Security Blog
The latest news and insights from Google on security and safety on the Internet
Hosted S/MIME by Google provides enhanced security for Gmail in the enterprise
2 лютого 2017 р.
Posted by Nicolas Kardas, Gmail Product Management and Nicolas Lidzborski, G Suite Security Engineering Lead
We are constantly working to meet the needs of our enterprise customers, including enhanced security for their communications. Our aim is to offer a secure method to transport sensitive information despite
insecure channels with email today
and without compromising Gmail extensive protections for spam, phishing and malware.
Why hosted S/MIME?
Client-side
S/MIME
has been around for many years. However, its adoption has been limited because it is difficult to deploy (end users have to manually install certificates to their email applications) and the underlying email service cannot efficiently protect against spam, malware and phishing because client-side S/MIME makes the email content opaque.
With Google’s new hosted S/MIME solution, once an incoming encrypted email with S/MIME is received, it is stored using
Google's encryption
. This means that all normal processing of the email can happen, including extensive protections for spam/phishing/malware, admin services (such as vault retention, auditing and email routing rules), and high value end user features such as mail categorization, advanced search and
Smart Reply
. For the vast majority of emails, this is the safest solution - giving the benefit of strong authentication and encryption in transit - without losing the safety and features of Google's processing.
Using hosted S/MIME provides an added layer of security compared to using SMTP over TLS to send emails. TLS only guarantees to the sender’s service that the first hop transmission is encrypted and to the recipient that the last hop was encrypted. But in practice, emails often take many hops (through forwarders, mailing lists, relays, appliances, etc). With hosted S/MIME, the message itself is encrypted. This facilitates secure transit all the way down to the recipient’s mailbox.
S/MIME also adds verifiable account-level signatures authentication (versus only domain-based signature with DKIM). This means that email receivers can ensure that incoming email is actually from the sending account, not just a matching domain, and that the message has not been tampered with after it was sent.
How to use hosted S/MIME?
S/MIME requires every email address to have a suitable certificate attached to it. By default, Gmail requires the certificate to be from a publicly trusted root Certificate Authority (CA) which meets
strong cryptographic standards
. System administrators will have the option to lower these requirements for their domains.
To use hosted S/MIME, companies need to upload their own certificates (with private keys) to Gmail, which can be done by end users via Gmail settings or by admins in bulk via the Gmail API.
From there, using hosted S/MIME is a seamless experience for end users. When receiving a digitally signed message, Gmail automatically associates the public key with the contact of the sender. By default, Gmail automatically signs and encrypts outbound messages if there is a public S/MIME key available for the recipient. Although users have the option to manually remove encryption, admins can set up rules that override their action.
Hosted S/MIME is supported on Gmail web/iOS/Android, on Inbox and on clients connected to the Gmail service via IMAP. Users can exchange signed and encrypted emails with recipients using hosted S/MIME or client-side S/MIME.
Which companies should consider using hosted S/MIME?
Hosted S/MIME provides a solution that is easy to manage for administrators and seamless for end users. Companies that want security in transit and digital signature/non-repudiation at the account level should consider using hosted S/MIME. This is a need for many companies working with sensitive/confidential information.
Hosted S/MIME is available for
G Suite Enterprise edition
users.
Немає коментарів :
Дописати коментар
Мітки
#sharethemicincyber
#supplychain #security #opensource
AI Security
android
android security
android tr
app security
big data
biometrics
blackhat
C++
chrome
chrome enterprise
chrome security
connected devices
CTF
diversity
encryption
federated learning
fuzzing
Gboard
google play
google play protect
hacking
interoperability
iot security
kubernetes
linux kernel
memory safety
Open Source
pha family highlights
pixel
privacy
private compute core
Rowhammer
rust
Security
security rewards program
sigstore
spyware
supply chain
targeted spyware
tensor
Titan M2
VDP
vulnerabilities
workshop
Archive
2025
черв.
трав.
квіт.
бер.
лют.
січ.
2024
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2023
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2022
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2021
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2020
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2019
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2018
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2017
груд.
лист.
жовт.
вер.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2016
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2015
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
січ.
2014
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
квіт.
бер.
лют.
січ.
2013
груд.
лист.
жовт.
серп.
черв.
трав.
квіт.
бер.
лют.
січ.
2012
груд.
вер.
серп.
черв.
трав.
квіт.
бер.
лют.
січ.
2011
груд.
лист.
жовт.
вер.
серп.
лип.
черв.
трав.
квіт.
бер.
лют.
2010
лист.
жовт.
вер.
серп.
лип.
трав.
квіт.
бер.
2009
лист.
жовт.
серп.
лип.
черв.
бер.
2008
груд.
лист.
жовт.
серп.
лип.
трав.
лют.
2007
лист.
жовт.
вер.
лип.
черв.
трав.
Feed
Follow @google
Follow
Give us feedback in our
Product Forums
.
Follow
Немає коментарів :
Дописати коментар