Category: Information Security

05 Jun 2020

Email Data Protection, The What and Why, and How to Select Yours

Organizations continue to place too much focus on feature and function when evaluating security technology. At a time of fierce digital transformation, the distance between technical promise and business impact continues to widen as over 124.5 billion business emails are sent and received each day.

When COVID-19 first emerged, many organizations scrambled to find quick-fix security solutions to prop up their now-remote workforces for a business delay expected to last a couple of weeks. Add to the mix the acceleration of long-term working from home and shifting attitudes to digital privacy.

“This is a wake-up call for organizations that have placed too much focus on daily operational needs at the expense of investing in digital business and long-term resilience,” says Sandy Shen, Senior Director Analyst at Gartner. “Businesses that can shift technology capacity and investments to digital platforms will mitigate the impact of the outbreak and keep their companies running smoothly now, and over the long term.”

But simply buying an encryption product, to protect your data being sent in emails, does not guarantee long term organizational value.

According to a survey from encryption technology experts Echoworx, 81 per cent of organizations prioritized encryption for protecting data sent in email as important, even critical, to their technology stack, but only 40 per cent are using email encryption throughout their business.

To end this disconnect, we argue that organizations need to start thinking differently about their email data protection strategy and the way they evaluate and select solutions and vendors.

Technology alone delivers no value

The fact that the technical “experts” believe a technology or product will work for the business is not a guarantee that the business will actually use it. Through our years of experience, we have heard these three email encryption misconceptions repeated over and over.

Misconception #1: “We invest in encryption tools because it is mandatory”
Reality: Investment in an encryption tool should address specific business needs.

Misconception #2: “We have encryption, we are safe. It’s good enough.”
Reality: Protecting data sent through email is less dependent on technology than you think.

Misconception #3: “Data protection is all about compliance”
Reality: The ability to protect data is just as important as the ability to use and move data.

Why do you need a particular product? How well do you know the business and their needs? And, how well will this product meet those needs? If you don’t know the answer to these questions, with total clarity, you don’t understand the business and you won’t be able to add real value.

One bank, for example, wanted to easily recall emails and customer documentation so that they could reduce implicating the Chief Data Officer and eliminate lengthy audit processes. That’s what the business needed. What the business got was an onerous multi-step approach, requiring physical actions from multiple staff, external individuals, organizations, and 3rd party email providers to confirm emails and attachments have been deleted from all backups and archives.

In another example, an insurance company wanted their customers to be able to simply respond to an email so that they could return sensitive documentation easily to a centralized mailbox. That’s what the business wanted. What the business got was a time-consuming multi-step approach, requiring the resources of multiple staff, sending instructional emails to customers, requiring registration to an encrypted email service – before being able to access and return requested documents safely.

The list goes on.

Ask better questions, align technology to business needs

Instead of arming yourself with a checklist of features and functions, prepare questions that will help you evaluate the fit of an email data encryption solution to your business needs. Here’s how …

To learn: How well the offering meets your business need.
Ask. Why do you need this particular security product? Why now?

To learn: What does success look like for the business.
Ask. How well does this offering resolve your specific need?

To learn: How end users will use this solution.
Ask. How well does the offering fit into your existing way of working?

To learn: Can this meet the business needs today and the bigger picture needs tomorrow.
Ask. How well the offering integrates with your other systems and technologies? Could the way you use this solution change over time?

01 Jun 2020

Multilingual Interfaces Drive Growth, Says Research

For decades, businesses have internationalized their global operations by adopting English. The gains from this have been real, but recent research suggests they could be even bigger if paired with language preference.

Global enterprises need to operate in English. It’s the primary language of technology, finance, regulators, and other major stakeholders. Firms with global operations need to have a unified language for communication and English-first policies have taken hold in many corporate headquarters and regional offices.

There are advantages to this, such as being able to communicate between offices in Mumbai, Shanghai and Sao Paulo. But even in economies with a high level of English-language skills – including tech hotspots such as the Nordics, Israel and Singapore – the use of non-native languages can cause confusion, miscommunication, and unnecessary risk.

Increasingly, firms and researchers are realizing that while the trend toward global English has brought benefits, there may be even more upside to having multilingual capabilities.

Here are some key recent findings and observations:

Multilingual businesses can embrace multiple ways of thinking

The World Economic Forum has recognized that the language people use can change the way they think, sometimes in surprising ways . For instance, Chinese speakers tend to take more gambling risks when they receive positive feedback in their native language, but they became more risk averse when the same feedback is given in English. “Reduced impulsiveness when dealing in a second language can be seen as a positive thing, [but] the picture is potentially much darker when it comes to human interactions,” the WEF noted. “In a second language, research has found that speakers are also likely to be less emotional and show less empathy and consideration for the emotional state of others.”

The WEF suggests firms embrace multilingualism even while having an “official” language. “A balanced exchange of ideas, as well as consideration for others’ emotional states and beliefs, requires a proficient knowledge of each other’s native language. In other words, we need truly bilingual exchanges.”

New technologies increase the need for native-language precision

Second languages are difficult to master in writing, and far more challenging to learn to speak. With the world’s largest technology firms promoting voice commands, the demand for better native-language interfaces is rapidly increasing.

The mobile-first world is changing the way we interact with our devices – Oracle Industry Strategy Director, William Bariselli

The mobile-first world is changing the way we interact with our devices, and we’re currently seeing a shift back to an older method of communication: speech. Users are increasingly starting to type using voice inputs rather than using the keyboards,” says William Bariselli, Industry strategy director at Oracle.  He notes that around 60% of mobile phone users already speak to their device daily, with higher rates among younger generations.

As anyone who has responded to voice prompts on a customer-service line or received a nonsensical response from Siri or Alexa can tell you, speech recognition is far from perfect. But with Google, Apple, Microsoft and Amazon making massive investments in natural language processing and including voice features in virtually all hardware and software, it is certain that the trend toward voice will accelerate.

English is the language of cyber crime

English is the global language of both business and cyber crime. Consumer anti-virus firms Symantec and Kapersky consistently note that email phishing and extortion scams almost always start in English before being adapted into other languages.

Scammers will use poor English deliberately to target people with lower-level reading skills

Scammers will use poor English deliberately to target people with lower-level reading skills – both less-educated native speakers and those who use English as a second language. Consultant and author Joseph Steinberg says this targeting of people with poor English skills is intentional and strategic. “As the vast majority of people simply do not write their emails with The King’s English, to put it mildly. A bogus email impersonating one from the head of corporate computer support is likely more believable with minor errors in it, than if it were written as well as most articles in the New York Times or the Wall Street Journal.”

Native-languages may be a legal requirement

Multilingual operations are often a requirement rather than a choice. Many jurisdictions have regulations that mandate bi- or multi-lingual services. Financial firms in Canada, for instance, must have both English and French content and interfaces for employees and clients. Similarly, Europe’s General Data Protection Regulations obliges firms to provide native-language services when dealing with third parties.

Even if multinationals are not required to adopt a local language by law, they will have to communicate and service with institutions that must do so – such as financial and government institutions, particularly when it comes to official and sensitive communications.

Enterprises can’t afford to have any vital instructions lost in translation when communicating sensitive data and private information – Echoworx Senior Director Market Intelligence, Jacob Ginsberg

“Enterprises can’t afford to have any vital instructions lost in translation when communicating sensitive data and private information,” said Jacob Ginsberg, Senior Director Market Intelligence with email data encryption leader Echoworx. “To avoid confusion, miscommunication or something as simple as a poor customer user experience, secure message notifications and instructions need to be clearly understood by those who receive them.”

Native language capabilities reduce costs

With local language capabilities, employees and customers can fully understand and interact with systems and software, improving their ability to use a product and learn its functionalities. “Only if all buttons, menu lists, commands, messages and notifications are clear, will your customers be able recognize all advantages of using your application,” said Dorota Pawlak , owner of DP Translation Services, which localizes software for Polish market. “Localization … ensures readability and preserves the original functionality to help your users understand your product, which in turn ensures better customer experience.” This lowers unnecessary queries to customer service reps, lowering support costs and freeing money for other activities.

Local language capabilities increase employee retention

Harvard Business School professor Tsedal Neeley sees many advantages of English as a global business language, but notes that forcing employees to adopt foreign language can hurt performance, job satisfaction and retention.”When my colleagues and I interviewed 164 employees at GlobalTech [a pseudonym for a multinational] two years after the company’s English-only policy had been implemented, we found that nearly 70% of employees continued to experience frustration with it. At FrenchCo [another pseudonym], 56% of medium-fluency English speakers and 42% of low-fluency speakers reported worrying about job advancement because of their relatively limited English skills.”

