Email often carries personal and confidential information, which is why email security matters so much.
What is email security?
Email securityis the practice of protecting email against risks such as theft of sensitive information, intrusion, information exposure, and attacks that use techniques aimed at compromising a user's personal email account.
Why is email security necessary?
Email security is critical for both personal and business email because, in the digital age, email is the medium used to exchange information, financial records and commercial data.
For individuals, email is often linked to bank accounts and social media, so if a hacker breaches an email account through a security vulnerability, they can obtain sensitive information such as banking passwords or private photos. Bad actors can also exploit compromised social media accounts to carry out scams.
For a business, email is both an important document store and the channel through which it deals with customers. Where security is inadequate, bad actors can gain access and expose the company's confidential information, with serious consequences. Losing access to email is particularly damaging, because it interrupts the business itself.
How to secure business and personal email
The right email security measures depend on whether the user is an individual or a business. Below are the ways to secure email for individual users and for businesses:
Email security for users
Taking steps to secure email is essential: it protects personal information and reduces the risk of unauthorized access by third parties. Here are several ways to secure your own email:
Use a strong password:Choose a long password for your email account that combines lowercase and uppercase letters, numbers and special characters. Change your password on a regular schedule and never share it with anyone.
Kích hoạt authentication 2 yếu tố (two-factor security):This is a strong security feature: when a user logs in to an email account, in addition to entering a password they must complete a second verification step — usually a verification code sent to a mobile number, or a code from an authenticator app such as Google Authenticator.
Always keep software and applications updated:Keep your browser and email client updated to the latest version to avoid security vulnerabilities
Limit access to links and attachments from emails of unknown origin: attachments can infect a user's device with viruses or malware, leading to data loss or system damage. In addition, some malicious actors use emails of unknown origin to carry out scams or phishing attacks.
Avoid accessing email on public computers:Public computers cannot be assumed to be secure, so limit access to your email from public networks or untrusted devices.
There are also a few other ways users can keep their email secure:
- Avoid sending images or sensitive information by email
- Use spam filters and antivirus software
- If you access company email remotely or on personal devices, use VPN software for the connection
Email security for businesses
Với email doanh nghiệp, muốn bảo mật tốt email, cần thực hiện theo 2 hướng: giáo dục nhân viên và thiết lập các giao thức bảo mật toàn diện.
- Train staff on security, on email security risks and on how to avoid attacks and phishing sent by email.
- Require staff to set strong passwords and change them regularly.
- Use email encryption to protect message content and attachments
- If a company lets employees access corporate email on personal devices, it must implement strong BYOD security practices.
- Deploy tools and protocols that scan and block email carrying malicious files before it reaches the recipient's endpoint.
- Deploy data protection solutions that identify sensitive data and prevent it from being lost through email.
The most common email security protocols today
Because email security matters to individuals and, in particular, to businesses, a growing number of email security protocols have appeared.
SSL/TLS – Secure Sockets Layer and Transport Layer Security
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are two security protocols used to protect email sent over the Internet. Both SSL and TLS provide a security framework that works with SMTP to secure users' email. However, SSL was deprecated in 2015.
TLS provides privacy and security for SMTP: when sending or receiving email, it uses TCP (Transmission Control Protocol) to initiate the connection, negotiate, and set up encryption before the email is transmitted. TLS is therefore considered an encryption security protocol that protects privacy and prevents unauthorized access while email is transmitted over the Internet.
S/MIME – Secure/Multipurpose Internet Mail Extensions
Most email services today support S/MIME, a security standard that encrypts and protects email data, provides digital signatures, and verifies the sender's identity. Broadly, S/MIME serves two main functions — encryption and authentication — to protect the information and data inside an email.
S/MIME uses public-key cryptography to encrypt email before it is sent, which helps protect email from attackers. S/MIME also uses digital signatures and authentication to verify identity, establishing the validity of the message.
DMARC – Domain-based Message Authentication, Reporting Conformance
DMARC là một giao thức xác thực email tiêu chuẩn, trong đó phương thức hoạt động dựa trên việc các nhà quản lý email thiết lập các bản ghi DNS (Domain Name System) để chỉ định cách xử lý cho các email không hợp lệ được gửi đến.
Key security standards in DMARC
Domain-based Message Authentication, Reporting and Conformance (DMARC):Authenticate email and block spoofing and phishing
Sender policy Framework (SPF):Authenticate email from permitted domains and IP addresses
DomainKeys Identified mail (DKIM):Digital signatures are used to authenticate email and reduce the risk of email spoofing. Recipients can verify an email's identity if it has been signed with DKIM. Conversely, if an email is not verified by DKIM, it will be considered invalid, rejected, or sent to spam.
SPF – Sender Policy Framework
With the SPF email authentication protocol, an organization can specify who is permitted to send email from its domain, and the SPF record is published in the domain name system (DNS). Receiving email providers then read the SPF record in the sender's domain and determine whether the sending IP address is authorized. SPF can also be combined with DKIM and DMARC to strengthen email security further.
Digital Certificates
Digital Certificates là chứng chỉ số, chứng chỉ điện tử được sử dụng để xác thực danh tính của cá nhân và tổ chức. Khi gửi email, Digital Certificates của người gửi sẽ được gắn vào tiêu đề của email và trở thành một phần của tiêu đề. Khi nhận email, trình đọc của người nhận sẽ xác minh chữ ký số ký bởi Digital Certificates của người nhận
DKIM – Domain Keys Identified Mail
DKIM stands for DomainKeys Identified Mail, a method of authenticating outbound email. DomainKeys Identified Mail works as follows:
A cryptographically secured DKIM signature is added to the email header
The recipient's email system decrypts the digital signature; if the resulting value matches the email content, the message is authenticated as genuine rather than spoofed.
This verification happens on the server, so the DKIM signature is not visible to end users.
OpenPGP – Open Pretty Good Privacy
OpenPGP is an open-source email encryption standard used to secure email, messages, documents and information, based on the Pretty Good Privacy (PGP) framework. OpenPGP uses both symmetric encryption and public-key encryption, primarily to protect the integrity and confidentiality of email. The public key encrypts the email before it is sent, and the private key decrypts the email on receipt.
Closing thoughts
In short, email security is an essential part of protecting personal information and privacy. Applying the email security measures and protocols described above helps users and businesses avoid cybersecurity risks.
