Tag: digital transformation

08 May 2020

New Streamlined Ways of Authenticating People Quickly Proving Their Value

Traditional ways of gaining access to an account or information, think usernames and passwords, remain common, but their shortcomings pose liabilities.

How do you confirm that people requesting access to your system and files are who they say they are? One way is to ask them to confirm their identity multiple times before granting access – otherwise known as Multi-Factor Authentication (MFA). Chastised in the past for awkward or clunky user experiences, new streamlined ways of authenticating people are quickly proving their value.

Bad password habits pose vulnerabilities

As the saying goes: A chain is only as strong as its weakest link. The same mantra may be applied to a cybersecurity program, where a single weak lock can pose a critical vulnerability to an entire company’s network. In the case of authentication, internal employee slipups can render even the strongest digital locks obsolete. Passwords were responsible for 81 per cent of breaches in 2017.

From weak or easy-to-guess passwords, like ‘p@ssword,’ to password reuse across multiple accounts, people cannot be trusted to create keys granting access to digital assets. But if multiple digital locks are created, each requiring a unique authenticating factor to grant access, it is theoretically harder to force access. That is what makes MFA systems so effective at protecting valuable data.

Address inherent vulnerabilities: authenticate beyond username and password

MFA helps mitigate the vulnerabilities presented by weak password habits by requiring additional authenticating ‘factors’ before granting access. These factors can vary in terms of complexity but are usually something unique or known only to the individual. This ensures that if a single factor is compromised, guessed or lost, like a password or PIN, other factors, maybe a birth date, remain to accurately verify the identity of who or what is trying to gain access.

“Imagine somebody is trying to hack an account and they correctly guess a user’s password,” says Chris Peel, VP Customer Engineering at Echoworx. “With MFA, they may try to log in, but the owner of the account gets a pop-up on their mobile device notifying them that someone is attempting to login. Access can then be denied by the person – using this second factor of authentication.”

Advocate for user friendly MFA

There is no ‘one way’ of conducting MFA. The term is loose and can be applied to a variety of authentication systems – from so-called ‘Strong Authentication,’ a variant of Two-Factor Authentication now a requirement for transactions over €30 in Europe, to hard-token MFA, where a physical token is required to gain access. These systems vary in the amount of security they provide – with some even deliberately hindering user experience to emphasize the importance of the access they provide.

“People won’t accept more security than they think they need.” – Google’s Mark Risher

But new digital variants help make MFA a relatively frictionless experience – with little to no impact on user experience. A bank portal, for example, might ask a banking customer for a password as one factor, or way, of authenticating their identity. But, as a second factor of authentication, the bank may also demand a Time-Based One-Time Password (TOTP) – a single-use and time-stamped random code – issued from an app installed on the customer’s mobile phone. This additional verification is completed by the customer without leaving their mobile phone. The key, you must keep it simple. Mark Risher, who manages Google’s identity systems says, “People won’t accept more security than they think they need.”

Adequate authentication, not an option

When it comes to protecting customers and the digital infrastructure of an organization, adequate authentication should not be an option – and it does not have to be. According to a report conducted by the Global Information Assurance Certification (GIAC), 87 per cent of respondents were favourable of having to authenticate themselves after being told what it was for.

The GIAC study illustrates that, while MFA might be initially viewed as security overkill by people, the same people view it favourably once they are made aware of what it is, and the protection benefits it provides them. Today most service organizations got the message: consumers want two-factor. If you do not offer it, they’ll find the service that does.

Authentication is an integral part of digital business

If digital trust is the new currency of customer experience, MFA is one of the locks holding everything in-place. The average user assesses the safety of an email in just 30 seconds before replying with personal information, says Echoworx in a survey they conducted.  Yet, more than three quarters of people will leave a company who mishandles their data. If people cannot be trusted to safeguard access to their own data, organizations need to ensure a single digital slip-up doesn’t enable fraudulent access.

To make sure that right people enter and access the right information, MFA assures organizations that their entire network won’t be compromised by a single person – helping solidify levels of digital trust.

The future does not include more complex passwords

While not uniformly mandatory under any regulation, MFA is quickly becoming a recommended default. For example, as per the European Central Bank (ECB)’s European Payment Services Directive (PSD2), transactions conducted over €30 must feature ‘Strong Authentication,’ to comply with their ‘Strong Customer Authentication (SCA)’ practice. In the wake of this regulatory development, 84 per cent of affected organizations outline MFA as a priority investment. For independent bodies, this trend continues, with certification bodies, like the PCI Security Standards Council, which is responsible for managing PCI DSS, highly recommending MFA for any future developments.

