Egress Switch Email Encryption User Guide This guide explains how to use the Egress Switch email encryption software Egress Switch integrates with Microsoft Outlook to provide easy to use email encryption. The guidance is arranged into sections for you to quickly refer to the bits you need. How to send an encrypted email Instructions on selecting the correct encryption level page 2 Adding time restrictions to an encrypted email This section will explain how you can add time restrictions to an encrypted email page 4 Managing information after it s been sent How to view and control the information you ve sent, even after receipt page 5 Managing access requests How to deal with access requests from non-authorised users page 8 Understanding Package Properties Explaining the tabs on the Package Properties window page 10 Help and Support Who to contact and how to contact them page 14 1
How to send an encrypted email Egress Switch integrates with Microsoft Outlook, making sending encrypted emails easy 1. To send an email, simply click to create a New Email in Outlook, compose your message and attach any files as normal 2. When you click Send, a pop-up will appear asking that you select the correct protective marking level from the list 3. Double-click the correct protective marking level, and your email will be automatically sent Protective Marking Levels Please note Once your email (with any attachments) becomes encrypted it is referred to as a Package. Top Tip If you re not sure which Protective Marking level to select, please refer to the Suffolk County Council Protective Marking Policy: https://suffolknet.sharepoint.com/sites/myscc/it/documents/protectivemarkingpolicyv3.3.pdf#search=sc c%20protective%20marking Alternatively, discuss with your designated Strategic Information Agent 2
How to send an encrypted email Selecting the right Protective Marking level Here s a bit more detail on the options you ll be able to choose from when selecting the Protective Marking Level OFFICIAL (Not Encrypted) This is for day to day messages which don't require encryption. When you select this level your email will not be encrypted OFFICIAL (Encrypted) Select this option and your message will be encrypted when it leaves Suffolk County Council's network. When the message is in your mailbox, saved on file, or received in the mailbox of another SCC employee, it will not be encrypted. The subject of your email will be automatically preceded with OFFICIAL' OFFICIAL-SENSITIVE (Encrypted) Select this option and your message will be encrypted when it leaves Suffolk County Council's network. When the message is in your mailbox, saved on file, or received in the mailbox of another SCC employee, it will not be encrypted. The subject of your email will be automatically preceded with OFFICIAL-SENSITIVE OFFICIAL-SENSITIVE (Not Encrypted for GCSx use) This option will only be available to GCSx mailbox holders and when selected the subject field of your email will automatically be preceded with OFFICIAL-SENSITIVE. Your email will be secured as per normal GCSx security no further encryption will be applied by Egress. If you no longer have access to a GCSx mailbox then you can remove this encryption option by contacting IT Top Tip The Protective Marking level you ve selected cannot be changed after an email has been sent 3
How to send an encrypted email Adding and modifying time-based restrictions Egress allows you to specify how long a recipient has access to a secure package you ve sent to them. Please note that this only applies to emails that are sent to people who are external to Suffolk County Council. 1. Compile your message as normal. When it is ready to be sent, click on Message Restrictions on the Message toolbar. 2. The window below will be presented and you can choose how to restrict the accessibility of the message. There are three different options that can be used to restrict the validity of a message: You can specify when the message is Valid From, e.g. if you know the recipient is on leave but you need to send the message you can ensure it is not read until the recipient returns. You can specify when the message is Valid Until this will result in the message expiring once the Valid Until date and time have passed. You can specify that the message is only valid between certain dates and times this requires both the Valid From and Valid Until values to be completed. Please note Egress will automatically default the Valid Until date to one month after your Valid From date. Top Tip Time restrictions can also be set or amended after an email has been sent by changing settings in the Package Properties dialog box see the next section for more information on this. 4
Managing information after it s been sent Using Egress Switch you can view and control the information you send to external recipients, even after it s been received, allowing you to manage who can access the information and how it s used Reviewing your secure packages 1. To review your secure packages, click the Egress Switch Sent Packages icon Remember Once your email (with any attachments) becomes encrypted it is referred to as a Package. 2. You ll be shown a list of any packages you ve sent. A double-click on any package you d like to review will provide you with a number of options around amending permissions and access. To assist you in finding the package you would like to review you can utilise the date based filters on the left of the screen, e.g. Recently created, Today, etc., or you can sort by clicking on the header fields in the box on the right. Finally you can also use the search box to look for a specific Package Label. Top Tip It is easy to see whether a package is current or not by simply looking at the envelope symbol next to the package. If the symbol in the circle has a tick then the package is active. If it has a cross then the package is no longer available. 5