People are more precise on their native language

English is essential to advance in sectors like technology and finance, but English as it is spoken in business is not the same as how it is spoken naturally and has serious limitations. “Phonetically, [business English] has almost nothing to do with American or UK English. They say it is ‘BBC English,’ but actually it is not. It is a phonetically simplified English that uses UK English grammar,” said Salvatore Sanfilippo, an Italian computer programmer with a U.S. cloud services firm. While this allows people from around the world to communicate easily, it has nothing to do with the real English spoken in UK, US, Canada, and other countries where English is a native language,” says Sanfilippo.

A person’s first language will be their first preference

The most obvious reason for language localization is that a vast majority of people prefer to speak their first languages.

The Globalization and Localization Association, a global non-profit, notes a wealth of studies on language preference: 56.2% percent of consumers say that the ability to obtain information in their own language is more important than price,65% of multinationals believe localization results in higher revenues, 95% of Chinese consumers are more comfortable with websites in their language. The ability to communicate in multiple languages can even be a critical factor the success of cross-border merger and acquisition deals.

56.2% percent of consumers say that the ability to obtain information in their own language is more important than price – The Globalization and Localization Association

Similarly Common Sense Advisory  polled 3,002 consumers in 10 countries finding a substantial consumer preference for native tongues, noting that people who lack confidence tend “to avoid English-language websites, spend less time during their visits, and not buy products that lack instructions or post-sales customer support in their language.”

21 May 2020

Security Shopping Based on the Lowest Bidder

Bang-for-buck is less about cost and more about strategic fit and operational value when it comes to email security

Overnight digital transformations in the wake of COVID-19 are pushing organizations to the brink of what their infrastructure can handle. In the case of large enterprises, with thousands of employees and offices around the world, actions as simple as sending an email can quickly become overwhelming – requiring new hardware, software and the IT staff to run it all. Consequentially, many organizations have had to rapidly upgrade and evaluate new technologies, in a cost-driven manner, to help bridge the gaps.

Yet, a new study by Echoworx reveals a disconnect between the immediate rewards of low initial price tags to actual long-term value amid growing security breaches and brand distrust. While cost remains a primary driver behind the decision-making process for information security shoppers, there is an alarming lack of other factors contributing to ultimate assessments of value.

Prepare for the next GDPR, align to the goals of business leaders

Meeting immediate business requirements is tempting for organizations operating under time constraints – it’s human nature. But focusing evaluation criteria for data protection on cost and business compliance, often results in adopting solutions that meet a narrow checklist of requirements or immediate needs. Theoretically this approach ensures the organization can maintain compliance, with minimal impact to their bottom lines, while preserving their ability to compete in their new digital world.

But it is not that simple.

Adopting a checklist strategy for protecting data sent through email does not anticipate unexpected turns or developments down the road. Regulations, or other security demands, are known to change without warning – suddenly adding more boxes needing to be checked off. While a low-price tag might create initial attraction to a security solution, organizations need to ensure it is flexible enough to accommodate new demands and the impact it can have on innovation and their strategic vision.

Introduced in the spring of 2018, the General Data Protection Regulation (GDPR) of the EU, for example, revolutionized the way organizations were able to capture, store and exchange the personal digital data of the citizens of affected European nations. Yet, less than a year later, in January 2019, Denmark introduced more literal interpretations of the new GDPR, making encryption mandatory for all sensitive data overnight – including data sent in emails. For organizations not set up to accommodate this new Danish development, conducting business in Denmark became incredibly difficult.

Opt for value optimization instead of short-term cost impact

More than 50 per cent of CIOs from banks and insurers operate their IT environments in a cost-inefficient way, according to Gartner’s cost value matrix. Another report by Forrester found that cost is, by far, the highest consideration of decision-makers shopping for an email security solution. But respondent also touched on other considerations seemingly unrelated to cost, with unquantifiable benefits, like customer impact, listed as important determining factors. This suggests that the actual business value of email protection is not set solely by the lowest possible initial investment – and is instead a value-for-money equation.

And this value equation can be played out in various scenarios.

According to Siddharth Deshpande, former-Research Director at Gartner, organizations continue to see the additional value brought by security solutions – in addition to the security they provide. “Security leaders are striving to help their organizations securely use technology platforms to become more competitive and drive growth for the business,” says Deshpande, as reported by Forbes.

If the solution is chosen on account of cost, without consideration being paid to a mix of business needs, the result may meet the tactical requirements set by IT but could be detrimental to the business on account of a poor or overly rigid customer experience, for example.

Digitalization will lead to the value-for-money

We need to remember that any digital tool on the market is designed to replace a clunky offline process – email data protection tools are no exception. Decision-makers need to keep business use cases top-of-mind when shopping for email security tools that help with digital transformations. Cost means nothing if a tool does not do what it’s supposed to do or proves detrimental to business flow.

A bank, for example, might need to send millions of secure financial statements to their customers at the end of each month. While this might normally be done using post, requiring reams of paper and expensive postage, an email data protection solution can enable them to send digital copies to customers faster and at substantially lower costs. Checkbox marked. But the true cost-efficiency is only realized if the same solution can handle the intensive demands and mass distribution of virtually unlimited encrypted documents – not hinder it.

And our new digital world appears to be here to stay, with 74 per cent of CFOs toying with the idea of increasing remote work capabilities after the current global pandemic passes. While others, like Twitter, already publicly stating, “If our employees are in a role and situation that enables them to work from home and they want to continue to do so forever, we will make that happen.”  But ensuring that these workers can do all their work from home, requires security. Analysts are predicting further investment into IT solutions to accommodate this increased demand for remote work.

Reap the benefits of digital transformation by smarter spending

Initial costs of an email data protection solution can be misleading if their business value over time is not considered. If the technology is effective at adapting to various business use cases and securing vulnerabilities, without detrimental impacts to customer experience, initial monetary investment can quickly become irrelevant.

Even a higher initial investment into encryption technology can be offset by less investments into maintenance, hardware, or software upgrades. This can lead to substantially shorter payback periods and allows for valuable IT resources to be allocated to other projects.

Further supplementary cost savings can also work over a period to make the solution more valuable. A more valuable security tool, for example, might grant access for users to self-help resources or access to third-party specialists to help navigate any user confusion. Mitigating the costs of email related help desk queries alone can save organizations hundreds of thousands of dollars.

An investment in email data protection, based on stakeholder needs and strategic fit, will lead organizations into value-for-money.

01 May 2020

Who Controls Your Encryption?

Security controls how our property is used, who has access to it and keeps it safe. But what happens to this secure sense of control when property and data goes beyond your reach – outside your digital perimeter?

Here are some points to consider when evaluating encryption options for email data protection – without relinquishing control:

Meets compliance needs 

Under international privacy rules, like the GDPR, non-compliance can lead to massive fines you can’t afford. And, while delivery methods like TLS or PGP are effective for protecting data in transit and end-to-end, they do not accommodate every situation – additional options are needed. If a TLS connection is not available, you may want automatic fallbacks to another secure delivery methods, such as via web portal or as an encrypted attachment – ensuring sensitive data always remains protected.

Automates processes

Encryption is a feature of any serious cybersecurity design – but real world application still lags, according to Echoworx data. When a platform is not user friendly and encrypting a message is difficult, there is a tendency for senders to favour the path of least resistance – sending sensitive data without protection. Setting proactive encryption policies in motion not only makes encryption mandatory based on pre-set rules, but also improves platform usability by automating a sometimes-confusing process. Take inbound encryption policies, for example. When a customer sends an organization sensitive information, like a credit card number, over an open or unrecognized channel, there is a chance existing email filters might flag and block their message for reasons of compliance. By setting inbound encryption policies, incoming emails containing sensitive data are automatically encrypted, before being delivered to a recipient’s inbox – safe, sound and compliant.

More secure ways to email

From the choice of email service provider to something as simple as a device-type, there are a variety of ways recipients might be inadvertently controlling their encryption experience. This unintended result can prove detrimental to their user experience – especially if there are better encryption delivery methods for their situation. Using proactive policies, your organization can push secure delivery methods tailored to specific customers. You might, for example, set policies which restrict TLS to trusted partners only – or employ attachment-only encryption for secure statement delivery.

Consistent experience for everyone

Part of a true streamlined user experience relies on a consistent user experience – regardless of device, location, location or connectivity. An encrypted message experience, for example, should offer the same user experience regardless of whether the secure message is accessed on a desktop computer or offline via a mobile device – without the need for third-party apps. This same consistent user experience also helps streamline working within collaborative environments. Common business scenarios, for example, often involve engaging with a sensitive document across multiple devices and environments. Is the document going to look and act the same offline and online? If working collaboratively on a sensitive encrypted document, is the user experience identical for all parties involved?

Recall email when needed

The ability to recall a compromised message even after it has been read, is a simple, yet fundamental feature enabling control of an encryption experience. Whether a message is sent to an unintended recipient or whether a message is no longer safe, control over a message shouldn’t have to be relinquished just by pressing ‘Send.’

Brand Safeguards

Branding and the separation of brands is crucial to any enterprise. The ability to brand, separate and segment customer interactions according to brand can mean anything from how a secure message is received to a preferred language. Different brands should also be siloed to prevent eavesdropping from other business units.

