Secure Email for Business: Email Encryption Best Practices

Email is a cornerstone of business communication. Without it, many companies would grind to a near-halt. Unfortunately, email is also a leading cause of data breaches and business interruptions. Why is business email encryption so crucial, and how can secure email safeguard businesses and their customer data?

Although inbound attacks such as phishing are on the rise, the most common risk to businesses comes from the messages they send out into the world.

Outbound email risks include:

• Email interception, where confidential information is intercepted by an unauthorised third party on its way to the intended recipients.
• Email misfires, where an unsecured confidential email is misaddressed and delivered to unauthorised third parties due to human error.

Outbound email risks are the most common causes of business email compromise, leading to reputation damage and regulatory fines.

So, how can a business protect itself from sending unsecured confidential information?

Let's explore how secure email for businesses can help you avoid outbound email risk.

What Is Secure Email?

Secure email is a comprehensive term for encryption and authentication solutions designed to protect outbound emails from falling into the wrong hands.

Secure email solutions for businesses provide two primary layers of protection:

• Email encryption disguises email contents and attachments so they can’t be accessed if intercepted.
• Email authentication locks emails behind an authentication challenge that recipients must correctly answer to open them.

Although all email providers offer some level of encryption and authentication, these are usually designed for everyday consumer emails.

For businesses handling sensitive customer information, the features provided by their email provider might not meet certain standards of compatibility, ease of use, and regulatory compliance.

Let’s examine your options for business email encryption and authentication when using Outlook, Gmail, and Apple Mail.

We’ll break down the pros, cons, and alternative solutions.

How to Secure Business Emails Using Microsoft 365/Outlook

Microsoft 365 and Outlook are part of an expansive ecosystem, so your secure email options differ depending on your business package.

Let’s take a look.

Microsoft Purview Message Encryption (Basic)

Availability: All 365 plans excluding E1/Basic

Microsoft Purview Message Encryption can encrypt business emails both within and outside your organisation and the Microsoft ecosystem.

Secure emails sent to recipients using Outlook appear within their inbox, auto-decrypted, just like a normal email.

Secure emails sent to recipients using other email clients receive a notification email and click to open the secure Microsoft portal.

Recipients must sign in with a Microsoft, Yahoo, or Gmail account to access the message in their web browser.

The requirement to be logged into an email account to access confidential information is enough to prevent many forms of attack.

Most email accounts require multi-factor authentication (e.g., an SMS code) by default.

However, this can be turned off by users, so the security is in the hands of your recipients.

Pros:

• Messages are auto-decrypted for recipients using Outlook.

Cons:

• No multi-factor verification (if the recipient's inbox is hacked, data is vulnerable).
• Only supports authentication for Microsoft attachments (e.g., docx, xls).
• No revoke functionality (you can ‘request’ a recall for unopened messages).
• MPME only works seamlessly with other Microsoft products. Recipients using non-Microsoft email clients must access the message through a web portal.

Initialisation:

• User option in Outlook:
  • To encrypt an email in Outlook, click the “Encrypt” button above the compose pane and select “Encrypt”. (You may need to add this option to your toolbar by selecting “Customise Toolbar” first.)
• Administrator message rules:
  • To enable MPME with message rules, you will need to use Microsoft PowerShell to enable access if it is not already enabled. You can then go to your Exchange Admin Centre and configure your rules under Mail Flow > Rules using the option “Encrypt” from the RMS template list.

Microsoft Purview Message Encryption (Advanced)

Availability: E3/E5 365 plans (or as an add-on to other plans)

Microsoft Purview Message Encryption (Advanced) brings additional controls and features to MPME (Basic), including branding, a revoke option, and keyword triggers.

Options to revoke and set expiry periods on secure emails provide a last-resort lockdown option for your business emails.

Keyword triggers are useful for initiating security based on your company’s policies regarding personal data and information security.

These can be set up so that an email will be encrypted if particular phrases are detected.

However, the core security that protects messages from unauthorised access is the same in both the Basic and Advanced versions of MPME.

If any of your recipients’ email accounts are compromised, so are any confidential emails they receive.

Initialisation:

• User option in Outlook (same method as Basic MPME).
• Administrator message rules (same method as Basic MPME).
• Email keyword triggers:
  • To configure advanced mail flow encryption rules using keywords and other information formats, see this guide.

Pros:

• Messages are auto-decrypted for recipients using Outlook.
• Branded templates for an improved recipient experience.

Cons:

• No identity verification (if the recipient's inbox is hacked, data is vulnerable).
• Only supports Microsoft attachments (e.g., docx, xls).
• No reliable revoke option (only works for emails sent outside your organisation using rules to apply a branded wrapper, accessed through the web portal).