05 May 2020

A Realistic Look at Email Security

Like any locked door, chest or vault, some things can be more secure than others. Enterprises need to know where and how to apply email encryption for maximum data protection. 

While some email data security products may offer a built-in encryption feature as part of a larger bundle, there are extensions you should consider that further protect your brand, business and customers.

Here are some ways to add some more muscle to your email data protection efforts:

Covers every scenario

Whether you’re sending millions of e-statements or just sending a sensitive document, not every encrypted message is the same. Look for an encryption platform which offers a customizable user experience for both senders and recipients. People do not come in a one-size-fits-all version.

Personalization

If your organization operates internationally, there’s a high chance that English might not be the mother tongue of some of your customers. Offering encrypted communications in the language of your users helps eliminate confusion and is just good customer service. With Echoworx OneWorld, for example, you can set language policies which can automatically be applied to encrypted communications based on sender, brand, locale or receiver attributes.

Keep email protection simple

Encryption may be hot but the use of it still isn’t. Echoworx found that only 40 per cent of organizations who have encryption capabilities are actually using them throughout their organization. Making data protection in email a consistent path of least resistance is a good non-intrusive way of getting everyone, inside and outside, to communicate securely.

More secure ways to send emails

With traditional secure message delivery, where TLS is used, if a TLS connection isn’t available or supported at the receiving end, there are only two outcomes: receiving an error or sending a message unprotected. Supporting multiple secure delivery methods offers effective fallback options – ensuring sensitive information is always able to be sent and is never sent unprotected.

Prevent unauthorized access

While a one-time-password encryption method is secure, the password itself is only as secure is where it is sent. In other words, if both the one-time-password and the encrypted message are sent to the same mailbox, there’s a lot of trust being put into the security of a recipient’s device or email inbox. A natural solution to this issue would be to send the password to the sender, who can then communicate it as they please to the recipient.

By Derek Christiansen, Engagement Manager, Echoworx

01 May 2020

Who Controls Your Encryption?

Security controls how our property is used, who has access to it and keeps it safe. But what happens to this secure sense of control when property and data goes beyond your reach – outside your digital perimeter?

Here are some points to consider when evaluating encryption options for email data protection – without relinquishing control:

Meets compliance needs 

Under international privacy rules, like the GDPR, non-compliance can lead to massive fines you can’t afford. And, while delivery methods like TLS or PGP are effective for protecting data in transit and end-to-end, they do not accommodate every situation – additional options are needed. If a TLS connection is not available, you may want automatic fallbacks to another secure delivery methods, such as via web portal or as an encrypted attachment – ensuring sensitive data always remains protected.

Automates processes

Encryption is a feature of any serious cybersecurity design – but real world application still lags, according to Echoworx data. When a platform is not user friendly and encrypting a message is difficult, there is a tendency for senders to favour the path of least resistance – sending sensitive data without protection. Setting proactive encryption policies in motion not only makes encryption mandatory based on pre-set rules, but also improves platform usability by automating a sometimes-confusing process. Take inbound encryption policies, for example. When a customer sends an organization sensitive information, like a credit card number, over an open or unrecognized channel, there is a chance existing email filters might flag and block their message for reasons of compliance. By setting inbound encryption policies, incoming emails containing sensitive data are automatically encrypted, before being delivered to a recipient’s inbox – safe, sound and compliant.

More secure ways to email

From the choice of email service provider to something as simple as a device-type, there are a variety of ways recipients might be inadvertently controlling their encryption experience. This unintended result can prove detrimental to their user experience – especially if there are better encryption delivery methods for their situation. Using proactive policies, your organization can push secure delivery methods tailored to specific customers. You might, for example, set policies which restrict TLS to trusted partners only – or employ attachment-only encryption for secure statement delivery.

Consistent experience for everyone

Part of a true streamlined user experience relies on a consistent user experience – regardless of device, location, location or connectivity. An encrypted message experience, for example, should offer the same user experience regardless of whether the secure message is accessed on a desktop computer or offline via a mobile device – without the need for third-party apps. This same consistent user experience also helps streamline working within collaborative environments. Common business scenarios, for example, often involve engaging with a sensitive document across multiple devices and environments. Is the document going to look and act the same offline and online? If working collaboratively on a sensitive encrypted document, is the user experience identical for all parties involved?

Recall email when needed

The ability to recall a compromised message even after it has been read, is a simple, yet fundamental feature enabling control of an encryption experience. Whether a message is sent to an unintended recipient or whether a message is no longer safe, control over a message shouldn’t have to be relinquished just by pressing ‘Send.’

Brand Safeguards

Branding and the separation of brands is crucial to any enterprise. The ability to brand, separate and segment customer interactions according to brand can mean anything from how a secure message is received to a preferred language. Different brands should also be siloed to prevent eavesdropping from other business units.

