US government updates secure email guide for first time in a decade

The US government's technology agency has updated its secure email guide for the first time in a decade and put it out for a month of public comment. The National Institute of Standards and Technology (NIST) guide [PDF] is 81 pages long and provides a surprisingly useful rundown on what to do to get your email secure. Its top …

[Anonymous Coward]

1. Don't use servers based in US, or owned by a US company anywhere.

[Herby]

Copy requested...

Please send to [e-mail]

Maybe not so much of a joke!!

[Martin Summers]

Re: Copy requested...

How very rude! I don't think you're going to get Hillary on that particular address,something quite different possibly.

[Adam 1]

Re: Copy requested...

Herby's?

[Mark 85]

So this agency is coming out and encouraging encryption? I'm shocked that the FBI hasn't been by to persuade them to the FBI line of thought. We really need a scorecard for this... some agencies for better encryption and some not. Although with all the election rhetoric, it'll come down to Congress listening to the fear mongers as usual.

[energystar]

NIST is also in the right track.

Congratulations :)

[Anonymous Coward]

Updated Secure e-mail Guide:

Don't use e-mail.

Send you communications by Carrier Pigeon instead.

[allthecoolshortnamesweretaken]

Re: Updated Secure e-mail Guide:

Carrier pigeons are very easy to intercept.

[tfewster]

Re: Updated Secure e-mail Guide:

Oh no they aren't!

https://www.youtube.com/watch?v=sj6-LG5VpGk

AND there's a standard

https://www.ietf.org/rfc/rfc1149.txt

[brotherelf]

Re: Updated Secure e-mail Guide:

Or steganographic pigeons, hidden in meat pies! Scrambled and hidden, I hear the brits deployed a similar equine-based system a while back.

[cantankerous swineherd]

just seen the words secure and email in the same sentence.

[a_yank_lurker]

Oxymoron

Secure email is the league of oxymorons like military intelligence.

[Velv]

Re: Oxymoron

the old comparison being "Military intelligence is to intelligence what military music is to music"

[John Smith 19]

As always in IT "It depends"

Are you running the system for you staff, or to email outsiders? Relevant if you're LM or Boeing or BP. Small companies on one site, not so much.

Do you management think keeping all email (not just their personal ones) private is important?

Will management invest if they find the current system can't do the job?

Are there products and services you can trust to do the job (and afford) that you can buy if the current system can't cut it?

[Version 1.0]

Secure email

Securing the mail server isn't that hard if you are willing to make an effort - it's securing the users that's the real problem - serious security tends to make life harder for your users and, while they will usually not devote much effort to following recommended security procedures, they are often wiling to devote quite a bit of effort to work around them.

And the NSA adds in a footnote, whatever you do, don't use an iPhone - even the FBI can break into those.

[Anonymous Coward]

Re: Secure email

"And the NSA adds in a footnote, whatever you do, don't use an iPhone - even the FBI can break into those."

"don't use an iPhone, running on old hardware using an out of date OS - even the FBI can break into those."

[All names Taken]

The best of it is?

That here in the UK central guvmint, local guvmint, voluntary sector, ... organisations tell you that your data are confidential.

Then say "Can we email you that (confidential) report."

Or even worse still?

"Yeh, I'll scan it and send it to main office/sub-office/partner/ ... by email attachment.

If asked do they use encryption

"What's that? Oh password protected - no we can't send or receive any password protected emails - policy innit"

Sort of undermines Private & Confidential stamp that they put on things no?

Or is it just me?

PS: my insurance agency at least makes the attempt to password protect documents that I give permission to be sent by email attachments.

[Anonymous Coward]

Re: The best of it is?

Oh password protected - no we can't send or receive any password protected emails - policy data protection innit

[Anonymous Coward]

ISTNay Encryptionay!!!

...that or just use AOL and Yahoo! email if you're a lowly functionary like the Chief of the CIA or the Director of National "Intelligence". HEY! Standards are meant to be broken. Just like encryption. At Night. Mostly.

[jake]

Whatever.

My take on the subject:

"Don't use email for anything you wouldn't shout from the rooftops!"

[Anonymous Coward]

Or....

...move to as many of people to Protonmail and stick to fingers up at the US government.

[amanfromMars 1]

Catch 42

Security systems and secretive societies have as a much, if not even more of a problem and/or opportunity, with emails to and/or about them, and to myriad others, which are not encrypted and which carry in plain sight text, information and intelligence which vulnerable and compromisable parties would rather not become widespread general knowledge.

The fact is compounded and strengthened by such vulnerable, compromisable parties, in ways which can be suddenly catastrophic to those parties, if they choose not to engage in a spirit of mutual advantage with such intelligence in state or non state actors, for that non action is an open invitation for information to flow directly elsewhere to what might be considered opposition and competition, where it can surely be used to initial contacts’ great disadvantage.