Communications
Choosing the right channel
Communication security covers email, messaging, and how you handle the information you send.
Concepts
- Email risks: spoofing (a forged sender address), phishing, malicious attachments, and accidental disclosure through misaddressed mail or "reply all".
- Encryption of messages: protects content in transit; end-to-end encryption means only sender and recipient can read it.
- Digital signatures: prove the sender's identity and that the message was not altered - they support integrity and authenticity, not secrecy.
- Confidentiality notices: a footer disclaimer does not make an email secure.
- Recipient checking: verify addresses, use BCC for large groups so addresses are not exposed, and be wary of unexpected change-of-bank-details requests.
- Instant messaging and social media: convenient but often not confidential; do not share sensitive data on public timelines, and check privacy settings.
Traps
- Confusing encryption (secrecy) with a digital signature (authenticity and integrity).
- Assuming a familiar display name proves the sender; display names are trivially forged.
- Believing a confidentiality footer legally protects a misdirected email.
- "Reply all" leaking a private comment to a whole list.
Rule of thumb: before sending, check the recipient, the attachment, and whether the content would be acceptable if forwarded to everyone. For any request to change payment details, verify by a separate known channel such as a phone call to a number you already hold.
Worked example: An email purporting to be from a supplier asks to change bank details urgently. Even though the address looks right, the safe response is to call the supplier on a number from your records; this defeats business email compromise, where a spoofed or hijacked account redirects payments.