How Secure is Your E-mail?

Fortunately, there are innovative developments that are making it a lot easier to secure your e-mail. Starting with the oldest:

• PGP Corporate Desktop, from PGP Corp., is the long-time standard in e-mail encryption. After this software has been installed, end users decide which of their outgoing e-mails should be encrypted. The sender's software encrypts each message using the recipient's "public key," a code for which only the recipient has a corresponding decryption key.

• FileAssurity OpenPGP 2.0 is a PGP competitor that's due for release within the next two weeks from the upstart company ArticSoft (whose name is a play on "articulated software"). The original 1.0 version was launched only last August. In addition to encrypting e-mails, the new release will have the ability to create compressed ZIP files as well as a secure .pgp file format that can be opened by anyone with a free reader (and the right code), company executives say.

• PGP Universal, also from PGP Corp., has broader capabilities than either of the other two alternatives. It automatically encrypts and decrypts e-mails — at the server level, not the user level — between any set of senders and receivers. The list of who shall send and who shall receive secure e-mails is determined by an IT administrator. End users never have to remember to click a button to secure these e-mails before transmitting them. It's done for them in the background. PGP Universal has been commercially available only since mid-September.

Each Product Has Its Boosters and Its Detractors

Steve Mathews, CEO of ArticSoft, said in an interview that FileAssurity is easier for end users to understand and use than PGP Corporate Desktop. The principle of FileAssurity, he said, is "users being able to use security as easily as they might use a courier service [for physical documents]."

FileAssurity has been implemented by a variety of companies from the Union State Bank of New York to the Michigan Public Health Institute, he said.

Stephan Somogyi, the director of products for PGP Corp., said of his company's Corporate Desktop programs that, "They are about as easy to use as current technology permits." End users still need training, he said, adding, "we certainly believe that the ease-of-use can still be improved."

That's one reason Somogyi's enthusiastic about his company's new PGP Universal product. The new software, operating at the server level, allows end users to do their primary jobs, he said. The messages that should and should not be encrypted become "a choice of the IT administrator or whoever is the person making the policy for e-mail."

Somogyi also noted that many companies in the U.S. and abroad want to ensure (or are required by law to ensure) that IT staff can't access and read internal e-mails that are sent from, say, the legal department to the personnel department. PGP Universal is designed to protect e-mails even at this intra-company level, he said.

In response to the need for secure communications without any end user action, ArticSoft officials say they will soon release a new product called Central Administrator. This server-level program will enable admins to set encryption policy without installing any software on client machines, they said.

Conclusion