“DRM protection” is often used as a synonym for copyright protection, but digital rights management is a major concern for email and other kinds of communications. Any time you’re sharing confidential business information (CBI), you need to control access — whether you’re discussing a private meeting with your colleagues, sharing IP with a client, or discussing pending litigation with your lawyer.
But traditional email security tools don’t provide real DRM. If your recipients have their accounts hijacked or their computers stolen, that data is exposed. If they decide to make and share an unauthorized copy, there’s nothing you can do about it. And even if they’re relatively careful with security, your email itself could stay archived in their folder for years, increasing the chance of future exposure.
Email Security is a Digital Rights Management Issue
We tend to think of email security in terms of encryption or Data Loss Prevention (DLP), but it goes beyond that (at least, it should). Encrypted messages don’t stop being sensitive once they reach the recipient, and just because an attachment doesn’t break DLP rules doesn’t mean it can’t be used to harm your organization. To share information safely, you need to be able to control how it is used even after you send it.
For example, if a manufacturer sends intellectual property to a prototyper, they need to ensure that information isn’t shared, edited, or leaked to anyone else. If a doctor emails patient information to a specialist, their duty under HIPAA compliance is to make sure that information is never shared, except as permitted by HIPAA and required for that patient’s treatment.
In this sense, email security requires an approach analogous to DRM protection. Like other types of DRM protected data, email messages and attachments require persistent protection that stays with the data wherever it goes. That protection needs to include multiple levels of access, so you can share access while decreasing the risks of the recipient losing control of the CBI or abusing their access.
Here’s What Email DRM Protection Would Require
There are three major requirements for email DRM protection:
- End users must be able to send and receive messages and attachments to authorized recipients, without exposing them to unauthorized actors.
- End users must remain in control of messages and attachment after the recipient accesses them.
- Administrators must be able to supervise users and data, enforce DRM protection rules, and maintain control of data, even after it’s left the organization.
Email encryption meets the first requirement, provided it works for all recipients your organization needs to communicate confidentially with. Users on any email platform should be able to decrypt messages, download attachments, and respond with their own encrypted messages and attachments without preparing ahead of time (e.g. by downloading software or signing up for a new account).
Rights control meets the second requirement. Senders should be able to stop recipients from forwarding sensitive messages or downloading confidential documents locally. To maintain control over the content, DRM protection should also enable the sender to recall the email from the recipient, and anyone the recipient has forwarded it to.
Data Loss Prevention (DLP) satisfies the third requirement. A DLP tool should allow admins to automatically scan messages for various types of sensitive content, such as Social Security numbers and keywords, and take actions to protect the information — for example, encrypting messages, stripping attachments, or warning the sender. DLP should also provide persistent rights control functionality and monitoring capabilities.
Traditional Email Security Isn’t a Complete DRM Solution
There are challenges for all three requirements. Most enterprise email encryption solutions require recipients to sign up to receive a message, and many require extensive configuration. Incomplete protection is also common. For example, most encrypted DLP solutions scan email at the sender’s server, which leaves it unencrypted during the first stage of its journey. DLP is also challenging, and many common products are difficult to configure, or have insufficient functionality or visibility.
But the biggest obstacle is with rights control. In most cases, once recipients can decrypt messages once, they can decrypt them forever. You can’t rescind access, and in most cases, you can’t even disable forwarding outside your organization. Similarly, most email solutions don’t support rights control for documents — once the recipient downloads and decrypts the attachment, you have no DRM protection. This limits the usefulness of DLP as well, since admins can’t observe or control data outside the organization.
How to Solve Email DRM Security
To solve these problems, you need an email security service that encrypts the data itself, and lets the user retain control of access. Data-centric encryption creates a persistent security barrier around each email and attachment. Data is encrypted as soon as the email leaves the sender’s account, and only decrypted on the recipient’s device, once they open the message. This can provide protection across the whole journey, providing DLP is applied on the sender’s encryption client (before the email is encrypted and sent), rather than the server.
The secret to access control is in split-key architecture — a new approach to encryption key management. In split-key architecture, the key is stored securely in a server, controlled by the sender or an encryption provider, and only the encrypted email — not a decrypted version — is sent to the recipient’s inbox.
When the recipient tries to read the message, the server consults an access policy for that email. If they’re allowed to read it, the message is unlocked for that session. The sender or admin can alter that policy at any point, to remove access to the key, or apply various DRM restrictions to the message and attachment.
Virtru DRM Protection and Email Security
With data-centric encryption and split-key architecture, Virtru can provide persistent protection, wherever your email messages and attachments go. Virtru senders and admins can see what recipients have received an encrypted email (even after it has been forwarded), and monitor who has opened or reshared it. Admins and senders can revoke secure emails with a click, preventing the user from accessing them in the future — even if they’ve already read them. Senders can also set messages to expire automatically at any point in the future.
Virtru DLP comes with an array of powerful features that continue to control access outside the organization. The PDF watermark option is particularly suited to DRM protection applications, because it allows senders to share sensitive documents without providing full access. When the feature is enabled, the PDF can only be opened in the Virtru secure reader — not downloaded locally. If the sender rescinds access, the recipient loses the PDF, along with the email. The PDF is also watermarked with the recipient’s name to discourage leaks.
Virtru can also disable email forwarding. Watermarked PDFs can only be forwarded once by default, and forwarding can be disabled entirely on any encrypted email.
These features combine into a powerful DRM security solution, allowing you to limit the risks of sharing information. Need to share proprietary information with a potential business partner, while minimizing the risk of exposing it to a competitor? Just turn on watermarking, and disable forward and set an expiration date that gives them enough time to consider your proposal. Need to discuss a confidential project with remote offices? With watermark and disable forwarding, you can ensure that only the appropriate recipients gain access.
Learn How Virtru Can Protect Your Data
Virtru offers much more for security and DRM protection. Learn more about how we can keep you in control of your data with The Complete Guide to Business Privacy.