By Derek Christiansen, Engagement Manager, Echoworx

27 Apr 2020

Multi-Factor Authentication Is Redefining Digital Business

Why risk everything on someone’s poor password habits? Multi-Factor Authentication (MFA) is quickly becoming the new norm for verifying people are who they say they are before granting access to digital assets.

Yet there remains a certain reluctance to implement MFA on account of its supposed detrimental impact on the user experience. But MFA has come a long way from its clunky beginnings two decades ago – making it easy for everyone except attackers.

Easy to use

When people think of MFA, they usually think of the authentication system in its most extreme form – requiring a combination of disconnected physical tokens, location-based factors or USB keys which must always be carried on your person. Some of these more-severe MFA systems are designed to be difficult so that organizations can be sure, without a doubt, that users requesting access are who they say they are. While these factors are still used at organizations requiring more robust security protocols for their digital access points, today there are frictionless factors available for a streamlined user experience.

An organizational portal, for example, designed to grant access to sensitive communications, can be set up to require as password for a first factor and a Time-Based One-Time Password (TOTP) – a single-use, soft-token and time-stamped random code – issued from a third-party SaaS app installed on the user’s mobile device as a second factor before access is granted. With the app-issued TOTP, an additional authenticating factor is added with little change to the user experience.

Hard to compromise

A password is only as strong as it is complex – and even the most complex password can be cracked. But people are notorious for choosing weak passwords, reusing old ones, and even using the same passwords for multiple points of access regardless of sensitivity. According to Verizon, 81 per cent of breaches in 2017 were due to weak or stolen passwords. By asking for additional factors of authentication, MFA ensures that even if a weak password is compromised, access is still denied.

In this way, MFA also acts as an effective deterrent to malicious actors. Consider, for example, that half a per cent of Azure Active Directory accounts used by Office 365 are compromised every month – that amounts to a yearly total of 600 compromised users at an enterprise composed of 10,000 accounts. Gartner says an organization which adopts MFA can see a figure like this drop 50 per cent by the end of 2020.

Works well with others: the case of Maersk

Large enterprises undergoing digital transformations are investing in cloud-based SaaS providers to help them bridge gaps in their massive tech stacks. Take Maersk of Denmark, for example, the world’s largest shipping empire, who’s ‘cloud-first’ policy means they outsource tasks and services which are not directly tied in with their product.

Rasmus Hald, Head of Cloud Center of Excellence at A. P. Moller – Maersk, told Computer Weekly, “Why in the world would I run an email system in the year 2019? You might have constraints, like legal requirements [that stop you], but if you don’t, why would you have the hassle of running an email service when you can buy great services off the Internet that probably give you a better service than you would every be able to provide yourself? [Our philosophy at Maersk is to] buy other people’s software as a service and then focus our efforts on building great software for our users, [and] for our customers.”

But with more third-party connections come more opportunities for malicious agents to gain access to organizational networks. This is what makes MFA such an important feature to look for when choosing a SaaS partnership. If MFA mechanisms are in-place, then a higher degree of security can help mitigate any authorization vulnerabilities outweighing the benefits of the service provided.

Perimeterless

Digital transformations enable organizations to be available anywhere and anytime to better serve customer bases across the planet. For an organizational leader, this customer-centric digital world is good for business. But for someone in charge of internal organizational IT infrastructure, a fully digital connected cloud-based environment, where sensitive data is flowing, SaaS providers are plugged in and users are mobile, can be a nightmare without help – especially for sensitive processes like authentication.

MFA can help an organization prepare itself for perimeterless cybersecurity postures in a zero-trust world – where every user needs to be vetted before access is granted. Gartner says, as digital organizations continue their digital transformations, they are going to begin relying less on traditional digital security tools, like VPNs, firewalls and hardware, and focus more budget on securing users outside their digital environment. With its ability to authenticate users more accurately according to various digital factors, MFA is going to play an important role in perimeterless security solutions.

By Alex Loo, VP Operations at Echoworx

15 Apr 2020

Goodbye Algorithms, Hello User Experience

Leading firms are revamping decades-old debt-heavy data protection technologies and processes to provide more productive experiences.

Most email data protection systems use the same encryption algorithms and specs; almost all contemporary email security products feature 2048-bit RSA encryption, 256-bit AES encryption and SHA2 signatures. There’s nothing new about that – it should be a given.

But not all solutions designed to protect data sent though email are easy for everyone to use – and that’s where user experience scores the winning goal.

Data protection only works if we put people first

We recently surveyed IT professionals and IT decision-makers and found that, while email data protection is a priority for most organizations, less than half of organizations with encryption software use it extensively. This often comes down to user-friendliness; it’s nearly impossible to roll-out a security feature that doesn’t integrate seamlessly into existing workflows. When searching for an email data protection solution, carefully consider the processes that come with the product and let a user-friendly secure communications experience differentiate you from the competition.

Keep email protection simple for everyone

Enterprises today are focused on flexible integration and customization – to provide more access across their entire business.

Popular with clients and staff:

  • Smooth and simple to use – Customers and employees tend to take the path of least resistance. Look for a secure communications system which makes protecting data in transit the path of least resistance. A recent case study by Echoworx, for example, enabled a U.K. bank to instantaneously reach its entire mortgage customer base during a time-sensitive emergency without changing the light look and feel of their regular customer communications. Communications could be sent via email as per usual, but with any sensitive information being packaged into protected secure encrypted attachments.
  • Customizable preferences – For international organizations, excellent customer experience includes on-brand communications in your client’s preferred language. Did you know that 79 per cent of people take less than 30 seconds to evaluate the safety of an email? This means off-brand but legitimate secure emails from your company can easily be categorized as spam, decreasing your organization’s digital trustworthiness. Even the most-secure communications should allow you to set language policies to automatically apply to secure communications based on sender, brand, locale and receiver attributes.
  • More ways to send secure email – Not every business use case is the same, so you need to ensure your email data protection solution if flexible enough to adapt to different conditions. While TLS remains a primary secure method of protecting data in transit, for example, what if a TLS connection is not available? In addition to providing fallback options, ensuring no sensitive message goes undeliverable or, worse, is sent in the clear, having access to multiple secure delivery methods gives more choice to both senders and recipients in how they choose to communicate with one another.

 

Popular with administrators and support:

  • More control over email security – Definable policies control which communications get protected (and how) based on message content. This is set up during implementation of an email data protection system—based on your needs and best practices—to be triggered by common message attributes, like subject, keywords, message type or recipient domains, for examples. Flexible controls for every scenario allow you to create a customized user experience for senders and recipients and stay in control of encrypted messages in transit and at rest.
  • Recall sensitive email – Whether a recipient is compromised, or a secure message is sent to an incorrect address, the ability to recall an email containing sensitive information is an important feature of any best-in-class email data protection system. Recipients should also be given the option to reply in a secure manner to any encrypted message.
  • Prevent unauthorized access Modern non-invasive Two Factor Authentication (2FA) options can accurately verify the identity of users before they are granted access to secure information. For access to a secure message portal, for example, a user can be required to provide a Time-Based One-Time Password (TOTP) – a random single-use, time-stamped soft token issued from a third-party SaaS app installed on a user’s phone – in addition to a username and password before access is granted.
  • Send unlimited email – For large enterprise organizations, numbers of recipients for mass communications pushed to customer bases can be in the millions. When the contents of these messages contain sensitive information which must be protected, like a bank statement, existing communications infrastructure needs to be able to scale to sudden bursts in activity without being overwhelmed.
  • Get full value on investment – With the right secure communications solution, your organization can provide a user-friendly experience—and save money. For example, a recent Forrester study, revealed that a typical enterprise-level organization using Echoworx’s OneWorld email data protection platform can expect an ROI of 155 per cent—with upwards of $2.7M in cost-mitigating benefits and a payback period of seven months.
  • Increase organizational use – According to Echoworx data, despite over half of IT professionals and decision-makers identifying email data protection as very important, even critical, to their organizations, only 40 per cent of the same group are using encryption technology extensively. When working with a third-party SaaS provider, you gain access to their team of experts and, paired with a simple interface and clear instructions, this can mean a streamlined UX – meaning less calls to your help desk and more successful and widespread implementation.

 

Offer email protection to everyone

While access to secure lines of communications is essential for any business, the reasons for email data protection vary. Verizon’s 2019 Data Breach Investigations Report[1] breaks down security incidents by industry, size and concerns. Here are a few takeaways:

  • Financial services and insurance – Use MFA, including 2FA or the European Central Bank (ECB)’s ‘Strong Authentication,’ for all customer-facing applications, train your employees on how to risky exchanges of sensitive data and set up secure communication controls to reduce the risk of insider threats and other communications-related vulnerabilities.
  • Healthcare –Ensure healthcare staff can safely send and receive sensitive documents containing patient information, which is protected under regulations like the Health Insurance Portability and Accountability Act (HIPPA).
  • Manufacturing – From sensitive data changing hands during an M&A deal to communicating personal details with customers to something as simple as exchanging trade secrets with a trusted partner, there are many instances where manufacturing organizations should be leveraging email data protection solutions.

