Release Notes – Client Version 6.2.7 42 Release Notes – CoSign Connectors for SharePoint 6.5.3 43 Release Notes – CoSign Connectors for SharePoint and Nintex 6.5 44 Release Notes – CoSign Version 6.2 46 Release Notes – Appliance Version
    [Show full text]
  • Curating E-Mails: a Life-Cycle Approach to the Management and Preservation of E-Mail Messages
    1 DCC Curation Manual DCC Curation Manual Instalment Curating E-Mails: A life-cycle approach to the management and preservation of e-mail messages Author: Maureen Pennock Date: June 2006 Author Bio Maureen is a Research Officer for the DCC, based at UKOLN at the University of Bath. She has been involved in digital preservation since 2001 when she joined the Dutch government Digital Preservation Testbed research project. She later worked at the Dutch National Archives on the EC-funded ERPANET project, and on the e-government knowledge centre project at the Dutch ICT Foundation (Stichting ICTU). Her main areas of interest lie in strategies for digital preservation, digital record-keeping and digital archiving, digital cultural heritage, and authenticity of digital records. She joined the DCC in Autumn 2005. Maureen Pennock, Curating E-Mails 2 1. Introduction and scope The rise and proliferation of digital technologies has resulted in an expansion of opportunities for institutions to create, manage, and maintain records and documents in digital form. One of the forms which these records often take is e-mail. The first electronic message – e-mail for short – was sent in the 1960's over a single mainframe system and network e-mail followed shortly after in the early 1970's. Sadly, the message that was sent was not recorded for posterity. The subject of the message is unclear and the contents of the message have been lost to the so-called 'digital dark ages'. This initial failure to preserve was indicative of what was to follow: modern companies in the twenty-first century have collectively been fined billions of dollars for failing to adequately manage and preserve corporate e-mail records, and others have been similarly fined for creating and retaining inappropriate e-mail records.1 Despite the fact that e-mail forms the backbone of communications in many modern institutions and organisations, it is often badly managed and the long-term preservation of e-mail messages is a challenge for which most solutions have yet to be put to the test.
    [Show full text]
  • Protection and Firewalls
    Lectures on Distributed Systems System Protection and Firewalls Paul Krzyzanowski INTRODUCTION Computer security was an issue since the earliest days of digital computers. The ear- liest computers, such as the eniac1 and the Colossus2 were designed for military use, the former to compute ballistic firing tables and the latter to decipher German Lo- renz3 codes. These were primitive machines: running no operating system, running a single “process,” and operated by a single user. Nevertheless, security of their data (or even of their existence, in the case of Colossus) was of paramount importance. This was achieved via physical security – guarded buildings, armed guards, face-to-face authentication. Things have changed since then. We have sensitive data coexisting with data of others on the same file servers. Multiple processes run on the same machine. As we started to work a distance and use data communication networks, those networks be- came avenues for snooping: authentication sessions and data transfers could be grabbed. To make matters even more complex, we actually want to run other peo- ple’s code on our machines. It’s unlikely that we will write all the code that runs on our machines, so we rely on externally-produced operating systems, compilers, and applications. We are somewhat at ease when these come from trustworthy sources (trusted vendors, such as Adobe, Macromedia, Apple, et alia) but we also want to run applications from random parties – applets that are loaded with our web pages or miscellaneous games that we may spontaneously download. This can open up a Pan- dora’s box of problems: how do we know that the applications are not performing malicious acts behind their innocent façade? 1 Completed in 1945 at the Moore School of Electrical Engineering at the University of Pennsylvania.
    [Show full text]
  • GFI Software Help
    EMAIL CLIENTS GUIDE Discover how to use various email clients with Kerio Connect. The information and content in this document is provided for informational purposes only and is provided "as is" with no warranties of any kind, either express or implied, including without limitation any warranties of merchantability, fitness for a particular purpose, and non-infringement. GFI Software disclaims and in no event shall be liable for any losses or damages of any kind, including any consequential or incidental damages in connection with the furnishing, performance or use of this document. The information is obtained from publicly available sources. Though reasonable effort has been made to ensure the accuracy of the data provided, GFI makes no warranty, promise or guarantee about the completeness, accuracy, recency or adequacy of information contained in this document and is not responsible for misprints, out-of-date information, or errors. GFI reserves the right to revise or update its products, software or documentation without notice. You must take full responsibility for your use and application of any GFI product or service. No part of this documentation may be reproduced in any form by any means without prior written authorization of GFI Software. If you believe there are any factual errors in this document, please contact us and we will review your concerns as soon as practical. GFI and Kerio Connect are trademarks or registered trademarks of GFI Software or its affiliates in the US and other countries. Any other trademarks contained herein are the property of their respective owners. Kerio Connect is copyright of Kerio.
    [Show full text]