How many organizations have access to my email?

Author: Ed Dante

Here’s a scenario: You are sending a confidential email to an employee at another company that’s based overseas. You need to share the information with the person at that company, but you don’t want the information to get out beyond that connection. How many organizations will have access to that email?

Answer: More than you would like!

Let’s set up the scenario, and break down who might have access.

Your company uses Microsoft Office 365 for email, and the receiver uses Google’s G Suite. That means there are copies of your emails with both Microsoft and Google.

So here’s the thing: both of these companies use different third-party email scanning tools. Those companies have or had access to your email. Somebody has been able to peer in while operating the security infrastructure of each platform, even if a lot of the scanning is automated.

Seconds after you pressed ‘send,’ four organizations had access to your email! That’s not all, though – there actually might be more. Does Google or Microsoft use third party data processors? Do they partner with email scanning vendors? Sure, they may say all of their vendors have “the same commitment to privacy and security” and everybody is conversant in GDPR. That still means all of those parties have access. It’s just what they do with it that is governed by privacy rules.

In addition, both parties on each end of the pipeline use desktop and mobile email, so there are copies of your data with those devices.

But wait, there’s more…

Your counterpart uses lots of email integration tools for better managing email. It turns out that several other companies have access to the email! Yes, the kinds of optimization tools that offer us streamlined CRM (Customer Relationship Management) and good data insight also port data to various parties, increasing the footprint of who has access. This is turning into quite a crowd!

Then there’s the cloud. Both of your organizations back up the email to different cloud services. It might be public, private or hybrid cloud. They might use edge computing or cloud gateways. The bottom line is: while cloud offers the convenience and value of porting information through the global internet, it also gives those vendors additional seats at the table when it comes to access. That’s why, in the early days of the cloud, so many executives and other skeptics spent so much time looking at the vendors’ security practices. They didn’t just take the vendor’s word for it. Now, a lot of people have calmed down on cloud security. That doesn’t mean there aren’t any remaining concerns!

Let’s keep going.

Other people who may have access:

Both organizations have administrators who can get access to the email.

Your counterpart gives email access to his admin team.

His wife sometimes has access to his phone.

He forwarded the email to one of his colleagues, which subjects the email to even more copies!

You don’t know it, but your recipient is also party to a legal action, and his email is subject to government subpoena!

Some of these aren’t even on the radar for most of us. How would you know if a lawyer was peering over somebody’s shoulder? You wouldn’t – until some kind of glitch happens.

Likewise, with the wife and husband stuff.

Challenge Summary

In summary, there are somewhere between 10 and 100 copies of the confidential email that you sent floating around the web. All copies are subject to both legal subpoenas and illegal hacking… now how confident do you feel about the confidential information that you sent?

Email is inherently prolific: in other words, there are always copies being made. Between the cloud services, device copies, backups, and the number of parties involved, the number of copies swells easily.

There has to be a better way!

Confidential Message Best Practices:

There are several ways to improve privacy with your sensitive messaging, without resorting to sending messages via carrier pigeon.

Use secure email features such as G Suite Confidential mode. It is a tool Google provides to restrict the ability to copy, print, or download the email. You can also expire the email and require an SMS passcode to access it.

Don’t send the content in email. Keep the confidential part in a shared repository like Office 365 OneDrive or Google Drive and send a link. (There are still copies, just fewer of them and you, in theory, have more control.)
Don’t send the content in email. Use a secure messaging tool like Signal to transmit confidential information. Signal allows users to message, have voice and video calls with the content encrypted from end-to-end.

Don’t send the content in email. Physically mail it or tell in person. But you can use the mail service and don’t need the carrier pigeon!

Summary

Email is handy, but without good oversight, your data ends up all over the place! Use these common-sense tips to play it closer to the vest with what you send.

If you would like help with your cybersecurity strategy or program, give Fractional CISO a call for a complimentary consultation. We can be reached at (617) 658- 3276 or by email at [email protected].