It’s now a given that every industry has data it needs to protect. But how this data is communicated safely – packaged, sent and received – determines the experience for everyone.

In the end: People want safe communications, not usable cryptographic algorithms.

By Michael Roberts, VP Technology at Echoworx

[1] https://enterprise.verizon.com/resources/reports/dbir/

14 Apr 2020

Encryption Expands, but Gaps in Adoption Raise Concern

Global information technology leaders tend to focus too much on senior executives at the expense of other business areas raising concern and vulnerability.

A strong majority of IT leaders are deeply concerned with security and have adopted some level of protections for data being sent through email, a study by industry encryption leader Echoworx has found. However, a distressing 13% of the largest firms [with more than 10,000 employees] were not encrypting their sensitive communications despite the steady rise in attempted security intrusions.

“Cyber criminals, hackers, agents of industrial and government espionage all see unprotected email as an easy target,” said Echoworx Director Market Intelligence, Jacob Ginsberg. “In the first half of last year over 4.1 billion records were compromised as a result of security breaches, with a stunning 70% of those breaches being email related.”

Protection efforts are unevenly focused

In collaboration with Pulse, an online research hub for chief information officers, Echoworx surveyed 100 Chief Information and Chief Technology Officers (CIOs, CTOs) from North America, Europe, the Middle East and Africa.

As a pioneer in email data protection, Echoworx has researched attitudes toward protecting information and files sent using email for two decades. As early as 2004, it found that while 68% of IT executives had concerns about email privacy, fewer than half had developed a strategy using encryption to protect it. By 2016, 63% of firms had developed a strategy. The 2020 study found that 83% have now done so.

The rise in those top-line numbers has been encouraging but further questioning exposed protection efforts are unevenly focused. The tendency to limit encryption to the top of the corporate pyramid, was noted, leaving vulnerabilities to data and files communicated through email in key areas including HR and payroll, product development, finance and more.

Asked how they were prioritizing the use of encryption, IT leaders said they had prioritized high-level internal messages (26%) followed by sensitive third-party data (24%), protected/regulated data such as medical or credit info (16%) and then intellectual property (10%). But when asked where they were prioritizing the access to encryption, IT leaders see Security, IT, and Engineering departments as being most in need of protection.

However, sensitive data and are shared through an entire firm and with third parties, by practically all business lines and departments in emails. The more limited email data protection and security are throughout an enterprise, the more at risk the company is for email breaches. That calls for a more collaborative and holistic approach, where the protection of data is available for all employees who may handle sensitive data.

…when adopting a ‘zero trust’ strategy – for all messages both internal and external – you have to extend protections throughout an organization … to everyone. – Director Market Intelligence, Jacob Ginsberg

Encryption reserved to select few

That’s currently not happening. Respondents said technology solutions for email data protection were often directed toward the top tiers of an enterprise, even though the measures could benefit whole companies. In most firms, respondents said using encryption to protect email was reserved for the “leadership”, “senior executives” and that it was “based on hierarchy.”

“IT leaders tell us they need to change the mindset, that enterprises need to take a more collaborative approach to address the gaps in email data encryption strategies,” said Jacob Ginsberg. “It’s essential to protect top executives’ communications, but when adopting a ‘zero trust’ strategy – for all messages both internal and external – you have to extend protections throughout an organization … to everyone.”

When building a zero-trust security environment, those who make purchasing decisions should evaluate the all network communication taking place in an enterprise, Ginsberg said. But among respondents, 59% said they had dedicated teams that study email security purchases, 31% said such decisions were made based on cross-department consultations, and a surprising 9% said that decisions were made solely by top executives.

Whose making purchasing decisions? A surprising 9% said decisions are made solely by top executives

Procurement missing the mark on zero-trust security

And even when procurement is a team decision, further questioning found it is often by one that doesn’t reflect the businesses diverse activities: 54% of respondents said the purchasing team were from a single department, while only 46% said purchasing team members included several departments.

“When protecting a company’s assets, most in the industry agree that more needs to be done to improve email security,” said Jacob Ginsberg. “Yet, this study shows that more needs to be done to ensure that email security technology decisions are balanced between the requirements of the whole business and the requirements of the security team.”

For the full insights, Echoworx has produced a one-minute white paper on the survey, asking CIOs how they think their encryption strategies stand up against today’s digital reality.

By Lorena Magee, VP Marketing at Echoworx

31 Mar 2020
Encryption Isn’t Just for Financial Services

Enterprise Encryption Hits All-Time High

Bank, financial service and insurance (BFSI) institutions may be the overwhelming past  juggernauts of secure communications, but they are by no means the sole future of this growing necessity – where information security spending is forecasted to exceed $170.4B in 2022.

Information security is becoming a keystone of any customer-centric business plan – and, in some cases, even mandatory – regardless of industry.

Encryption is no longer an add-on

As early adopters of encryption, BFSI organizations marketed their secure document delivery systems as ‘environmental-friendly’ or ‘postage-saving,’ with more onus put on the customer as an optional add-on. But in addition to streamlined, tree-saving digital features, a more substantial societal embrace of digital delivery methods has given rise to new regulations with teeth paired with expectations that sensitive personal data is being protected. Consequently, over 50 per cent of encryption adopters today, according to Echoworx data, state compliance as a primary reason for implementing an email data encryption strategy. A study by multinational law firm, DLA Piper, reports there have been over $126 million in GDPR fines since the General Data Protection Regulation went into effect in May of 2018.

Data encryption hits all-time high

While BFSI organizations continue to be the more-prominent adopters of encryption, accounting for a healthy 50 per cent stating extensive use in a recent Ponemon study, other industries are beginning to take note. In fact, according to the same report, manufacturing and transportation organizations are not far behind – accounting for 47 per cent respectively.

This changing trend isn’t a trend at all – but rather an evolution of how we protect data. As a tool of customer stewardship, encryption is a way for all industries to demonstrate that they value and care about the personal data of their patrons. As a mutually beneficial relationship, the resulting digital customer trust encourages consumers to continue conducting business while enabling an organization to effectively collect adequate amounts of data without compromising their integrity – resulting in better customer service.

Echoworx recognizes that the world of encryption is becoming more three-dimensional and varied in terms of its business use cases. In order to accommodate the mosaic of industries set to explode into the encryption market, we offer a wide array of flexible, scalable and user-friendly email data protection solutions to streamline any business process.

Ten ways encryption is being used across departments to protect data in email

Changing views on privacy

From the introduction of encryption to popular instant messaging app WhatsApp in 2016 to headline grabbing violations of international privacy regulations, like the massive €400K fine issued to Uber France for their fumbling of sensitive personal data, consumers are now more aware of and concerned for protection of their personal data.

And yet they continue to provide their most precious digital details with little prompting – less prompting than needed for them to disclose their address to a first date, according to Echoworx data. But, if digital customers are easy to get, they are even easier to lose after a data breach and impossible to get back. So why take chances with their data?

According to a recent PwC report, strong levels of digital customer trust are a keystone of any customer service plan. In terms of sharing data, for example, 88 per cent customers who trust an organization are more likely to provide accurate, reliable and consistent personal data. This, in turn, provides more information with which an organization might fine-tine their customer service program.

At Echoworx, we know that offering a streamlined encryption experience is not only good for customer experience – it helps bolster the levels of digital trust needed to build effective business relationships. As more industries go online and digital, this trend is set to occupy a more prominent role in most business use cases.

Fine-tuning the customer experience to align with enterprise goals and expectations

International regulations demand encryption

By now we know the General Data Protection Regulation (GDPR) of the EU is spurring governments to take matters of data privacy seriously. But did you know that EU citizens are protected by the GDPR regardless of where they live or work? Did you know that Danish interpretations of the GDPR mean encryption is now mandatory for all business in Denmark? Did you know that the UK’s National Health Service (NHS) is eliminating fax machines completely?

Like it or not, organizations looking to compete internationally are going to have to adopt proactive data protection policies, like encryption, into every process. At Echoworx, we realize this can be complicated for massive international organizations sending out millions of sensitive messages a year. That’s why we have data centres located in six countries – including locations in the EU zones.

And it’s not just about the EU!

Encryption is a part of everyday conversation

While legacy on-premise encryption solutions might continue to dominate the market to the end of the decade, cloud-based encryption continues to grow. In fact, according to a recent Ponemon study, encryption in public cloud services grew over 10 per cent in 2017 – the highest year-over-year growth of any encryption use case observed in the report. We expect this trend to continue and grow stronger.

At Echoworx, our scalable and flexible email data encryption platform and worldwide presence are prepared for this cloudy new world. Our team of experts can help you migrate your on-premises encryption infrastructure to the cloud without any business disruption.

