Scrambling for safety

Home Office Computing, Oct, 1998 by David Haskin

IF YOU'RE LIKE MOST PEOPLE, YOU wouldn't dream of going to bed without making sure the front door is locked. And yet chances are you send sensitive information across the Internet without the slightest regard for security.

"If you e-mail something like a business plan or a legal negotiation, you're playing with fire if you don't use encryption," says Mark Levitt, director of research at International Data Corp., a Framingham, Mass., research firm. It adds a step to the e-mail process, but for some home-based workers, it's worth it.

In general, encryption software scrambles your e-mail, making it unreadable to anyone other than the intended party. Many popular e-mail programs--including Microsoft Outlook and Outlook Express--have basic built-in encryption, but it's not hacker-proof and it's not universal. If your e-mail service doesn't encrypt messages, or if you're concerned about the level of security it provides, it may be time to look into third-party software.

Here's how most e-mail encryption programs work: Just like locking and unlocking a door, you encrypt and decrypt files with a key. In this case, the key is a series of digital characters; the longer the key, the more difficult it is to crack. With simple encryption programs, the key consists of a single password shared by the sender and recipient. A more secure method uses both public and private keys. The sender encrypts the message using a public key previously sent by the recipient. To decrypt the message, the recipient uses a private key to which only she has access.

The following three programs, all available for download from the Web, use public key/private key encryption. They also employ digital signing, which verifies that both you and your recipient are who you claim to be.

PGP for Personal Privacy (www. mcafee.com; $39) integrates itself into the menus of Microsoft Outlook and Outlook Express, Eudora Pro, and Claris Emailer. It's slightly more complex to use than other encryption programs, however. InvisiMail (www.invis imail.com; $29.95) is a no-brainer to install and use, and you can send a free, scaled-down version to recipients so they need not buy the program. The downside is slow operation compared to other encryption packages. SynCrypt (www.syncrypt.com; $49.95) encrypts messages and any other files on your system with a simple click of a toolbar button. However, it doesn't automatically encrypt file attachments.

Though it does offer peace of mind, installing and using encryption software takes time and money and isn't always necessary. "Most e-mail isn't really sensitive," acknowledges Levitt. "It might be personal or even embarrassing, but it's not necessarily worth encrypting." So before you encrypt your mail, here are some questions to ask yourself.

What is the potential damage if information falls into the wrong hands? Use encryption when it would be harmful to your business if competitors got their hands on the contents of the message. Also, beware of internal prying eyes. For instance, telecommuters should encrypt personnel-related mail sent to the human resources department.

Will others participate? Both the sender and the receiver must install the same encryption program. For home-based workers, that means clients and colleagues must buy in. Telecommuters must convince their MIS department, colleagues, and outside contacts to use encryption.

How much security is necessary? Most e-mail programs with built-in security use the S/MIME encryption protocol. This is a significant deterrent but is breakable by determined hackers. Third-party encryption programs typically use stronger algorithms such as Triple DES and Blowfish.

Will I be sending encrypted messages overseas? The U.S. government limits the export of the strongest encryption software. If you exchange secured messages internationally, make sure your correspondents can legally obtain the encryption program.