I had a similar exercise that I went though a couple of years ago with a former employer (10k+ primarily non-technical user base, financial services company, approx 1mm outbound messages per day including automated processes, approx 30%+ contained sensitive info like acct numbers and SSNs that needed to be encrypted, and recipients were a mix of corp users and users that used free email accts as their primary address).
Email was pretty much the file transfer mechanism of choice for the business (for better or worse).
Major issues from my team (Info Sec): 1) how do we stay out of the key management business (anybody that has been to the key ring, PKI, certificate, etc. management barbecue knows what I am talking about here) 2) that we get all the mail off of our systems at the time of delivery (basically, in the wild world of e-discovery, we did not want to have to get into managing other company's 'sensitive emails') 3) no software required on the recipient's machine
I have used, tinkered with, been burned by, loved, and hated pretty much all the top players in this space... but based on our requirements and my personal motivation to just solve my email encryption problem and go back to my other work without needing to tie up resources to support users that were now using the implementation... I went with Voltage (http://www.voltage.com). It took two change control windows to get it into prod (one to test, and one to go live). For the sensitive email traffic that was not handled by gratuitous SSL/TLS (roughly 100k+ messages per day) we used Voltage at the gateway with users entering a key word in the subject line to encrypt. It took a little bit of training and some internal showing of dirty laundry, but users eventually caught on... and within about 3mos of implementation we were dealing with high 100s to low 1000s of user violations. We could have dropped the number to 0 by rigging our DLP product into the mix and forcing all remaining sensitive data flagged by our DLP solution to go through Voltage, but the business was happy with the drop in violations and did not want to do that.
In short, we dropped our plain text email violations from about 300k+ per day to about 1k per day, nobody had to do the key management dance, and no residual customer email was left in our environment. As a side note, Voltage also has a SAAS product that is completely managed by them that we referred our power recipients and business partners off to... once again, no work there for me or my team.;) At the time that I left, we had the solution in play for 3 years and only had about a half a dozen support tickets opened on the solution - and basically, they were from users that did not read the web page they were looking at.
Hope this gives a decent data point for your issue.
Slashdot Mirror
I had a similar exercise that I went though a couple of years ago with a former employer (10k+ primarily non-technical user base, financial services company, approx 1mm outbound messages per day including automated processes, approx 30%+ contained sensitive info like acct numbers and SSNs that needed to be encrypted, and recipients were a mix of corp users and users that used free email accts as their primary address).
;) At the time that I left, we had the solution in play for 3 years and only had about a half a dozen support tickets opened on the solution - and basically, they were from users that did not read the web page they were looking at.
Email was pretty much the file transfer mechanism of choice for the business (for better or worse).
Major issues from my team (Info Sec):
1) how do we stay out of the key management business (anybody that has been to the key ring, PKI, certificate, etc. management barbecue knows what I am talking about here)
2) that we get all the mail off of our systems at the time of delivery (basically, in the wild world of e-discovery, we did not want to have to get into managing other company's 'sensitive emails')
3) no software required on the recipient's machine
I have used, tinkered with, been burned by, loved, and hated pretty much all the top players in this space... but based on our requirements and my personal motivation to just solve my email encryption problem and go back to my other work without needing to tie up resources to support users that were now using the implementation... I went with Voltage (http://www.voltage.com). It took two change control windows to get it into prod (one to test, and one to go live). For the sensitive email traffic that was not handled by gratuitous SSL/TLS (roughly 100k+ messages per day) we used Voltage at the gateway with users entering a key word in the subject line to encrypt. It took a little bit of training and some internal showing of dirty laundry, but users eventually caught on... and within about 3mos of implementation we were dealing with high 100s to low 1000s of user violations. We could have dropped the number to 0 by rigging our DLP product into the mix and forcing all remaining sensitive data flagged by our DLP solution to go through Voltage, but the business was happy with the drop in violations and did not want to do that.
In short, we dropped our plain text email violations from about 300k+ per day to about 1k per day, nobody had to do the key management dance, and no residual customer email was left in our environment. As a side note, Voltage also has a SAAS product that is completely managed by them that we referred our power recipients and business partners off to... once again, no work there for me or my team.
Hope this gives a decent data point for your issue.