This chapter uses the outline of Chapter 2 to compile the risks and defenses to each of the 13 step in the email pathway. What should you look for? You have a unique set of circumstances in regard to the email path of your own email system. You have undoubtedly already set up some adequate defenses. You need to determine whether you need to revise or strengthen those defenses. And, of course, you need to determine what are the risks you have not yet defended and how you might do so.
RMail provides two defenses to keep in mind. The first is automatic encryption enabled by RMail Inbox (see Chapter 6), RMail Web (see Chapter 7), and RMail plug-ins and app (see Chapter 13). This is facilitated by SSL/TLS encryption built into the email system. It’s an incomplete defense but nevertheless one that reduces the risk of hacking considerably.
The second is the RMail manual Message-Level encryption (see Chapter 9) enabled by choice for each individual email messages. RMail uses the technical term RPX for it. In fact, it’s a 256-bit AES encrypted (commercial strength) PDF processed in such a way as to keep attachments in their native form and be convenient to use with email. Your email message goes encrypted all the way from your computer to the recipient’s computer. It’s a complete defense to be used for your most important and high-value email messages.
Let’s call these RMail services automatic encryption and Message-Level encryption.
Different Encryption Methods Sometimes it’s difficult to tell from a company’s product information what’s what because the use of non-technical names and names for services change in the marketing copy from time to time. In the case of RMail, to differentiate between the two types of RMail encryption, I use the terms automatic (Chapters 5 and 6) and Message-Level (Chapter 9). But this distinction may not be worded the same in the RMail marketing copy.
Keep in mind that the defenses covered below are for individuals and small businesses. Larger networks require enterprise security software and protections that are operated by IT departments and are beyond the scope of this book.
Let’s go over the email path steps explained in Chapter 2.
Your Email Program
RISKS: A hacker might gain control of your computer (desktop, laptop, tablet, or smartphone) to get control of your email program and get access to your email operation, management, or database.
DEFENSES: See Your Computer next. Also, an easy defense is to use a password to access your email program. Whether your computing device is stolen or whether a hacker gets access to it somehow online, password protected access will prevent a hacker from opening your email program and using it.
Your Computer
RISKS: A hacker might gain control of your computer and thereby gain control of your email program, adopt your identity, gain access to your accounts, gain access to your passwords, etc.
DEFENSES: Use a competent suite of software defenses such as Symantec Norton Security, McAfee LiveSafe, Bitdefender Internet Security, Webroot SecureAnywhere, or the like. Suites typically include a firewall with protections against viruses, anti-phishing, malware, adware, spyware, ransomware, and more. Third-party suites may offer better protection than the built-in protections of your operating system (e.g., Windows).
Apple Some Apple computer users believe they are immune from computer hacking. Don’t bet on it. With Apple having only about 10% of the computer market, most hackers have an incentive to ignore Apple computers and go grazing in more productive pastures. But that does not mean the Apple computers are hackproof.
Don’t overlook a simple defense: use a password (pin number) to access your computing device.
Local Transmission
RISKS: A hacker might intercept the transmission between your computer and your network and thereby get access to your email messages.
What Does It Take? What does it take for a hacker to intercept a Wi-Fi transmission? First, the hacker must be in range of the Wi-Fi transmission (nearby). Few Wi-Fi systems have the power to reach a significant distance beyond your home or place of business. Second, a hacker needs time. If a hacker is parked in an unrecognized vehicle outside your home for ten hours, you might notice. Or maybe not. Perhaps the biggest threat at home is your neighbor’s tech-savvy teenager. Perhaps the biggest threat at your office is a guy in the business next door. A public Wi-Fi network, such as a hotel or coffee shop, is the riskiest place to use email. A hacker could be hiding anywhere. Or the administrator of the public Wi-Fi network could be a hacker (very dangerous).
Note that if your router is not a Wi-Fi router (if it uses network cables instead of Wi-Fi transmissions), there is no likelihood of a hacker interception between the router and your computer.
DEFENSES: Encryption is the essential defense. There are several sources of encryption. First, in your Wi-Fi router software you need to initiate encryption for the transmissions and otherwise configure your router properly (read Chapter 19). This takes care of the transmission between your computer and the router.