By Derek Christiansen, Engagement Manager, Echoworx

25 Nov 2019

The Importance of Synchronized Tech: Mergers and Acquisitions that Stick Need to Fit

The ink is dry. The handshakes have been made. Your company has just successfully negotiated a multi-million-mega dollar monster merger or acquisition. And your newest corporate addition has all the promise of taking your business to the next level.

But what’s next? How do you begin integration with your existing IT infrastructure? What sorts of vulnerabilities should your IT department be aware of before marrying your two systems? Is your existing IT infrastructure even set up for marriage? Did your top-brass think of any of this before signing off?

Chances are they didn’t.

And, like cooking a soup on your stovetop, a merger between two organizations only works if all the great ingredients can be mixed, melted and mashed together in one pot. If they can’t, your sweet deal might turn sour in a hurry! Or, worse, if left unattended – burn.

Here are some ways conducting technological due diligence plays a pivotal role before, during and after any merger or acquisition process:

1. A history of breaches – a future of headaches

Conducting conclusive research on a prospective merger or acquisition’s digital history should be a primary first step of your courting process. Asking simple questions like “Have you had a breach?” can vet massive roadblocks further down the merger and acquisitions path. Take the now-infamous 2016 Yahoo!/Verizon merger worth an initial $4.8B, for example. In this instance, since Yahoo! reported two major data breaches of user account data just prior to the sale, Verizon shaved $350M off the final price for the deal. In fact, between 2014 and 2018 alone, there where over 10 major breaches affecting mergers and acquisitions deals, affecting billions of users worldwide.

Since breaches can affect sale prices, stall deals or even cancel them out, careful attention should be paid to poor data hygiene during any merger or acquisitions process. Update your legacy encryption system now.

Common red flags, for example, might be a company not adequately protecting sensitive communications. From legacy encryption systems to not encrypting at all, a company which doesn’t protect is opening another to risk.

With our OneWorld encryption solution, companies can reduce the complexity of legacy systems by consolidating email encryption into a single, scalable cloud-based platform – for a more secure environment for sending sensitive communications. From configurable encryption policies to detailed message reporting, our robust encryption system can help you demonstrate effective risk-mitigating security for any deal

2. Understanding IT infrastructure

When organizations begin to execute elaborate digital transformation plays, any hidden tangled wires, certifications and claims within an existing IT infrastructure suddenly come to the forefront. If left unattended, these tangles can create expensive knots for any merger or acquisition attempts. From obsolete technology lowering a product’s value to legacy systems and processes which simply do not line up.

IT issues need to be top-of-mind throughout any merger or acquisition process. Read more about our certifications.

Proper consultation with your IT department prior to a merger is an effective way to ensure elaborate paper acquisitions play out as planned – especially when you consider that over 50 per cent of initiatives throughout a mergers and acquisitions process, designed to capture synergies, are directly related to IT. A merger or acquisition candidate might claim, for example, that they are SOC2 certified, meaning their security has been vetted and approved by a credible third-party SOC2 evaluator. A member of your IT department can help determine whether this certification is valid or acquired via a third-party.

3. Protecting trade secrets

In order to protect trade secrets, prevent unwanted access and to bring order to your merger or acquisition process, you need to provide protected conduits through which information can be sent, received and replied to.

Mergers and acquisitions can sometimes be periods of organized chaos, as new faces meet new infrastructure and information flies freely from camp A to camp B. Ensure only intended recipients can read your secure message.

In addition to its six flexible secure delivery methods, the OneWorld encryption platform is fully brandable, configurable and features various secure authentication methods. For additional security, OneWorld features a flexible suite of encryption policies which automatically protect any incoming or outbound sensitive data.

4. Sanitizing IT infrastructure

Prior to plugging in to any newly acquired merger or acquisition, be sure to identify any existing vulnerabilities. This ensures that any legacy cybersecurity technology, ageing in-house communications systems and other technological cracks don’t pollute your system once the deal is signed – something 40 per cent of companies fail to do. A thorough audit of a prospect’s digital infrastructure can help mitigate the risk of dealing with expensive interventions further down the line.

Prior to plugging in to any newly acquired merger or acquisition, be sure to identify any existing vulnerabilities. Update your legacy message encryption system.

Moving non-critical systems to the cloud is a simple solution to uncluttering, sanitizing and updating an incompatible legacy system. With Echoworx OneWorld, for example, migrating legacy resource-intensive message encryption service to the cloud is simple. The resulting light, configurable and flexible secure message environment, managed in the cloud, helps organizations consolidate cybersecurity efforts and streamlines the merger and acquisition process.

By Christian Peel, VP Customer Engineering, Echoworx