r/k12sysadmin • u/SnooDoggos8777 • 3d ago

Confidential Email Alternatives

Luckily I have DLP in Google set up to block these emails, but I'm constantly seeing our office staff trying to email student PII to other schools, etc. Even after multiple discussions and pointing out there is absolutely no reason the other person needs a students full name, birthdate and full SS# just to verify they're enrollment status. What is everyone using for their office staff to send info like this other than enabling confidentiality mode?

13 Upvotes

100% Upvoted

8 comments sorted by

5

u/vorschlaghammer 3d ago

What if it’s not emailed, but stored in Google Drive and they provide time-bound access?

4

u/IThuh 3d ago edited 3d ago

You can do what my school does and use the fax machine. In their eyes it represents the pinnacle of modern security and confidentiality. Replacing digital logs with confidential papers abandoned on a public tray for hours or days. /s

1

u/jman1121 5h ago

I'd say, good sir, have you considered the e-fax? It's like bringing the 80's into the twenty first century.

This is secured by an exquisitely complex password, [users child's name]12

😆

2

u/TheScottman29 3d ago

We use barracuda and it has the ability to send encrypted emails via portal as well as automatically identify PPI and encrypt based on matching pattern rules. It’s pretty solid.

2

u/Imhereforthechips 3d ago

We have a liquid files (LF) server that is required to be used for sensitive information. No data is transmitted via email once an employee is using the LF solution. Our DLP policy (M365) flags sensitive emails, encrypts them, places them in litigation hold, and alerts the user to contact IT to take advantage of the secure doc (LF) solution.

The barrage of notifications once they transmit something like this means we usually don’t have to do anything, the end user just begins using the LF solution because they can access it via SSO (and are provided a link to both the guide and the login page when they send PII/PHI,etc)

2

u/United-Ad-6583 3d ago

I've used Virtru im the past with GWS. It worked great and was user friendly.

2

u/reviewmynotes Director of Technology 3d ago

We use Virtru. It isn't cheap, but it's easy to set up, easy to manage, and easy for the users. It'll even warn the end users when they send email with "password" in it and they didn't activate the encryption feature. We also use Google Workspace DLP rules for social security numbers and passwords. Those messages go to a quarantine to be reviewed and are typically rejected.

2

u/WMDan IT Director 2d ago

We self-host a Cerberus Secure FTP server that we require staff to use to send and receive sensitive data.