Note: This Article only applies to Exchange 2007 clients and Exchange 2010 clients that signed up before 3/29/2012.
Q: Is email encryption available with all versions of Exchange?
A: Email Encryption is available with Exchange 2007 and higher.
Q: Do I have to enable every Exchange user with Encryption?
A: No. After enabling the service you can choose to enable individual users.
Q: Does encryption work on a mobile device?
A: Yes, email encryption is enabled server-side. Therefore, emails can be encrypted using mobile devices, Outlook Web Access, and all email clients that are compatible with Exchange 2007.
Q: How do I enable users with email encryption?
A: To enable email encryption in the control panel:
- Click on the Email Encryption tab in the menu (Please Note: Hosted Exchange email service must first be enabled to view this tab).
- Click ‘Enable Encryption’ to enable email encryption for your company.
- You may now use the interface to provision individual users with email encryption.
- Select ‘save changes’. A welcome email is available and can be sent to each user. This is optional, but recommended.
Q: How do I send an encrypted message?
A: To send an encrypted message:
- First, ensure your account is enabled for email encryption. Only accounts enabled with the email encryption service will be able to send encrypted messages.
- Create a new message using the hosted Exchange email service.
- Begin the subject of your email with the word “[encrypt]” (without quotes). Then you may add your normal subject. If you choose to use the Outlook email encryption plug-in, you can skip this step.
- Type your message, include any attachments, and send. If you’re using the Outlook plug-in, you can simply click the ‘send securely’ button. This will have the same effect as typing [encrypt] into the subject line.
Q: How does the recipient view the message?
A: To view the encrypted message:
- The recipient will receive a message with an attachment.
- By opening the attachment, the recipient will be directed to a secure website.
- During the first login, the recipient will be asked to create a password.
- Once logged into the secure website, the recipient will have the ability to read, reply to, or forward the encrypted message.
- Any messages sent from the web portal (replied or forwarded) will be delivered as encrypted emails.
- Forwarded messages can only be sent to the sender or recipient’s domain.
Q: Can I set rules to automatically encrypt messages based on key words?
A: To automatically encrypt emails based on content, you can add any of our content scanning policies. When activated through the control panel, these policies will look for dictionary terms included in the email, including attachments. If a dictionary terms is found, the message will be automatically encrypted. The automatic content scanning policies help companies to comply with regulations and company policies.
Content scanning policies:
- Health Insurance Portability and Accountability Act (HIPAA): Protects health information. This policy looks for Social Security Numbers (SSN) along with any HIPAA or ICD-9 related Dictionary Terms and automatically encrypts the message.
- Social Security Number (SSN): Looking for SSN in the subject field or within 20 characters of a SSN dictionary term and automatically encrypts the message.
- Payment Card Industry (PCI): Protects credit card information. This policy looks for a credit card number within 20 characters of a term from the credit card dictionary and automatically encrypts the message.
- Gramm-Leach-Bliley Act (GLBA): Protects ABA Routing Information. This policy looks for ABA Routing or CUSIP numbers within 20 characters of a dictionary term and automatically encrypts the message.
Q: What recipient options are available when reading/replying to a message?
A: Three options – all based on policy:
• Reply: Reply back to sender of the encrypted message or initiate message to an internal user.
• Reply All: Reply back to all recipients and sender of the encrypted message.
• Forward: For security reasons, encrypted messages can only be forwarded to mailboxes either on the sender’s or recipient’s domain.
Q: Can I modify the content dictionaries?
A: The encryption policies are monitored and updated by Proofpoint.
Q: Once the service is enabled, are all outbound messages routed through the encryption gateway?
A: Yes. Encryption uses the Outbound Relay service to send all outbound mail to the encryption gateway servers for content scanning. If you would like to enable encryption, but are currently using a service that requires Outbound Relay, you will need to disable Outbound Relay before enabling encryption.
Q: Can I encrypt email sent to internal users?
A: The email encryption service encrypts email at the SMTP gateway; therefore, messages sent internally are not available for encryption. However, if the email is sent to an internal recipient AND an external recipient, the message would be encrypted for the external recipient, and would not be encrypted for the internal recipient.
Q: Will I need to remember an encryption key?
A: No. The Encryption is based on symmetric key cryptography, with a unique key for every message. The keys are stored and managed by the Proofpoint Hosted Key Service. By leveraging the on-demand cloud infrastructure, we can deliver a secure, cost efficient, high availability, and fully redundant key service.
Q: What type of encryption is used?
A: Email Encryption uses a symmetric key system which utilizes AES256 to encrypt the message.
Q: Is this a certificate-based system?
A: No, Email Encryption uses a symmetric key infrastructure allowing for complete ad hoc secure communications. No pre-registration or prior contact of any kind is necessary to send an encrypted message to any SMTP address.