In addition to gaining the benefits of multiple delivery methods, branding and language options and other natural extensions to your existing system, there are additional cost mitigating benefits of working with Echoworx in the cloud. According to a recent Total Economic Impact™ study of Echoworx’s OneWorld encryption platform, conducted by Forrester Research, additional value can be unlocked by working with us as a third- party provider – including cutting down on overhead like support time and additional resources required to run encryption infrastructure in-house.

Read the full Forrester TEI study of OneWorld here.

Encryption is no longer just about saving paper on bank statements – it is becoming a part of everyday conversation. From international privacy regulations to customer service to actual customer expectations, encryption is no longer an option – regardless of industry. Be prepared – be proactive – talk to us today.

By Nicholas Sawarna, Sr. Content Marketing Specialist, Echoworx

———

Sources:

  • Gartner Information Security Forecast – 2019 | Ponemon Global Encryption Trends Study – 2019 | PwC Report – Securing customer trust

24 Mar 2020

Creating a Work-from-Home Business Culture Beyond a Lockdown

Vulnerabilities, from poor data hygiene to weak authentication, can be further amplified during times of crisis when some, or even entire workforces, may be working from home. Here are some quick ways to prepare employees for remote working conditions:

Communicate the importance of corporate data

Employees understand the value of personal identifying data, like a credit card number or SIN, but do they view corporate data the same way? According to Gartner, the potential harm of insider threats at banks, for example, can be the same, if not greater than threats of external nature. Organizations need to educate their employees on the importance of practicing adequate data hygiene when operating remotely.

Suspicious emails, even originating from internal users, need to be triaged to ensure their validity – especially when they contain strange attachments or vague context. Cybercriminals can compromise one account to enter a system before going after their actual targets. Known as ‘spearphishing attacks,’ these attacks can even originate via SMS.

To ensure outgoing data or sensitive information remains intact, employees need to be educated on the importance of encryption. Encryption is an effective way to keep the integrity of messages – to make sure only intended recipients have access. Offering a flexible suite of different ways to send securely, or even enforcing encryption via encryption policies, means secure messages are never rendered undeliverable or, worse, be sent in the clear.

Do they know how to use the video conference? Can they share files remotely? Do they know how to create a group discussion with their teammates? What if their laptop fails – is there a help number they can call? – President of Global Workplace Analytics

Teach the security basics 

As more workplaces move to employees’ homes, so does the business which they conduct. With the recent Coronavirus Disease 2019 (COVID-19), for example, businesses across the planet saw an immediate need for overnight digitization to nearly every business line. For Aviva UK, this meant pushing more of its customer service options online to take the strain off its call centres. The UK insurance giant explains on their website that following their government’s decision to encourage its citizens to work from home, they now encourage more customers to manage their accounts online via their app or by email as an alternative to calling.

But, from exchanging sensitive business agreements to delivering a tax return to something as simple as answering a customer query, there is going to be a lot of important data changing hands. Employees working from remote locations need to understand the importance of communicating this information clearly, safely and seamlessly with customers.

According to Kate Lister, the president of Global Workplace Analytics, as reported by The Washington Post, organizations pushing remote workplaces need to teach their employees everything down to the basics to ensure they follow proper organizational protocol. “Do they know how to use the video conference? Can they share files remotely? Do they know how to create a group discussion with their teammates? What if their laptop fails – is there a help number they can call?” said Lister.

90 per cent of all cyber threats originate with email – Gartner

Warn users of suspicious links

From strange pop-ups to emails originating from unknown senders containing links to malicious sites, phishing is a chameleon crime which can assume all shapes and sizes. And, according to a recent Gartner report, 90 per cent of all cyber threats originate with email – making phishing one of the most significant threats affecting contemporary digital business.

Any employee working remotely needs to understand the real threat phishing poses. Whenever they are working remotely, an employee should always question any suspicious link, even from their personal email if they are working on a personal computer. Encryption should always be applied to any outgoing messages containing sensitive information.

According to Nicole Coughlin Raimundo, the CIO for the Town of Cary, a tech hub in North Carolina, as reported by CNBC, on account of the COVID-19, whose initial outbreak forced the majority of American firms to immediately explore digital alternatives to physical workplaces, she’s seen an uptick in phishing campaigns targeting remote employees. “As part of our work-from-home guidance, we’re continuing to encourage staff to be vigilant and exercise extreme caution when clicking on outbound links,” Raimundo said.

Use strong authentication and passwords

While complex passwords, paired with usernames, are a common go-to for organizational authentication, they are quickly becoming obsolete. To combat this growing issue of authentication, organizations are now demanding established and tested Multi-Factor Authentication (MFA) methods for verifying users are who they say they are.

In addition to educating employees on the importance of password complexity, organizations need to ensure adequate MFA systems are protecting their digital gates. Echoworx, for example, can employ policy-based MFA to ensure recipients are who they say they are before they are granted access to an encrypted message. In an age of zero trust, where anyone connecting to a digital system needs to be verified, MFA is an adequate safeguard.

Passwords can be weak and security questions such as “what is your mother’s maiden name?” – can be easily cracked.

Secure connections to prevent eavesdropping

A public wi-fi network can be a honeypot for employees working remotely. Whether they are installing themselves at a local coffee shop or just quickly checking their email on their mobile device, there are various reasons for connecting to a public wi-fi. While most public wi-fi connections may be perfectly safe, they should be avoided for the mere reason that they are easy to monitor – and may even be set up by malicious actors to collect information, from logins to personal data.

In addition to only working on trusted networks, employees should be connecting to a company-instigated Virtual Private Network (VPN). A VPN works to route a device through a private server, so that any data transmitted is sent via the VPN rather than from their personal device.

Build strong firewalls and update security software

As a first line of security, a firewall paired with up-to-date security software, protocols and other preventative measures is a must for employees operating remotely. In addition to repelling attacks, or at least discouraging them, providing employees with the tools they need to practice proper data hygiene can enable them to identify and prevent security issues from becoming vulnerabilities for an organization.

Implement a BYOD policy

The Bring-Your-Own-Device (BYOD) culture is an inevitable feature of digital business. As more employees work remotely, there is an increased demand for them to use their own machines. But before they connect to company networks, and access company data, their devices need to be vetted, updated and secured by IT departments. This ensures that the computers, smartphones and tablets they use to connect to an organization are not going to pose vulnerabilities.

By Wen Chen, Senior Manager IT and Customer Support at Echoworx

26 Feb 2020

Nordic Countries Score Huge Tech Successes, but Worries About Cybersecurity Mount

The Nordics have become a hot spot for innovation, producing technologies that have reshaped global industries, but governments and industry groups have been cautioning that the region’s phenomenal success could be threatened by weak cybersecurity

When people think of Nordics, they may visualize lands of elk and reindeer, but perhaps they should also be imagining “unicorns,” those rare start-ups that attain a valuation of US$1 billion. With just over 27 million people, the Nordics of have been punching above their weight when it comes to producing innovative tech firms.

The Nordics – comprised of Denmark, Finland, Iceland, Norway, and Sweden – was already home to some of Europe’s largest legacy technology firms, including Ericsson, Nokia and Telenor. This has provided a foundation for start-ups that are relatively small, nimble, entrepreneurial, and with high growth potential.

Although most Nordic unicorns are unfamiliar to the public – with firms in areas like FinTech gaining large market share without much global attention – others have become household names. Skype helped make long-distance charges a thing of the past. Spotify shattered the dominance of Apple’s iTunes. Rovio Entertainment, creator of Angry Birds, boasts more than 4.5 billion downloads of its apps.

It’s been said jokingly that the region’s long winters have encouraged technology development as people don’t want to go outside, but more important factors are those that it shares with other innovation hotbeds – such as Silicon Valley, Singapore and Israel. These include open economies, a global outlook, regulatory support, high personal incomes, and highly educated populations.

The World Economic Forum’s most recent Global IT report ranked Finland, Sweden and Norway among the top five countries in terms of “network readiness” – sandwiched between number one Singapore and the U.S. at number five. That makes them among the world’s top locations in terms of the overall environment for technology use and creation, infrastructure, affordability, skills and technology adoption.

We’ve invested in multiple high-growth countries and regions globally, but few have as many advantages or inspire as much confidence as the Nordics – Echoworx Senior Director Market Intelligence Jacob Ginsberg

“The dynamism of Nordic companies is just exceptional, and the talent in the region is amazing,” said Jacob Ginsberg, Senior Director Market Intelligence of global email data protection leader Echoworx, which recently introduced Nordic languages to its message encryption platform and support network. “We’ve invested in multiple high-growth countries and regions globally, but few have as many advantages or inspire as much confidence as the Nordics.”

Success attracts Cybercrime

As could be expected, the success of the Nordic tech firms has made them a tempting target for cybercriminals, industrial espionage, and even hostile foreign governments.

