Question

A security architect is implementing security measures in response to an external audit that found vulnerabilities in the corporate collaboration tool suite. The report identified the lack of any mechanism to provide confidentiality for electronic correspondence between users and between users and group mailboxes.

Which of the following controls would BEST mitigate the identified vulnerability?

A. Issue digital certificates to all users, including owners of group mailboxes, and require S/MIME with AES-256.
B. Federate with an existing PKI provider, and reject all non-signed emails
C. Implement two-factor email authentication, and require users to hash all email messages upon receipt
D. Provide digital certificates to all systems, and eliminate the user group or shared mailboxes

Answer 1

Issuing digital certificates and requiring S/MIME with AES-256 for all users is the best control to provide confidentiality for electronic correspondence. This provides end-to-end encryption and secures emails against unauthorized interception.

Step-by-step explanation:

The recommended control that would best mitigate the identified vulnerability of lacking a mechanism to provide confidentiality for electronic correspondence in a corporate collaboration tool suite is to issue digital certificates to all users, including owners of group mailboxes, and require S/MIME with AES-256. This method secures emails by providing end-to-end encryption and ensures that only the intended recipients can read the emails. Implementing this measure offers a strong layer of security against the interception of sensitive information by unauthorized entities.

Digital certificates serve as a method of confirming the identity of users and devices, allowing for secure and private communications within the system. When accompanied by S/MIME (Secure/Multipurpose Internet Mail Extensions), which provides message integrity, authentication, and privacy through encryption, emails are protected with a high standard of confidentiality.

Other options such as federating with an existing PKI provider or implementing two-factor email authentication could also improve security but are not as directly related to protecting the confidentiality of email correspondence as the use of S/MIME with strong encryption like AES-256.