Avoid Sending Sensitive Information Over Email

A single oversight can potentially nullify the effectiveness of your cybersecurity measures. For instance, even if you've implemented security measures like multifactor authentication, a phishing scam or certain malware variants could grant unauthorized access to your email, compromising all the data stored in your inbox.

The severity of these attacks escalates, particularly when sensitive information is exchanged through emails. Once hackers gain access, they have unrestricted visibility into all the information. Let's go into the types of data that should never be casually stored in an email for precisely this reason.

What Types of Information Should Never Be Stored in an Email?

Various categories of data should not be included in emails for several reasons. Firstly, emails are inherently unprotected, and we've previously highlighted the ease with which a user's email content can be illegitimately accessed. Moreover, your control is limited to your own inbox. An email's duration in someone else's inbox is unpredictable, providing ample time for the information it contains to be pilfered.

It is crucial that certain types of information are exclusively shared through secure means, and any emails containing them should be promptly deleted. We can establish rules (based on your Microsoft 365 license) to periodically scan for such information and attempt to delete messages containing it. Nonetheless, constant vigilance is essential to ensure that these types of data are not sent or stored in the body of an email or as an attachment.

• Government-Issued ID Numbers - Whether from a driver's license, Social Security number, passport, or any other government-issued identification, this data can serve as a key to open numerous doors for a cybercriminal, granting them significant power.
• Bank/Financial Account Numbers - Access to an email containing the numbers identifying a user's financial accounts puts attackers halfway to accessing those accounts. This information could enhance the effectiveness of phishing attacks.
• Credit/Debit Card Numbers - Continuing the trend, cybercriminals gaining access to these numbers can make fraudulent purchases, with no consequences for themselves.
• Protected Health Information - Access to this data infringes on a person's privacy and could be exploited to make life challenging. Additionally, these records often contain a wealth of personally identifiable information, amplifying the impact of their theft. Healthcare information is one of the most protected types of data, under several compliance standards.
• Documents Protected by Attorney-Client Privilege - Similar to health information, these documents contain significant sensitive data, and their privacy is legally protected. Exceptions to this privilege are rare and do not include cybersecurity incidents.
• Passwords or Authentication Credentials - Completing the list, sharing passwords or authentication credentials via email is a significant risk. Cybercriminals gaining access to these details can potentially compromise all the aforementioned resources.

It's extremely important for you and your team to keep this list in mind when using email. Additionally, it is not sufficient; robust cybersecurity measures are imperative to safeguard sensitive information. If you would like some help outlining your business’ security strategy contact the IT professionals at Quercus IT today at (780) 409-8180.