Nordic firms are acutely aware of the risk of lax cybersecurity. In KPMG’s 2019 CEO survey, 21 per cent of Nordic CEOs rated cybersecurity risks as the top threat to their business while another 19 per cent said their top risks stemmed from emerging and disruptive technology.

The consultancy also found that 65 per cent of Nordic CEOs believe that becoming a victim of a cyber-attack is a case of “when,” not “if” and that 72 per cent view information security as being of strategic and competitive importance.

KPMG’s 2019 Global CEO Outlook | Nordic Executive Summary

 

Recognizing the threat, business organizations and governments have launched multiple initiatives to help enterprises’ technical and financial barriers that may hamper critical data security and business integrity. However, both industry and government say there is still some way to go.

The Danish Business Authority (DBA), for instance, has identified cost as the single biggest factor impeding firms from strengthening their IT security defences. The industry group estimates that as many as 30 per cent of all small to medium-sized enterprises (SMEs) are “acutely vulnerable” to malicious malware attacks.

Meanwhile in Norway, a YouGov survey for the Oslo-headquartered Norwegian Center for Information Security (NorSIS) found that complacency and over-confidence are a major concern, describing the finding as “deeply troublesome.”

… so few Norwegian companies seem to recognize the actual extent of the risk they face from cyber space – NorSIS director general Peggy Heie

“What is extremely worrying from the survey is that so few Norwegian companies seem to recognize the actual extent of the risk they face from cyber space,” NorSIS director general Peggy Heie, told the media.“Company leaders cannot expect partners and authorities to take all the responsibility for the protection against cybercrime.”

Part of the issue is that while Nordic organizations have a high level of digital maturity, the regions Chief Information Officers (CIOs) have tended to focus on optimizing their existing business processes.

In back-to-back annual surveys of Nordic CIOs, global research and advisory firm Gartner found that while they are well positioned with streamlining internal processes, they tend to be back-office focused. As they lack strong relationships with external customers or stakeholders, they are less likely than their international peers to recognize external disruptive factors.

But this tendency toward complacency may be changing quickly. Tech consultancy IDC has forecast that Nordic IT services spending will grow from $24.4B in 2018 to $29.5B in 2023. However, in spite of forecast growth, the consultancy noted that international vendors seeking to enter the market will still need to up their game and deliver tailored advice and hands-on project services.

“Our experience on the ground is very much in line with the IDC forecasts and recommendations” says Echoworx’s Ginsberg. “Even though there is growing demand, Nordic CIOs want services tailored for their needs, including things like true local-language functionality and support services, as well as solutions that can scale to suit everything from two-person startups to ten-thousand-employee conglomerates.”

Echoworx this month announced the expansion of its European footprint with Nordic language support.

By Lorena Magee, VP Marketing at Echoworx

20 Jan 2020

How a Choppy Merger Can Hurt Your Acquisition

Adequate preparation, due diligence and stable execution are necessary for smooth mergers and acquisitions. Failure to do so can result in a choppy path – with potential to hold back, delay and hurt any resulting M&A deal. Often overlooked in the M&A process, issues surrounding digital synchronization and cyber security can be major contributors for a bumpy transition. Here are some digital reasons why an M&A deal might go sour:

A lack of digital protection increases digital risk

Despite their devastating effects on almost every facet of business, even some of the biggest data breaches continue to go undetected throughout high profile M&A deals. In addition to their immediate damage to a deal’s value, an unnoticed data breach can literally poison another organization’s digital infrastructure upon integration. And the longer these breaches go unnoticed the more pronounced (and expensive) their effects.

Take the now-infamous Verizon/Yahoo! acquisition, for example. In 2017, Verizon acquired Yahoo! before realizing their new addition had suffered several breaches just a few years prior. Aside from nearly derailing the entire deal, the result saw a $350M reduction in purchase price, a $35M penalty dished to Yahoo! from the U.S. Securities and Exchange Commission (SEC) and a subsequent $80M paid out through lawsuits to disgruntled shareholders and customers.

But hunting for a history of data breaches is more than just Googling the name of a target organization and hoping nothing comes up. You must go deeper, and you must think outside of the box. In addition to looking for an actual breach, you need to consider potential for a breach and how a lack of comprehensive cyber security safeguards might put your data at risk during a tentative integration process.

For sensitive M&A communications, for example, you need to ensure any valuable information being exchanged, from trade secrets to internal agreement documents, is protected with adequate email encryption safeguards. To help insulate your organization from risk during the M&A process, Echoworx offers an encryption solution with six flexible delivery methods and additional security tools, like message recall.

Why take a chance with your most-valuable company data. Can you ensure that any sensitive email sent, for a wide range of reasons, never goes to a recipient unencrypted?  

Legacy technology slows M&A deals

Unanticipated delays brought by poor synchronization with legacy digital equipment during an M&A affects your bottom line, your customer experience and exposes your system to vulnerabilities. Before signing the dotted line in your M&A deal, consult your IT department to anticipate any possible digital snags. This ensures when it’s time to integrate, there won’t be any major digital holdups or service interruptions for your customers.

If you do find outdated technology, or incompatible technology, third-party cloud-service providers can help bridge the gap. You might, for example, be a bank with customers in Denmark, where encryption is mandatory under the General Data Protection Regulation (GDPR) to conduct business. You cannot take a chance on a target organization with a legacy on-premises encryption platform. But what if you lack the time or resources to upgrade and upload their email infrastructure to your cloud?

OneWorld encryption platform easily migrates any legacy message encryption process to the cloud. As a Software-as-a-Service (SaaS) provider, our dedicated team of encryption professionals do all the heavy lifting – so you don’t have to. A problem which might have taken your IT department time, money and resources to solve is literally done at the click of a button.

Here’s how it works:

Simplifying Post-Merger On Premises Encryption | Watch Now

Non-compliance is closing business doors

You might know the rules of your market and you know the potential value of acquiring or merging with a target organization. But how much do you know about their industry? Are they prepared for and working within the rules of the laws and regulations which affect their industry or geographical area? Or, alternatively, if they do not protect data in their jurisdiction, do you really want to risk trade secrets being intercepted?

In the United States, for example, you might be looking to expand your bank across the country by acquiring established financial hubs in each of your target states. But is your target organization in California prepared for the recent California Consumer Privacy Act (CCPA), which came into effect January 1, 2020?

To keep data safe and compliant in transit under various rules, privacy laws and regulations, you need a flexible encryption solution which can quickly to any regulatory environment. Even if there are no rules, or your target cannot support encryption, there are delivery options to accommodate.

Human error is an M&A liability

From unintentional attacks by inadvertent threat actors to deliberate internal sabotage, human error continues to play a part in 95 per cent of all security incidents, according to research by IBM. And users of webmail services continue to be primary culprits contributing to this problem – sometimes without even realizing it. But human error is hard to anticipate, near impossible to fix and can happen to anyone.

Take the United States Marine Corps, for example. In 2018, this elite military organization, with all its defenses and vigilant staff, still managed to leak the information of about 21,500 marines, sailors and staff by inadvertently sending a non-encrypted email to an incorrect distribution list. You might dismiss this digital slip as a fluke, but, according to the Information Commissioner’s Office (ICO), an independent UK privacy watchdog, incidents of incorrect address information are actually quite common, accounting for 12 per cent of reported data security incidents alone in Q4 of the 2018/2019 year.

Sending a sensitive document doesn’t always have to be a complex process – one involving registration, more information, and additional authentication.

For an M&A process, where hundreds of back-and-forth emails between multiple parties and stakeholders contain sensitive information, from trade secrets to insider deal information, nothing can be left to chance. Since a single slip-up can mean the difference between a deal-signing handshake and a trip back to the negotiation table, organizations need to insulate themselves from human error.

A simple way to rectify human error for sensitive communications is to encrypt them – with secure vetted methods ensuring only intended recipients can view data or a message. But any encryption solution also needs to be flexible enough for day-to-day use. With our OneWorld encryption platform, for example, encryption can be made to fit any business case, from simple ‘Encrypt’ buttons to automatic encryption for certain message, recipient or attachment types.

By Jacob Ginsberg, Senior Director Market Intelligence, Echoworx

20 Dec 2019

CCPA vs GDPR: What’s the Difference?

In 2018, the business world shuddered as the General Data Protection Regulation (GDPR) came into full force. More shuddering is expected shortly with the California Consumer Privacy Act (CCPA) going into effect on January 1, 2020 – with enforcement measures beginning six months later. But what’s the difference between these two privacy acts? This article gives a high-level overview of the similarities and differences between the GDPR and the CCPA and why you need a flexible policy-based encryption solution to deal with one or both of them.

What is the California Consumer Privacy Act (CCPA)?

The CCPA establishes data privacy rights for Californian residents and it applies to businesses that sell products and services to California residents and collect information about them.

