Sending an email via the internet is well known to be comparable to sending a postcard. Anyone who is in some way involved in the transportation process can theoretically read or even alter the contents without being detected. If one wants to prevent this when using regular mail, then the solution is to send the information in a letter secured inside a sealed envelope. The corresponding equivalent for email communication is sufficient encryption including an electronic signature. For companies such protective measures are by no means only an end in themselves – in many countries regulators expressly require businesses to ensure that personal data cannot be read, copied, altered or deleted without authorization. As a result, many enterprises use standardized procedures such as S/MIME or PGP to send offers, invoices, patient information and customer data.
Searchable archive despite end-to-end encryption
However, if emails don’t only have to be transmitted in encrypted form but also have to be archived in compliance with legal requirements, IT decision-makers often find themselves faced with a new problem. How can it be guaranteed that despite end-to-end encryption the message will remain readable throughout the archiving period? When an email is stored in an archive in an encrypted form, it can only be decrypted again by using the recipient’s private key. This is especially challenging if the recipient concerned has already left the company or has received a new private key for encryption in the meanwhile. With legally binding duties to preserve records of several years or more, either scenario is far from unlikely.
Retrieving archived emails without a private key
It is considerably easier to archive and retrieve emails if the end-to-end encryption has already been decrypted prior to physically archiving the messages. To achieve this, the decryption of the message must not take place only after reaching the user’s client, but rather centrally via the email security solution. Only following this is the email placed in the archive. As a result, no private key management is required any longer for the archiving itself. This means that retrieving an archived email is possible at any time – irrespective of whether the relevant private key still exists. In order to protect the archive itself from unauthorized access, it can of course be safeguarded by means of a company key and corresponding encryption in turn. Find out more about Retarus E-Mail Security and Email archiving options here or directly from your local Retarus contact person.