Managing information after it s been sent Revoking / un-revoking access to a package 1. To revoke access to a package click the Sent Packages icon. 2. Select the relevant package from your Sent Packages list by clicking it once, then click the Revoke Access icon at the top of the sent packages list window. All of your recipient(s) will no longer have access to the package and the symbol next to the package will now contain a red circle with a white cross in it. 3. To un-revoke access to a package, select the relevant package from your packages list by clicking it once, then click the Unrevoke Access icon at the top of the sent packages list window. All of your recipient(s) will now have access to the package again and the symbol will change to a green circle with a white tick in. Revoking a package means withdrawing previously granted access to a secure package. This can only be done on packages that have been sent to external recipients and will revoke the access for ALL recipients. NB. It is not currently possible to amend access for packages sent from shared mailboxes although there is an update due which will resolve this. Top Tip If the external recipient of an Egress encrypted email replies to this email using the Egress Web Browser or a downloaded Egress application then a new package is created. The sender of the original email cannot revoke access to the new package as it will now belong to the external recipient. 6
Managing information after it s been sent Revoking access for individual(s) 1. To revoke an individual s access to a package click the Sent Packages icon. 2. Select the relevant package from your Sent Packages list by double clicking it to launch the Package Properties window and then click once on the Access tab to display a list of people who are authorised to view the package: 3. Click once on the name of person whose access you want to revoke. Then click on the Remove button at the bottom of the screen and then click OK. The person will no longer be able to open the package and will no longer be listed on the Access tab. Top Tip Even though an individual has been removed from the Access list they will still receive the original encrypted email notification and will be able to request access. What this looks like and how it works is detailed on the next page. 7
Managing information after it s been sent Managing Access Requests If a non-authorised recipient attempts to login to view your secure package, they are offered the option to request access from the package author, i.e. you. Below is the screen they will get presented with by Egress. If the non-authorised recipient clicks on Send request you will be notified of the access request via an email which will contain details of the package that access is being requested for together with the name and email address of the person requesting access. 1. To review an access request click the Sent Packages icon in Outlook as before and then double click on the package with the access request to launch the Package Properties window. You can tell at a glance which package has a pending access request by looking at the icon next to the package as it will have a blue circle with a white exclamation mark next to the envelope. 8
Managing information after it s been sent Managing Access Requests (continued) 3. Select the Access tab on top of the Package Properties window. A notification will be displayed at the bottom of the Package Properties window, displaying the email address of the person who has requested access to the package. 4. Clicking on the email address of the person requesting access will display a pop up which will allow you to either Approve or Deny the access request. Clicking on Approve will allow the requestor access to the message. Selecting Deny will ensure they cannot access the message. Top Tip The message in the pop up could be different or even blank if the person requesting access has sent the request from the downloaded free Egress application rather than the web application 9
Understanding the Package Properties Properties Tab Package Label: The unique system-generated name given to the package by Egress. Registered At: The time the Egress server encrypted the package. Contents: This summarises how many encrypted items are in the package, e.g. a encrypted email with no attachments will show just 1 file, but an encrypted email with an attachment will show 2 files, etc. Subject: The email subject as typed by the author preceded with the Egress encryption option selected by the author. Tags: This is not in use. Status: Displays whether the package is Active or Revoked. The drop down can be used to revoke / un-revoke access. Classification: Shows the encryption option selected by the author when the package was created. Although this is a drop down, it is not possible to change the classification once a package has been created. Valid From: If message restrictions were set this will contain the date and time the package is valid from. This can be amended after the package has been created. Valid To: If message restrictions were set this will contain the date and time the package is valid until. This can be amended after the package has been created. 10
Understanding the Package Properties Access Tab Authorised: Remove: Edit: This displays a list of the email addresses that are authorised to access an encrypted package. Individual access can be removed by selecting an email address from the authorised list and then clicking on Remove. It is possible to add a new email address to the list of authorised accounts using the Edit button however it is not possible to inform the new authorised recipient that they now have access so it is advisable to add people by sending the original email onto them. 11
Understanding the Package Properties Access Reports Tab This tab shows the last time that an authorised user accessed the encrypted package. It will only show one entry (the latest access) for each authorised user regardless of how many times they have accessed the package. 12
Understanding the Package Properties Audit Events Tab This tab displays a full history of who has accessed a package and when, together with whether any unauthorised users tried to access a package and what actions were taken as a result. 13
Help and Support 1. For any queries relating to the correct use of the product please refer to mylearning: http://suffolk.learningpool.com/course/view.php?id=1212 Alternatively discuss with your designated Strategic Information Agent 2. To report a fault with the software please contact: Helpdesk Contact Details IT Self Service: http://servicedesk.suffolk.gov.uk Telephone: 01473 265555 Email: ITHelpdesk@suffolk.gov.uk 14