Under the CCPA, California residents have the right to:

  • Know what personal information is collected about them.
  • Know whether their personal information is sold or disclosed and to whom.
  • Opt out of allowing businesses to sell their personal information.
  • Access the personal information collected about them—in the last 12 months—in a user-friendly format.
  • Equal service and price, no matter what privacy options they choose.
  • Erase personal data collected (in some situations).

 

Under the CCPA, Californians can opt out of almost all secondary uses of their personal information including sale to data brokers, tracking and other uses not directly related to service delivery.

Here’s what banks need to know about this law.

What is the General Data Protection Regulation (GDPR)?

The GDPR establishes data privacy rights for Eurpean citizens (who may or may not be residents); it’s a uniform privacy law that applies across the Eurpean Union to protect its 512 million citizens. Companies that do business in Europe are subject to the GDPR.

Under the GDPR, Europeans have the right to:

  • Access their personal data.
  • Correct errors contained in their collected personal data.
  • Withdraw consent for data processing.
  • Stop automated decision making when the decision has a legal implication.
  • Withdraw the consent that allows businesses to sell their personal information.
  • Erase personal data collected (in some situations).
  • Access some personal information collected about them in a user-friendly format.

 

Similarities between the CCPA and the GDPR

Both acts give consumers access to personal data, the right to have companies erase some personal data, a way to opt out of having their personal data sold to third parties and claim damages through a private right of action.

Differences between the CCPA and the GDPR

The GDPR gives citizens the right to stop automated decision making when there’s a legal implication and the right to correct errors in collected data but these aren’t included in the CCPA. It’s hard to say which act is more aggressive with enforcement penalties. While the GDPR tops out at four per cent of a company’s annual global revenues, the CCPA allows fines of up to $2,500 per unintentional violation and $7,500 per intentional violation. Depending on the type of breach, those CCPA fines could add up quickly.

Advantages of the CCPA and the GDPR

For consumers, the advantages of the CCPA and the GDPR are clear: more privacy rights and the power to protect those rights through right of action damages and enforcement penalties. The advantages of the GDPR for business is that it’s one blanket regulation to conform to—which is easier than managing patchwork privacy. Imagine if every country in the EU had its own privacy regulations!

Challenges for businesses

American businesses don’t have to imagine patchwork privacy because it’s already happening with state privacy laws and laws governing cyber security, data security and data breach notification in Washington, Texas, Oregon, New York, New Jersey, Nevada, Maryland, Massachusetts, Maine and California. This means organizations that do business across America and Europe have an increasingly complex privacy landscape to navigate. Compliance must be built into the three Ps of business—people, process and products—because even sending an email is no longer simple.

National organizations, for example companies in banking, financial services and insurance, must adapt to and comply with new privacy laws because it’s unlikely the consumer data privacy trend will reverse itself.

Echoworx OneWorld: a flexible, policy-based encryption solution for GDPR and CCPA compliance

An enterprise privacy program covers everything from daily operations and compliance to policies, procedures and investigations. To build compliance across the 3 Ps of business, organizations must adopt a flexible, policy-based encryption solution.

OneWorld features that help enterprises navigate privacy laws including the GDPR and CCPA:

  • Definable policies – This allows you to control which communications get encrypted (and how) based on the message content. These policies are based on your needs, legislation and encryption best practices. Flexible controls for every scenario allow you to create a customized user experience for senders and recipients and stay in control of encrypted messages in transit and at rest. This policy-based encryption helps you stay compliant with privacy laws.
  • Easy and frictionless user experience – A recent Echoworx survey found that 53 per cent of organizations with encryption found it “too difficult to use.” OneWorld makes it easy for employees and customers to use, making encryption — and compliance — a consistent path of least resistance.
  • Enable inbound encryption – Emails with sensitive information—including protected personal information—are automatically identified, securely routed to the OneWorld web portal and encrypted. Encrypted delivery methods include TLS encryption, encrypted PDFs and attachments, certificate encryption and web portal encryption.

Here’s how it works with OneWorld:

Whether it’s the GDPR or the CCPA, encryption is considered an appropriate measure for protecting personal data—and it comes with financial benefits. A recent Forrester Total Economic Impact™ study showed that a typical enterprise-level organization using Echoworx’s OneWorld encryption platform can expect an ROI of 155 per cent—with upwards of $2.7M in cost-mitigating benefits and a payback period of only seven months.

Are you ready to make flexible, policy-based encryption—that’s also user-friendly—part of your compliance strategy?

By: Brian Cole, Senior Manager Security Operations and Support, Echoworx

09 Dec 2019

Protecting Trade Secrets: A Crucial Part of Mergers and Acquisitions

Under normal circumstances, you might hide trade secrets behind hardened firewalls under heavy coded locks. But what about when you’re amid a mega merger or acquisition? You need to share intimate details with a prospective buyer or learn about what a target has to offer. But you also need to protect the integrity of sensitive digital data – ensuring any trade secrets which leave point A arrive intact at point B.

To make this work, you need encryption. But you also need an encryption platform which offers the flexibility to accommodate different business situations while featuring effective risk mitigating security measures. This can be easier said than done.

Here’s how our OneWorld encryption platform can help:

  1. Definable message policies for automatic encryption

Mergers and acquisitions are delicate processes involving a lot of back-and-forth correspondence between various concerned parties. Depending how many parties, or people, are involved, things can get confusing fast. Malicious actors prey on this confusion to get what they want – valuable confidential information about your company, like trade secrets.

With our OneWorld email encryption platform, you can set definable policies to ensure encryption is automatically applied to sensitive emails or attachments. Based on a predetermined set of triggers, like keywords or attachment types or something as simple as a specific recipient, emails and their content, including your trade secrets, remain uncompromised.

Automize your email security.

  1. Multi-branding prevents M&A confusion

If you’re a large international company, chances are you operate under multiple brands, out of multiple offices or in multiple languages. This can be problematic when executing delicate mergers and acquisitions, where message authenticity is crucial. From trade secrets to secrets regarding the actual M&A process itself, a confusing encryption experience can open doors to thieves.

With support for multiple brands in up to 22 languages, our OneWorld encryption platform ensures all your encrypted communications look like they come from you. And an easy configurable drop-down menu allows your recipients to interact with your encrypted message in all offered languages. This reduces the potential for confusing, misleading or fraudulent communication.

Add multi-branding to your encrypted messages.

  1. Only intended recipients can read your messages

When negotiating mergers and acquisitions, at some point you are going to be sending confidential trade secrets and other sensitive information to a prospective buyer or partner. While providing these details over the phone, via snail mail or in-person might seem more secure – these methods simply don’t cut it in our fast-paced digital age. But sending them via email can be risky (and even illegal) without protecting the message with adequate encryption.

But how do you retain control over a message once you’ve hit ‘send?’ How do you ensure only an intended recipient sees the sensitive information in your message?

In addition to other password options, our OneWorld encryption platform allows senders to both set their own secure passwords, communicated via password hints or out-of-band to their recipient, or they can defer to a system-generated password system. Both methods ensure that even if an encrypted email is sent to an incorrect recipient, or if a recipient’s email system is compromised, access is not granted without proper password authentication.

Gain more control over encrypted communications.

  1. Detailed reporting to dot your i’s and cross your t’s

Picture this: You sent a confidential encrypted email containing trade secrets to someone crucial to your M&A process. But somehow that email has been misplaced, they’ve forgotten their password for access, or you are not sure they have received it and time is of the essence.

Instead of just resending sensitive information, further muddying the waters, you need to make sure your original message is not compromised, sent to an incorrect recipient or has even been sent. To help you check up on sent messages, and even recall them or change permissions, OneWorld offers a comprehensive set of reporting tools. As the saying goes: Better safe than sorry.

  1. Keep sensitive information safe in transit

At the end of the day, any trade secrets, or other sensitive information you might send throughout an M&A process, are only as secure as the delivery method used to send them. With six flexible secure delivery methods, to fit any business case, the OneWorld email encryption platform ensures no sensitive message goes out in the clear, no secure message is undeliverable and that your prospective partners, M&A targets or buyers can learn more about your company’s details in a safe and controlled manner.

Ensure secure delivery now.

By: Michael Roberts, VP of Technology, Echoworx

27 Nov 2019

Uniform or Patchwork Privacy Laws? How Your Bank Can Mitigate Cyber Risk

As more state privacy laws come into effect in the US, navigating privacy, data residency and jurisdictional requirements is more complicated than ever for banks and financial institutions with national and international reach. Let’s look at what these privacy laws are and how encryption helps banks and financial services institutions mitigate the risk that comes with juggling multiple privacy laws.

Patchwork privacy laws

America is gearing up for the California Consumer Privacy Act (CCPA) that goes into effect on January 1, 2020. The CCPA is now one of many privacy and data security laws that protect consumers across some states.

Current state privacy laws:

  • California Consumer Privacy Act (CCPA)
  • Nevada Senate Bill 220
  • Act to Protect the Privacy of Online Consumer Information (Maine).

