“Encryption is easy, but decryption is hard.” This quote from Virtru summarizes the challenge of balancing usability and security in email ecosystem: Email remains a popular means for communicating sensitive data as it is widely used and easily accessible. However, as consumer application and data breach scenarios suggest, encryption does not just mean moving bits and bytes around. Encryption cannot outweigh the inconvenience or lack of usability that comes with such security practices, and this quote captures that tension well. News that Google had added a new encryption feature for Gmail business users was met with eye rolls around the cybersecurity block. The phrase “end-to-end encryption” (E2EE) has a lot of clout but Google’s version doesn’t measure up to the gold standard privacy pros and IT types associate with real E2EE.
At the heart of Google’s method is a process that encrypts emails at the sender’s browser, whether it’s Chrome, Firefox or another, and keeps them in that form when they pass from server to server. The message is then decrypted in the recipient’s browser once the message is received. While this protects data in transit, it’s missing the essence of true E2EE: encryption that remains when the data is in a resting state. This is significant because, as Virtru explains, “TLS encryption is like using a secure courier service,” whereas E2EE is comparable to putting your sensitive data in a lockbox that only the sender and recipient can open.
Google’s S/MIME end-of-life decision stands out as significant. S/MIME, an established standard for encrypted email, has long been criticized for being overly complex. S/MIME requires organizations to handle X.509 certificates that they receive from certificate authorities, which is a very resource-intensive and coordinated process. For many businesses and government agencies, this has meant sacrificing agility at the altar of compliance.
Google has come up with a solution that it hopes will make encryption easier to deploy, addressing pain points that have plagued S/MIME. But this convenience comes with trade-offs. But unlike S/MIME, which does its heavy lifting using asymmetric cryptography, with public and private keys used together to deliver both authentication and confidentiality, Google’s approach relies on browser-centric encryption that doesn’t come with the same stringent safeguards. It begs the question whether the new Gmail feature actually fulfills the exacting standards governed by regulations like HIPAA and DFAR in industries like healthcare and defense.
The difference between E2EE and transport-layer security (TLS) can be significant for IT admins and cybersecurity nerds. TLS, which is only applied during data in-transit, leaves the data vulnerable once at its destination, according to Virtru. C. In other words, all data is protected with E2EE from the moment it is created until the moment the intended recipient has accessed the data no intermediary can view or modify the data. That’s why E2EE is called the gold standard for sensitive communication.
The difficulties of achieving true E2EE are non-trivial. According to Sectigo, due to the careful management necessary for S/MIME certificates, such as including key escrow and exchange systems to store and distribute cryptographic keys, Given that complexity, many organizations have put off adoption even though the protocol has a solid track record of preventing spoofing, phishing and even man-in-the-middle attacks. Although Google’s solution is more user-friendly, it does not entirely get rid of the aforementioned risks, especially in cases where email data needs to stay secure at rest.
For those who work in industries facing a changing email security terrain, the debate surrounding Google’s encryption feature highlights a larger question: What amounts of protection are appropriate for sensitive correspondence? Google’s method meets fundamental compliance needs but lacks the specificity and durability that advanced solutions such as Virtru provide. As Jason Karn of Total HIPAA explains, “Just having data encrypted point-to-point doesn’t solve the problem. If that’s all it took, then Gmail, Google Workspace, and Office 365 would be sufficient. The real issue is, ‘What do you do when you send PHI to the wrong person?’ Virtru is a minimal expense for the security and safety it provides.” This is an illustration of the benefit of features like the ability to revoke access, the ability to track who is looking at documents features that are beyond just encryption that provide real-world use cases.
In the end, the decision between convenience and complete security is determined by what the organization requires. For some, Google’s new feature could be a leap forward in deploying encryption without headache. For others, it may be insufficient to properly protect sensitive data in a more sophisticated threat environment. As DigiCert points out, “The best S/MIME platform isn’t a standalone tool. It’s part of a unified solution for all your certificates.” Such a holistic approach to digital trust might just be the balance that IT administrators and cybersecurity professionals crave.
No email security solution is 100% effective. Each has its own strengths and weaknesses. Google’s Encryption feature is no exception a streamlined alternative to S/MIME adds some frictionless E-mail Encryption to your inbox while generating important conversation around the evolution of secure messaging. For tech-savvy professionals, comprehension of these subtle distinctions is integral to making smart choices regarding how to safeguard an organization’s most prized income: Its data.
