Its coming

1
Its coming
Internet Email security has been elusive

• PHI over the Internet should be encrypted
• Between the Email systems of organizations
  (business-to-business, or B2B)
• Between organizations and individuals
  (business-to-customer, or B2C)
• Most organizations are not using secure
  (encrypted) Email
• Perceived lack of technical solutions
• Cost
• Requires partner cooperation

2
Its coming
Emerging solutions

• Gateway-to-gateway for B2B (standards based)
• Webmail for B2C
• Choice of vendors
• Many products support both

3
Its coming
Webmail

• Sender operates in own email system
• Recipient establishes account on senders system
• Recipient operates on senders system via browser
• Good for B2C
• Good for the B dealing with many Cs
• Not so good for the C dealing with many Bs

4
Its coming
Gateway-to-gateway

• Email software encrypts messages as leave
  organizations (at the gateway to the internet)
  and decrypt when entering the receiving
  organization
• Both parties operate only in own email systems
• Users not involved in setup
• Requires trust between organizations
• Encryption between not within organizations
• Good for B2B
• No good for B2C

5
Its coming
Wisconsin State Agencies

• Tumbleweed contract
• Implement this fall
• 36,000 email accounts
• Estimate 30 encrypted
• Support B2B gateways (SMG or TLS) or B2C Webmail
• 300,000 purchase, 76,000 annual

6
Its coming
Wisconsin State Agencies

• Encryption by policy or user selection
• State users only use Outlook client
• Partners use own email system for B2B or State
  Webmail site for B2C

7
Its coming
Wisconsin State Agencies

• Policy determines encryption need based on
• Message or subject content (keywords)
• Recipient
• Recipient organization (domain)

8
Its coming
Wisconsin State Agencies

• Tumbleweed determines encryption approach based
  on knowledge of recipient
• Uses SMG or TLS gateways if established between
  orgs
• Reverts to Webmail if gateways not supported

9
Its coming
State agencies will begin requiring secure email

• Partners participate by
• Using states Webmail service (ok for small
  volumes and if not too many others require same)
  OR
• Establishing gateway-to-gateway connections by
• Turning on features in their existing email or
  encryption software that supports SMG or TLS
• Acquiring email or encryption software that
  supports SMG or TLS

10
Its coming
Testing is a challenge

• Insufficient expertise
• In email
• In secure email
• In particular products
• Experts unavailable
• No test systems (test on production email
  systems)
• Requires partners

11
Its coming
Summary

• Secure email can be done
• Some partners will start expecting it
• Webmail is okay for some situations (B2C)
• B2B (i.e. gateway-to-gateway) better for higher
  volumes and efficiency with many partners
• Testing is a challenge