Email encryption improves security
"We have seen real benefits throughout the organisation as a result of our usage of Switch," says Sarah Roberts, head of ICT at NWFRS
The software is free for recipients to use. It’s an easy process for them to register and securely share info.
North Wales Fire and Rescue Service is using the CPA-certified encryption solution Egress Switch to protect all confidential electronic information leaving the organisation, improving its communication, security and speed in the process.
NWFRS works to protect a residential population of more than 600,000 people, in addition to the thousands of tourists that visit the area each year. Employing approximately 1,000 staff, NWFRS attends to more than 3,200 fires, 500 road traffic collisions and 500 other emergency incidents every year, in addition to delivering initiatives to schools, businesses and local communities to promote fire safety and prevention. Carrying out this work involves collaborating with a network of external third parties, which in itself represents a security risk given the confidentiality of some of these documents being sent and received.
However, NWFRS has recently improved its security by adopting an encryption tool to ensure that electronic information is shared and stored securely, not just in house but also with other emergency services, local authorities and agency partners.
Sarah Roberts, head of ICT at NWFRS, told SC Magazine UK that this safe sharing of information was vital, especially as fire safety referrals often go out to external organisations, like charities not on the government's Public Services Network (PSN). “We used to share this information face to face, on the phone or via the post,” she said.
“Basically, we wanted to be able to share confidential information with a number of organisations and to do that securely. Our email system just isn't secure enough”, she said, citing the group's use of Microsoft Exchange. “Emailing internally doesn't have the same risks as when emailing out over the Internet.”
Roberts said the group was attracted by simplicity of the encryption product; it's a three-step process to sign up and it's free for recipients to use. NWFRS also put together a one-page document on how to use the solution, which was useful for everyone from HR and finance to occupational health.
One example, said Roberts, was Conway Country system which pays invoices and also needs access to mission critical services in the private sector.
“The whole process is faster than sending CDs through the post,” she said. “It makes it a lot easier when dealing with local authorities,” she added, continuing that the solution's roll-out came after heads of local authorities discussed how to improve service across North Wales, as well as other issues raised by information steering groups.
Other benefits of the encryption tool were seeing an audit log of who was sending information on behalf of group mailboxes, flexible deployment platform, integration with mail scanners (so they could scan in clear text), easily and securely communicate information about North Wales to those most vulnerable.
Roberts said that the group is particularly wary of protecting information – especially on vulnerable citizens – and added that Egress complements NWFRS's existing encryption solutions and mail scanners in place on desktop, laptop and radio. Certain information is restricted by a government classification policy, and there's a secure email gateway in place to block information that gets out. Roberts said that they had a ‘few cases' where often a flagged word doesn't necessarily mean a breach.
“IT is about educating people about information security and trying to put enough technology in place so you don't have to think that much about it,” said Roberts.
NWFRS doesn't allow USB stick use due to potential data loss, and says the ROI is easy to judge: “It's the speed in which you can share information freely and securely. There are tangible benefits. If there's a vulnerable citizen we need to know about that person now.” Roberts added that it's easy to comply with the Data Protection Act as it's UK based and on the premises.
The public sector body built the servers in a day and Egress helped with the configuration, something Roberts said was more timely given the rules over sensitive and restrictive data.