Email encryption must be prioritised

When discussing the security of e-mail an often used analogy is “e-mail is like sending a postcard” and I would add “written in pencil’. Everyone who comes into contact with it is able to read and change the contents should they wish to do so. Add your voice to the email security issue, join the latest CIO Debate, What is the future of email? Email is a “store-and-forward” medium. Most email not only passes through, but actually resides on at least two servers once it is sent by the originator; in many cases the number is greater. When you hit the ‘send’ button, you are not sending your message directly to the intended recipient. Instead, you are sending the mail to a server and asking it to find the best route to the recipient. In a corporate environment the first stop for your mail is probably your internal mail server (the one where your inbox lives). Your internal mail server will then attempt to open a connection directly to the receiving server at the recipient’s domain. At the recipients side most often the email will be first handled by a server which is publicly visible, before finally being handed off to the recipient server where all the inboxes reside. Email can be intercepted at any point along this delivery chain by anyone with access to those servers, whether that be server administrators at the sender, ISP or recipient. Also there is every possibility that any internet facing server could be hacked by criminal third parties for the purposes of information theft. Obviously if a person or company is known to deal in personal information or financial details for example, they will be a more visible target. So why is email encryption not already the norm in corporate environments? Workable technological solutions have existed for many years now in both commercial and open-source forms and still I count the number of encrypted mails I receive over the course of a year on one hand. In most cases the reason for failure to adopt encryption lies in the management and administrative overhead associated with creating and maintaining a public key server at the corporate level. At the end user level, the fact that the recipient of the as yet unwritten email has to pre-register somewhere and hand over a copy of their public key to sender before the conversation can even begin, has been enough to make most users rapidly revaluate their need for privacy and just hit the Send button. The decision to abandon email encryption projects in most cases was probably taken many years ago when those overheads became apparent. Since then, not only have the regulatory and legislative landscapes changed considerably (DPA, FSA, SOX et al) , but so has the technology. It is now possible to send encrypted mail to anyone at any time, without key management, without pre-registration and even without installing end-user software. With the increasing powers of the Information Commissionerand the looming reality of Europe-wide data breach disclosure notification, are we on the verge of finally defaulting to secure?