How to Secure Business Emails Using Gmail and Apple Mail

Gmail and Apple Mail offer no secure email functionality that can support a business in encrypting emails at scale without compatibility issues.

TLS and S/MIME are offered but neither guarantees delivery and security to all recipients when used alone.

There is also no authentication capability within Gmail or Apple Mail to make sure that recipients must verify their identity to gain access.

Emails sent using their encryption are no more secure than the rest of the emails in a recipient’s inbox.

Few information security regulators would advise using Gmail or Apple Mail’s native capabilities (regardless of updates) to secure sensitive information and comply with regulatory guidance.

For this reason, let’s explore how a third-party tool like Mailock can help.

Secure Email for Gmail and Apple Mail

If you’re using Gmail or Apple Mail for your business, don’t worry - you can still send confidential information securely by email.

You have two options to secure your communications:

• Third-party webmail: Many secure email solutions (such as Mailock Pro) provide a web browser-based interface, allowing you to log in to compose secure emails, add attachments, and set authentication challenges for recipients.
• Third-party gateway: Some secure email solutions (such as Mailock Enterprise) offer an encryption gateway, which can be hosted on-premise or in the cloud. Confidential emails pass through it to be secured before they leave your infrastructure. Gateway encryption can be initiated using keywords, rules, or API calls triggered by custom functionality within your email infrastructure.

The solution you use will depend on the scale of your operation and the volume of confidential information being shared.

Why Is Multi-Factor Authentication So Important?

The term “secure” can mean a lot of things to different people. It's not just about protecting data from hackers, scammers, and other bad actors.

It's also about preventing the release of sensitive information—like customer names, credit card numbers, addresses.

Encrypting an email protects data on its way to an inbox, but it doesn’t ensure it gets to the right person.

As we become more reliant on digital communication and increasingly aware of top email risks, recognising this distinction becomes crucial.

Here are the most important reasons why multi-factor authentication should be a key part of securing your sensitive business emails:

• Multi-factor authentication offers message-level security so that, even if someone gains access to one of your recipient’s email inboxes, they cannot open an email containing confidential information or files.
• Multi-factor authentication provides evidence that information has been delivered to the right person. In professional services, this is often a requirement for regulatory compliance in certain transactions.
• Multi-factor authentication prevents 99.9% of automated cyber-attacks according to a study conducted by Microsoft.
• Multi-factor authentication prevents the most common cause of a data breach—human error. If a sensitive email is sent to the wrong address, they are unable to open it without passing a challenge.

Protect Your Business

Securing business emails is no longer optional in today’s digital landscape. With the increasing frequency of cyber threats and data breaches, businesses must adopt secure email practices.

Leveraging robust encryption and multi-factor authentication solutions not only helps in safeguarding sensitive information but also in maintaining trust with clients and partners.

Whether you are using Outlook, Gmail, or Apple Mail, exploring and implementing the right secure email solutions tailored to your business needs is essential.

By doing so, you ensure that your business communications remain protected and compliant with regulatory requirements.

The investment in secure email practices is an investment in the integrity and future of your business.

FAQs

What Is the Difference Between Email Encryption and Authentication?

Email encryption protects the content of an email during transmission, ensuring it cannot be read if intercepted. Authentication verifies the recipient’s identity, adding a layer of security to ensure the email reaches the intended person.

Why Should Businesses Avoid Relying on Native Email Security Features?

Native features like TLS and S/MIME provide basic encryption but lack universal compatibility and multi-factor authentication, making them insufficient for securing sensitive business communications.

How Does Multi-Factor Authentication Improve Email Security?

Multi-factor authentication requires an additional step beyond a password, such as a code or biometric verification, ensuring that only the intended recipient can access sensitive emails.

Are Gmail and Apple Mail Suitable for Secure Business Communication?

Gmail and Apple Mail lack robust encryption and authentication features, making them unsuitable for handling confidential business information without third-party tools.

What Are the Benefits of Using Third-Party Secure Email Solutions?

Third-party solutions offer advanced encryption, recipient authentication, and additional features like message revocation, providing stronger compliance and security tailored to business needs.

References

8 Most Common Causes of a Data Breach, Security Boulevard, 2022

Phishing Attacks Soar 220% During COVID-19 Peak, F5, 2022

Set Up New Message Encryption Capabilities, Microsoft, 2022

Define Mail Flow Rules to Encrypt Email, Microsoft, 2022

One Simple Action You Can Take to Prevent 99.9% of Account Attacks, Microsoft, 2019

Human Error Is Responsible for 85% of Data Breaches, GRCeLearning, 2022

Reviewed by

Sabrina McClune, 18.06.24

Sam Kendall, 18.06.24