Second, you can use the automatic encryption email services such as RMail Inbox and RMail Web that automatically encrypt messages between your email program, your email server, and potentially the recipient’s email server (see Chapter 5).
Third, if the automatic encryption of RMail Inbox or RMail Web is not secure enough for your particular purpose (see Fatal Flaws in Chapter 5), you can use the RMail Message-Level encryption which encrypts your email message from your email program all the way to the recipient’s email program (see Chapter 9). RMail Message-Level encryption can be enabled in the RMail Inbox and RMail Web programs (interfaces) and also in RMail plug-ins and app.
Your Local Network
RISKS: A hacker can hack into your network as a first step toward hacking into your computer.
DEFENSES: Router software (built into the router) typically provides very comprehensive security protection. The default settings should prove adequate unless you have some special configuration for your network that requires adjustment. (If so, consult with a network security expert.) Note, however, that you do need to initiate certain simple router settings for adequate protection. Such settings do not require any IT knowledge or skills. These basic router settings are outlined in Chapter 19.
Warning 1 The failure to set up your router for security will result in a complete lack of security. Again, such a setup is easy to do. Read Chapter 19.
Warning 2 Keep in mind that the administrator of a public W-FI network could be a hacker or could allow access to the router by fellow staff members, other employees, or even friends.
Transmission Across the Internet
RISKS: A hacker might intercept the transmission across the internet between your local network and your mail server (i.e., your email service provider’s email server).
DEFENSES: First, you can use RMail Inbox or RMail Web, both secure email services (see Chapters 6 and 7). They provide automatic encryption all the way to your email server or the recipient’s email server (see Chapter 5).
Second, you can instead use RMail Message-Level encryption. That gets you securely all the way from your email program to the recipient’s email program with complete security, including preventing IT staff and those with unauthorized access from seeing your email.
Third, note that if you and the recipient are both RMail Inbox users, your email will be secure all the way from your email program to recipient’s email program via automatic encryption. This is due to the fact that RMail Inbox is a secure email service, and your email doesn’t go any further than the RMail email server (read Chapter 6).
Your Email Server
RISKS: A hacker might hack into your email server (your email service provider’s email server) or the provider’s message database (archive), which holds incoming email messages until downloaded and perhaps thereafter.
DEFENSES: The defenses are the responsibility of the operator of the email server (your email service provider). A reputable email service provider typically employs defenses likely to be professional, effective, and up-to-date.
What about Staff If your email does not stay encrypted on the email server, the staff of your email service provider can potentially read it. Remember, your email goes to the email server to be managed, and part of that management is temporary storage of email on the email server. While it is stored, your email can be potentially read or even recorded by a staff member, if unencrypted. Then when it gets to the recipient’s email server, the staff there can potentially read it, if unencrypted. Thus, secure email such as Gmail may not be secure from staff. (In the case of an enterprise email system, the staff is the enterprise IT department.) RMail Message-Level encryption is the RMail service you need to use if it’s important to you that staff does not ever see your email.
An email server is a computer program, nothing more nothing less. You don’t need a special computer to run an email server. Email servers (software) are available both for free and for a fee. You might run such an email server on an old desktop or laptop computer that you’re no longer using. Simply connect such a computer to the internet with the email server software installed, set up the software, and you’re in business. But remember, the email server must operate 24/7.
Can you run an email server on the same computer you use every day? Sure. Why don’t people run their own email servers? There are several reasons: (1) In order be effective, an email server has to run 24/7. You can’t turn it off. (2) Email servers are somewhat complicated to set up and operate. (3) By operating your own email server, you enter the world of IT (information technology) operations which requires a minimal level of computer skill. (4) If you don’t run your email server properly, you could be blacklisted by ISPs; blacklisting would render your email system ineffective. (5) Finally, the biggest challenge to running your own email server is managing the inbound spam.
You may need to employ an email archive server (for a multi-employee business) that stores all email messages sent and received over the years, a large and growing database. Without proper encryption, the email stored could be readable by staff or be susceptible to external hacking.
Accordingly, very few people choose to operate their own email servers. Operating your own email server is certainly not recommended. Too much risk and too little reward. You can achieve better security by letting the IT personnel take care of it.
Transmission Across the Internet
RISKS: A hacker might intercept the email message as it goes across the internet from your email server to the recipient’s email server.
