How Secure is Email? A Brief Report on the Security of Email
A while ago I had a conversation with someone who was convinced that using email to transfer private and confidential data was quite secure and that no further security needed to be put in place. I wrote the following report to help convince them (and their organisation) that email was not a secure media to transfer private and confidential data.
How secure is email?
Firstly I think we need to look at what we are concerned about protecting. For general communication, it does not matter that much whether someone else can read you email as it will only be of much interest to the sender and the recipient. Email of a personal nature could cause some embarrassment if the content was to be read by someone else (especially someone known to either the sender or recipient) and email containing sensitive data such as personal records, financial data, etc. could have serious repercussions if the content became public. In the main, email security is not really a major concern for most people, but for organisations handling sensitive data their approach to email needs to be taken a bit more seriously.
So lets look at the email process and where the security holes lie…
SMPT (Simple Mail Transfer Protocol)
When the email is sent, it is forwarded to a SMTP server and then relayed through a number of servers on the Internet before reaching its final destination. During this process the email is copied, forwarded and deleted on various server computers along the way. Back-ups are routinely created which can last for days, months, or possibly indefinitely so anyone with access to those servers has access to email on them. Errors can also occur during the SMTP process, which can mean that the email never gets delivered to the correct final destination and instead ends up being bounced around the Internet or forwarded to various system administrators to make them aware of the problem.
The recipient’s online mailbox may store email for months or possibly years after the email has been downloaded. If the recipients server is IMAP (Internet Mobile Access Protocol) enabled (most email servers are) the email will be stored indefinitely. Even when the user has deleted email, it still may be available and stored on the server. While mailboxes are password protected, if that password is compromised or hacked, the entire contents become accessible to anyone who has the password. The owners/administrators of the mailbox server will have access to the email, as well as the owners/administrators of the email address domain name the email was sent to.
Accidentally sending email and email forwarding
It is very easy for either the sender or the recipient to send or forward email accidentally, (or inadvertently by virus or other malicious software), or this could be done by anyone with access to the email. This starts the whole process again. If the email is accidentally forwarded to a public or bulk list, this widens the problem further. When typing an email address, a simple typo or accidentally sending to the wrong person stored in an address book means that the email can get sent to the wrong person.
Shared or Networked Computers
Many email users use web based email programmes to access their email from shared computers (such as at work etc.). Email (and attachments) may be stored in temporary files on that computer even after the email browsing session has ended. Any person with access to that computer may have access to those files.
Email on Corporate Networks
Those who use email at work (via a corporate network) may have all their email automatically monitored by the system administrators or their bosses. Software is available to automatically forward all email traffic going through the servers without the user ever knowing.
WiFi Hotspots and Unsecured Networks
If the email is transferred (either by the sender or the recipient) via an open or unsecured/unencrypted wireless network (such as an airport, bar or even an unsecured home wireless network), it is possible for anyone on that network to intercept traffic on that network and store the data being transferred.
We do not know for certain who could be reading our email. We cannot know where it goes where it is stored or who has access to what we sent. For the most part, it does not really matter anyway. If there is anything contained in email, which must remain private, it is imperative that further security should be put in place to stop the email being read by anyone other than the intended recipients.