E-mail you can bank on

The need for banking regulators to communicate securely with one other and with banks is apparent, and e-mail is a primary medium.'The question of secure e-mail has been coming up over the last five years,' said Mary Beth Quist, senior vice president of the Conference of State BankingSupervisors (CSBS).When breaches of sensitive personal data began making news, the issue took on greater urgency. None of the regulators wanted to open a newspaper one morning and see himself in a headline, Quist said. 'We knew right away there was a need to come up with something.'The question was how to do it. Encrypting e-mail messages among a small group is not difficult, but schemes to enable ad hoc encryption on a large scale are more complex. Public-key infrastructure is a common answer, but implementing PKI and managing digital certificates for a large community is neither simple nor cheap.The conference includes regulators from all 50 states in addition to Guam, the U.S. Virgin Islands, Puerto Rico and the District of Columbia, all of whom also have to communicate with their client institutions and federal regulators, including the Federal Deposit Insurance Corp. and the Office of Thrift Supervision.The conference selected a fully managed service from ZixCorp that uses a customer gateway appliance with a central directory to secure and route e-mail messages between and among customer organizations.'We secure communities of interest,' said Nigel Johnson, vice president of product management at Zix.The two largest communities it now serves are the financial services and health care industries. Federal, state and county governments are a fast-growing market for Zix, both regulatory agencies such as those served by CSBS and agencies that deliver citizen services, he said. The company's central directory contains about 8.4 million e-mail addresses and is adding new ones at a rate of about 60,000 a week.'Every member can communicate with every other member,' he said. 'We alsohave mechanisms for sending e-mail to nonmembers.''This solution seemed to work best for the states because they had options,' Quist said. Agencies using ZixCorp E-mail Encryption Service can send secure e-mail messages to other agencies even if they are not Zix customers. The first state regulators began signing up in 2005.CSBS represents the interests of the state banking system to federal and state legislatures and regulators. Bank examiners deal in sensitive information ' including both proprietary business information and personal customer data ' and the need to share that information has been growing with the expansion of the banking industry.'With branching and interstate banking increasing, more states are doing joint interstate bank examinations,' Quist said. 'The home state always has the lead,' but other states and often federal regulators also take part in an examination. Regulators also need to communicate within their respective states. Identifying ZixCorp E-mail Encryption Service as a workable solution was simple, Quist said. 'The solution was very easy to use.'Installation of the equipment takes about four hours, and the service is transparent to users.The service requires a gateway appliance at the periphery of the client's network that handles mail. 'It is the last mail transfer agent for traffic that is leaving and the first for incoming traffic,' Johnson said.The gateway appliance is built on the Dell PowerEdge 1950 Server, a high-performance, high-availability server with dual processors and a redundant power supply. It has a policy enforcement engine that examines outbound messages for inappropriate or prohibited content. Customers can set the policy, but the engine also has a body of rules based on the examination of live e-mail traffic through agreement with some of Zix's customers. One result of this learning process is a separate profanity lexicon for each country, because what is considered unacceptable language varies from country to country, even in the same language.The encryption function is separate from the policy engine. It does not encrypt desktop-to-desktop, but only gateway-to-gateway. The appliance checks the recipient address of outgoing e-mail with the central directory housed in the Zix data center in Dallas. If the recipient is a Zix customer in the directory, the message is encrypted using the Advanced Encryption Standard algorithm with a 256-bit key and forwarded to the appropriate gateway, where it is decrypted and passed to the recipient.If the recipient is not a Zix customer, the e-mail message can be encrypted or not, depending on the customer's policy for outgoing mail. If the message is encrypted, it can be delivered by pushing it to the user's desktop for decryption if the directory indicates the recipient can receive that type of mail, or it can be placed on a secure server for the recipient to access. In that case, the recipient is notified through a separate e-mail that provides a link to the secure server and a password for accessing the message.Because encryption and decryption are done at the gateway rather than at the desktop, the scheme relieves customers of the burden of managing encryption keys.