Encryption is absolutely essential to protect data both in transit and at rest. However, most sensitive or confidential content sent through email is not encrypted, but instead is sent in clear text and so exposed to potential interception. This puts the owners of this information and its recipients at serious risk of data breaches, damage to corporate reputation, loss of intellectual property and a variety of other consequences that can have significant financial and other ramifications.
Email, while not the only area of concern for data leakage or unauthorized interception of corporate ontent, should be the primary focus of encryption for corporate decision makers for three reasons:
- Email is the dominant communications mechanism in most organizations. An independent research survey has found that the typical information worker sends 30 emails and receives 80 emails, and spends 149 minutes in their email client, on a normal workday.
- Roughly 95% of the content that flows through corporate email systems consists of file attachments, making email the primary method for sharing files in most organizations. Although managed file transfer solutions, SharePoint and other tools are widely used, email remains the mainstay of most corporate file sharing.
- Corporate email is the most common single application for most users, as well as the most common capability employed on personally owned devices. The latter is of particular concern because of the lack of IT control over email sent and received on devices that are owned by employees.
- Organizations that send or store sensitive data through email should establish policies about when and why to encrypt content, train employees about appropriate handling of this data, and implement solutions that will enable automatic, policy-based encryption of data based on its content.
