* Comments about encrypted e-mail and getting end users to comply
My recent article on making the case for encrypted e-mail http://www.networkworld.com/newsletters/gwm/2005/0801msg2.html?rl generated a significant response – here’s a sample of what readers had to say on the subject:
* “I gave up on the battle to make users appreciate the risks and use e-mail carefully. However, I have had greater success getting them to switch from e-mail to more secure means of collaboration, such as secure document repositories. Not only are they more secure, but also more economical. Surprisingly, I have had little problem convincing clients to use a centralized secure repository whereas I found it impossible to convince anyone to use secure e-mail (or at least use it judiciously). I suppose it’s a bit like treating alcoholism; it’s easier to stop drinking entirely than to simply cut back.”
* “With a focus on secure messaging by Microsoft, we could quickly see the deployment of a standards-based Internet infrastructure. Without it, it will remain largely implacable. The reason is that you never know what capabilities your receivers have.”
* “Better to drill into people an underlying instinctive feeling that e-mail is insecure (Pavlovian conditioning of some form required here), and provide a solution that ‘feels different’ for sending secure stuff. Extranet, password-secured FTP site, there are many options that can work without too much infrastructure investment.”
* “E-mail is our biggest hole in our [Health Insurance Portability and Accountability Act] security. I’ve heard of outbound filters to stop certain info from leaving the network, but imagine building the criteria list. A salesman from [a vendor] called last week offering our little non-profit an encrypted e-mail solution, but it costs too much. The recipient has to log on to their site to retrieve the e-mail by entering a password each time. How many people are going to remember ANOTHER password? Oh well, I’ll just put it on a sticky note on my monitor-oops, HIPAA violation!”
* “The problems we found [with secure messaging]: getting people here to use it; making it easy enough so that the recipient can unencrypt the message; getting people to understand WHEN they need to use it; and technical problems, mostly on the recipient’s side. Basically, you become the help desk to the world.”
* “Your article…and the quotes from the Australian [reader cited in the article] are exactly what I face. Secure e-mail is too complicated for the average non-techie. The only alternative I have found is to hire a company…that takes one’s outgoing e-mail and turns it into an encrypted Web page. The cost for such a service, $10 to $30 per month per e-mail box, is cost prohibitive. Given HIPAA, Gramm-Leach-Bliley and so forth, the world desperately needs a low-cost, easy solution.”
Thank you to everyone who provided their comments on the article.