DEFENSES: The defenses are in the hands of the email service providers. They can be expected to be diligent and guard against hacking. To be sure, however, you need use to RMail Message-Level encryption, and your email will be secure all the way to the recipient.
Anomaly In the unlikely event that you use a secure email service and the recipient uses a different secure email service, the message might automatically transmit securely between your email server and the recipient’s email server and then on to the recipient. But you will not know for sure if this will happen and therefore should assume that it doesn’t happen. Read more about secure transmissions in Chapter 5.
This is a very vulnerable step in the email path. Chapter 5 analyzes this vulnerability in greater depth. Automatic encryption is not necessarily complete security. It remains encrypted to the recipient’s email server, but may not be encrypted beyond that. Only RMail Message-Level encryption proves security along the entire email path.
Recipient’s Email System
Well now, let’s take a look at the defenses for the remainder of the journey between your email program and your recipient’s email program (steps 8–13 in Chapter 2). The reality is that this part of the email path is out of your control. There’s not much you can do. After your email reaches the recipient’s email server it’s in the recipient’s control (and the control of recipient’s email provider). The risks are the same as steps 1–6 except in reverse (steps 8–13), and the defenses to be applied by the recipient are the same.
You have no idea whether your recipient’s email server, local network, and computer are secure or not. Your recipient likely doesn’t even know. Many local networks have some security in place but most do not have complete security as outlined in this chapter.
There is one exception. If your recipient is in a large enterprise network, you can assume that the network is run by a professional IT department that has installed substantial security. But even enterprises may not provide secure email as outlined in Chapter 5.
For complete control use RMail Message-Level encryption. The recipient’s email defenses are irrelevant because your email message is encrypted all the way to the recipient’s email program. Not even the staff that administers the recipient’s email can read it.
Another View
A summary of each security defense will give you a better idea of potential defenses you can use.
Security software Again, your computer and the recipient’s computer need to be protected by security software such as Symantec Norton Security.
Operating system The security programs native to your operating systems (e.g., Windows Defender) may not be as effective or dependable as the leading third-party security software. Regardless, upgrades to your operating system often patch holes in internal security protection. Such patches are essential for ongoing security. Always keep your operating system up to date. The most reliable way to do so is with automatically installed updates.
Router Without other defenses, the protections provided by your router (read Chapter 19) become important for email, because such protections cover the local transmission, which is vulnerable to hacking. Keep in mind also that router protections act as a defense against all types of hacking in your local network that have nothing to do with email.
RMail services RMail offers a service Message-Level encryption that will keep your email encrypted and unable to be read if hacking takes place (read Chapter 9). RMail also offers other secure services such as Registered Email, E-sign, and LargeMail transfer (read Chapters 8, 10, and 11).
RMail email services RMail provides automatic encryption in RMail Inbox and RMail Web (read Chapters 6 and 7).
RMail plug-ins RMail provides plug-ins to enable you to use RMail services in leading email programs such as Outlook (read Chapter13).
Parting Thoughts
Don’t get me wrong. Although there’s a lot of risk, if you employ good security measures, it’s difficult for a hacker to hack your email system. This statement assumes the following:
- You practice the maximum security for your computing device.
- You practice the maximum security in the operation of your Wi-Fi local network.
- Your ISP practices the maximum security in the operation of its network.
- Your email service provider practices the best security for email servers.
- The recipients email service practices the best security in the operation of its email server.
- The recipient’s ISP practices the maximum-security for ISP network.
- The recipient practices the maximum-security for their Wi-Fi local network.
- The recipient practices the maximum security for their computing device.
If all that is done, the likelihood of you getting hacked is minimized, but still possible. If you add up all the operators and their levels of network security, that equals a lot of variables. In fact, you might say that sending email is a somewhat iffy business in any case. That’s why you need to reduce your risk by doing all the things you can do to make the email path more secure for your email messages.
RMail services provide you with a means of making a transmission between your email program and the recipient’s email program absolutely secure. If you use Message-Level encryption, you don’t have to worry about all the steps in the email path. Your email message is encrypted and secure from your computer to the recipient’s computer regardless of the secure practices of others. It even remains encrypted while residing on the recipient’s computer. It’s quite safe. This statement assumes only the following:
- You practice the maximum security for your computing device.
- The recipient practices the maximum security for their computing device.