While three privacy laws might not seem like much to handle, that’s not the whole picture. There are also laws governing cybersecurity, data security and data breach notification in Washington, Texas, Oregon, New York, New Jersey, Maryland and Massachusetts.

That’s a lot for any national company to keep up with and with each new law enacted, it becomes easier for companies to fall out of compliance, especially if they don’t implement proper risk management.

National privacy laws

National privacy laws include:

  • The General Data Protection Regulation (GDPR) in Europe.
  • The Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
  • The Act on Protection of Personal Information (APPI) in Japan.
  • The Health Insurance Portability and Accountability Act (HIPAA) in the USA.
  • The Electronic Communications Privacy Act (ECPA) in the USA, often critcized for being outdated and having no impact.

 

What kind of privacy legislation is best for banks?

Banks and other financial institutions are subject to strict legislation outside of general privacy laws. For example, the Gramm-Leach-Bliley Act (GLBA) governs what kind of information can be shared with third parties and requires financial institutions to disclose how they protect their clients’ private data.

We won’t list the regulations financial services companies are subject to here—suffice to say, banks are already heavily regulated.

The best type of privacy legislation for banking, financial services and insurance companies is legislation they influence to meet their needs (and the needs of their customers).

We’d suggest that one national privacy law would be easier to manage than multiple state laws on top of international privacy laws. Whatever the answer is, banks would be wise to weigh in on the idea of a national privacy law in America—because other businesses sure are.

Why the business community is advocating for an American national privacy law

The CCPA is hailed as “America’s answer to the GDPR” but that doesn’t hold up in terms of reach. The GDPR and the CCPA are similar regulations and both allow for sharp fines for lack of compliance. But the GDPR protects citizens of nations belonging to the European Union—that’s 512 million people. There are 327 million people in the US and 39.5 million people in California.

How many more laws need to be enacted for all 327 million Americans to enjoy the same privacy rights as Californians and Europeans? For many people and businesses, the answer is “too many.”

The complications of patchwork privacy legislation is one reason the Business Roundtable—an association of chief executive officers who promote the U.S. economy through sound public policy—is advocating for a national privacy law for Americans.

Marc Benioff, CEO of Salesforce, writes in a Politico article that a national privacy law is “the right thing for consumers and the industry.”

But this advocacy work hasn’t yet borne fruit so businesses must deal with what is, instead of what could be.

How Echoworx OneWorld—a flexible encryption solution—helps banks navigate patchwork privacy laws

Encryption allows organizations to enhance data protection and breach notification practices. It’s an essential risk management tool that supports an organization’s overall cybersecurity strategy.

Echoworx OneWorld is a user-friendly and customer-centric encryption solution that helps banks and financial services organizations navigate patchwork privacy laws.

OneWorld features that help banks stay compliant to multiple privacy laws:

  • Definable policies – This feature allows you to control which communications get encrypted (and how) based on the message content. This is based on your needs and encryption best practices. Flexible controls for every scenario allow you to create a customizable user experience for senders and recipients and stay in control of encrypted messages in transit and at rest.
  • Multiple options for data residency – We have six data centres located in Canada, the US, Mexico, the UK, Ireland and Germany which means our clients can stay compliant to data residency requirements outlined in the GDPR and American privacy legislation. For example, if an organization works in both the EU and US, they can’t have data residency (or third parties) in the US or else they’ll be out of compliance with the GDPR.
  • Automatic inbound encryption – Emails with sensitive information—including protected personal information—are automatically identified, securely routed to the OneWorld web portal and encrypted. Encrypted delivery methods include TLS encryption, encrypted PDFs and attachments, certificate encryption and web portal encryption.
  • Secure statement delivery – Senders can batch and deliver sensitive encrypted messages, like financial statements, directly to recipient inboxes in an encrypted PDF that’s password protected.
  • Natural extensions for Office Message Encryption (OME) – We work alongside Microsoft to take Office 365 to the next level with flexible use cases, branding, audit and tracking capabilities and certificate encryption. This increases existing encryption capabilities and keeps employees comfortable and confident using their existing communication tools—which makes encryption the path of least resistance.

A recent Forrester Total Economic Impact™ study, revealed that a typical enterprise-level organization using Echoworx’s OneWorld encryption platform can expect an ROI of 155 per cent—with upwards of $2.7M in cost-mitigating benefits and a payback period of seven months.

Banks are already doing business in a patchwork of conflicting privacy environments. Why not make it easier with our user-friendly encryption solution?

By: Brian Cole, Senior Manager Security Operations and Support, Echoworx

 

25 Nov 2019

The Importance of Synchronized Tech: Mergers and Acquisitions that Stick Need to Fit

The ink is dry. The handshakes have been made. Your company has just successfully negotiated a multi-million-mega dollar monster merger or acquisition. And your newest corporate addition has all the promise of taking your business to the next level.

But what’s next? How do you begin integration with your existing IT infrastructure? What sorts of vulnerabilities should your IT department be aware of before marrying your two systems? Is your existing IT infrastructure even set up for marriage? Did your top-brass think of any of this before signing off?

Chances are they didn’t.

And, like cooking a soup on your stovetop, a merger between two organizations only works if all the great ingredients can be mixed, melted and mashed together in one pot. If they can’t, your sweet deal might turn sour in a hurry! Or, worse, if left unattended – burn.

Here are some ways conducting technological due diligence plays a pivotal role before, during and after any merger or acquisition process:

1. A history of breaches – a future of headaches

Conducting conclusive research on a prospective merger or acquisition’s digital history should be a primary first step of your courting process. Asking simple questions like “Have you had a breach?” can vet massive roadblocks further down the merger and acquisitions path. Take the now-infamous 2016 Yahoo!/Verizon merger worth an initial $4.8B, for example. In this instance, since Yahoo! reported two major data breaches of user account data just prior to the sale, Verizon shaved $350M off the final price for the deal. In fact, between 2014 and 2018 alone, there where over 10 major breaches affecting mergers and acquisitions deals, affecting billions of users worldwide.

Since breaches can affect sale prices, stall deals or even cancel them out, careful attention should be paid to poor data hygiene during any merger or acquisitions process. Update your legacy encryption system now.

Common red flags, for example, might be a company not adequately protecting sensitive communications. From legacy encryption systems to not encrypting at all, a company which doesn’t protect is opening another to risk.

With our OneWorld encryption solution, companies can reduce the complexity of legacy systems by consolidating email encryption into a single, scalable cloud-based platform – for a more secure environment for sending sensitive communications. From configurable encryption policies to detailed message reporting, our robust encryption system can help you demonstrate effective risk-mitigating security for any deal

2. Understanding IT infrastructure

When organizations begin to execute elaborate digital transformation plays, any hidden tangled wires, certifications and claims within an existing IT infrastructure suddenly come to the forefront. If left unattended, these tangles can create expensive knots for any merger or acquisition attempts. From obsolete technology lowering a product’s value to legacy systems and processes which simply do not line up.

IT issues need to be top-of-mind throughout any merger or acquisition process. Read more about our certifications.

Proper consultation with your IT department prior to a merger is an effective way to ensure elaborate paper acquisitions play out as planned – especially when you consider that over 50 per cent of initiatives throughout a mergers and acquisitions process, designed to capture synergies, are directly related to IT. A merger or acquisition candidate might claim, for example, that they are SOC2 certified, meaning their security has been vetted and approved by a credible third-party SOC2 evaluator. A member of your IT department can help determine whether this certification is valid or acquired via a third-party.

3. Protecting trade secrets

In order to protect trade secrets, prevent unwanted access and to bring order to your merger or acquisition process, you need to provide protected conduits through which information can be sent, received and replied to.

Mergers and acquisitions can sometimes be periods of organized chaos, as new faces meet new infrastructure and information flies freely from camp A to camp B. Ensure only intended recipients can read your secure message.

In addition to its six flexible secure delivery methods, the OneWorld encryption platform is fully brandable, configurable and features various secure authentication methods. For additional security, OneWorld features a flexible suite of encryption policies which automatically protect any incoming or outbound sensitive data.

4. Sanitizing IT infrastructure

Prior to plugging in to any newly acquired merger or acquisition, be sure to identify any existing vulnerabilities. This ensures that any legacy cybersecurity technology, ageing in-house communications systems and other technological cracks don’t pollute your system once the deal is signed – something 40 per cent of companies fail to do. A thorough audit of a prospect’s digital infrastructure can help mitigate the risk of dealing with expensive interventions further down the line.

Prior to plugging in to any newly acquired merger or acquisition, be sure to identify any existing vulnerabilities. Update your legacy message encryption system.

Moving non-critical systems to the cloud is a simple solution to uncluttering, sanitizing and updating an incompatible legacy system. With Echoworx OneWorld, for example, migrating legacy resource-intensive message encryption service to the cloud is simple. The resulting light, configurable and flexible secure message environment, managed in the cloud, helps organizations consolidate cybersecurity efforts and streamlines the merger and acquisition process.

By Christian Peel, VP Customer Engineering, Echoworx