My organization is currently looking into encrypting our emails internally as well as the occasional message to come outside recipients. The requirements are currently a bit overwhelming and I am not sure where to begin. We run a somewhat mixed environment:

  • Exchange Server 2010 SP1
  • Outlook 2007
  • Thunderbird 3.1
  • iPhone/iPad
  • Android
  • BlackBerry (with BES)

When management asked for encryption with PGP, they want everyone in the company to be able to seamlessly send/receive encrypted emails on both their desktop email client and phones. Obviously I won't be able to meet all of their requirements and I don't care if it is an open-source or commercial solution. I understand private/public key encryption, but I have never setup anything like this before.


Encryption will never be "seamless" - particularly in a mixed environment.
Similarly the idea that you'll be able to get outside agencies to adhere to your encryption policy is a noble goal, but may be difficult in practice (My company has been trying to get this to happen since before I came here. Some outside personnel are simply not going to be able to deal with the concept of encrypting sensitive data.)

Your best bet is to settle on encrypting sensitive email with something like PGP or email signed/encrypted with certificates -- Support is available for both of these solutions on Mac and Windows machines.
Mundane messages can continue to be sent in the clear (this necessitates training your staff on what does/doesn't need encryption, and periodically spot-checking to ensure compliance).

If you want secure communication from outside agencies you may need to set up a web portal (https) that takes their message, encrypts it to your standards, and sends it to the appropriate people.


You'll need to take a few steps here. First may well be user education. Explain to your users that email is like writing on a postcard, anyone along the way can see the message. You'll want to find a PGP (GPG) client that integrates with each mail client in use on your network. Start with the most widely used client. I'd guess that is Outlook so take a look at http://www.gpg4win.org/.

You may have more luck getting a few of your power users to set it up and test it with you. Once you have these encrypted/decrypted mails going between users, show your management what you've got as a proof of concept and ask if that is what they had in mind.

Work through the remaining clients in order of their adoption rates on your network.

Also, consider email that leaves your company. It will be very difficult to encrypt those messages as you would need buy-in from all your business partners, vendors, etc.

I'd recommend writing a detailed policy and sending that your your management for review and ultimately to your users before implementing such a requirement.


There is a very nice plugin for Thunderbird named enigmail. For Outlook we have successfully used a plugin named cGeep (from here. This is commercial, but very affordable. I can't really help with BlackBerry, Android or iPhone/iPad, I am afraid.

All of these are client based, and the server doesn't really get involved at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.