[PLUG-TALK] Cisco Secure Email Encryption Service (CRES)

[James Bertelson]

Just my experience... This particular secure email solution others like it are used in the healthcare industry to share PHI with vendors as needed alongside fairly advanced phishing training. Reason being SMTP can never be reliably secure end to end so the actual data has to transport over HTTPS.

Asking the end users to use PGP would be my preference, and some vendors like mine are moving in that direction at least among technical staff when moving data around. 

> On Mar 19, 2021, at 11:34 AM, Ash (Richard) Powell <rpowell at lucidheart.com> wrote:
> 
> I know this isn't a security list, and there's probably better lists to pose this question to.  But, despite my limited active conversation here, I feel more comfortable here (Portland locals) than the global/larger lists.
> 
> After conducting a security awareness training about phishing scams, someone on my billing department ran this by me to be safe.  And I was somewhat shocked to see that a reputable company such as Cisco has a product where they encourage people to save .html files with Javascript in them to their local machine, and then to open those files and enter their password.  I understand browser developers have probably made great strides in "sandboxing" Javascript in a browser.  But I remember the days when running an html file with Javascript from a local machine would enable the script to run in the context of that local computer, rather than the sandbox.  It was some scary shit, and still is for me.
> 
> Anyway.  I have always cautioned users against opening and running attachments that run code.  So what the hell?  Has Cisco just thrown this recommendation out the window for me?  Do I need to now monitor these things on a case by case basis for my company employees?
> 
> Just looking for thoughts.  Am I overreacting?  Should I reevaluate my understanding on opening html email attachments?
> 
> _______________________________________________
> PLUG: https://pdxlinux.org
> PLUG-talk mailing list
> PLUG-talk at pdxlinux.org
> http://lists.pdxlinux.org/mailman/listinfo/plug-talk