S/MIME

S/MIME was initially proposed by RSA Data Security, Inc. in 1995. Soon after, major email providers and web developers adopted the protocol. Today, the Internet Engineering Task Force (IETF) S/MIME Working Group coordinates S/MIME development.

What is S/MIME?

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is an email encryption protocol used to prevent unwanted access. In a sense, S/MIME adds a padlock to email messages.

Individuals and enterprises can both use S/MIME encryption through most email services, including Microsoft Exchange. Government entities are also increasingly using S/MIME encryption.

How Does S/MIME work?

S/MIME Encryption

S/MIME uses asymmetric cryptography to encrypt emails. This type of cryptography pairs a public key with a private key. Outbound emails are encrypted with the recipient's public key. They can only be decrypted with the paired private key, which should only be accessible by the recipient. This process ensures that the intended recipient is the only person able to view the email content.

Note that the protection afforded by S/MIME is an added layer of security on top of encryption from email providers. Google, for example, encrypts messages that are sent to Gmail. However, without S/MIME protection, emails are still left unprotected while in transit or when sitting in the sender's outbox.

Digital Certificates & Signing

Full S/MIME protection requires digital signatures attached to digital certificates, which add authority to internal and external communications. Digital signatures also help users ward off email phishing attempts.

Digital certificates are security tools that verify the sender's identity and ensure a message hasn't been altered in transit. Applications like ArcESB create these certificates.

Signing emails with digital certificates adds further privacy protection, though that protection is limited unless both the recipient and sender hold digital certificates.

Individual (private) keys and certificates must be obtained and installed before S/MIME encryption can be used. Encryption can only occur when the destination party's certificate is stored, a process that should take place automatically when an email is received by a party holding a valid signing certificate.

Each time an email is sent, the sender's private key applies the unique digital signature attached to the sender's digital certificate. When the recipient opens the email, the sender's public key is used to verify the signature.

The result is twofold. First, digital signatures ensure the sender actually sent the email. This verification helps fend against phishing attacks involving spoofed email accounts. Second, digital signatures attached to digital certificates prevent outsiders from intercepting email content. Emails are protected to and from the encrypted server.

However, digital certificates don't necessarily protect the emails themselves. Emails sitting in an inbox are still vulnerable to hacking. For example, hackers could access a company's email system and read messages that are stored or passing through other servers.

Installing S/MIME

While details of the installation process vary by email provider, the same basic steps apply across the board.

1. Obtain a digital certificate (ArcESB can generate this for you or you can obtain one through a network administrator).
2. Install the certificate.
3. Install an S/MIME control if needed (many operating systems include an S/MIME control by default).
4. Go through the S/MIME control settings and link the digital certificate.
5. Send a test email and troubleshoot errors if the digital certificate is not attaching.

How Secure Is S/MIME?

S/MIME encryption helps to establish integrity, protect data privacy and sensitive data, and mitigate phishing attacks. Without the addition of a digital signature, however, it is virtually impossible to determine where an email originated. In an ideal world, all emails would be protected with both S/MIME encryption and digital signatures.

While it's possible for an uncertified sender to send encrypted messages using the destination party's certificate, S/MIME clients require users to install their own certificates before they allow encrypting to others.

Scanning Malware

Even with S/MIME protection, email is still vulnerable to malware because the protocol is tailored for end-to-end security. Encryption applies not only to email messages, but also to any attached malware. If a message is not scanned for malware at a company's gateway, before it is delivered, encryption will defeat the detector and successfully deliver the malware. Therefore, malware scanning needs to take place before key points; when sending a message, malware scans must take place before decryption and sending, and when receiving a message, malware scanning must occur prior to opening and decrypting the message.