Like an unbuckled seat belt, e-mail encryption that goes unused doesn’t offer much protection. That’s one reason why network administrators will want to take a look at InvisiMail, Enterprise Edition, Version 3.0. Unlike most third-party e-mail encryption products, InvisiMail works automatically in the background without user input. And that means, of course, that it will actually be used.
Even better, Version 3.0 of InvisiMail can be installed on your proxy server instead of having to be installed on each individual workstation, as previous versions required. Thus, setting up encryption protection for your entire organization is a breeze.
It’s also worth noting that because InvisiMail Enterprise was developed in New Zealand, it is not controlled by U.S. export controls on encryption technologies. That means you can use the product in overseas as well as in domestic operations.
Network Associates has recently shipped Version 6.0 of PGP Enterprise Security — InvisiMail Enterprise’s primary competitor — that covers the same basic ground as InvisiMail. (See our review of PGP Enterprise Security, Version 6.0, Oct. 5, page 44C.)
Installing InvisiMail Enterprise is a snap once you have decided the type of configuration you want to employ. The product can be installed on each user’s workstation, on a network server to protect your LAN e-mail, or on a proxy server to act as an Internet gateway.
Not surprisingly, the first of these options offers the highest level of security — both internally and externally — although it is also the most complicated to set up and configure because it involves installing InvisiMail Enterprise on multiple systems. But other than this, the only delay that I encountered during installation was having to manually enter each user’s name and e-mail address. Names and addresses can also be imported from files, although there is no browse or auto-import feature.
In addition, the enterprise version of InvisiMail supports e-mail aliases, so network managers have the ability to use one public key for an entire organization. Alternatively, if managers want to be able to secure each user’s messages within the organization, individual keys for each user can be generated.
That’s all it takes to deploy and use InvisiMail Enterprise. From that point forward, whenever a user sends a message, the public key is included in the header. Once a message was received by another InvisiMail user, all future messages to that user — including attachments — will be encrypted before being sent. Both the sender and the contents of each message are verified upon receipt via digital signatures.
For the sender, the benefits are even more obvious. For starters, there aren’t any hassles with certificate or key management to deal with; with InvisiMail, it all takes place behind the scenes. Second, the user does not have to highlight text for encryption or enter passwords, because all messages are automatically encrypted in the background. In addition, InvisiMail’s compression and encryption algorithms are fast enough that most users will not be bothered by the delays unless very large messages are being processed.
Apart from its speed and global availability, InvisMail Enterprise’s greatest strength lies in its hands-off simplicity. Users never see the product and even administrators have very little to concern themselves with once they have installed InvisiMail.
In addition, InvisiMail Enterprise includes an administration module, although there really isn’t much you are able to do with it. Although you do have the ability to check on system information, the program requires little attention. With the administration module you can, of course, add users and create new keys.
You can also specify whether messages will be compressed before sending and decrypted on receipt on a user-by-user basis. The program also offers good control over what happens when messages fail authentication and control over receipt policies for messages. Finally, in the event of trouble you can switch on InvisiMail Enterprise traffic log.
InvisiMail Enterprise works with virtually all of the major server and client e-mail software, including all products that are compliant with POP3, SMTP, and IMAP4. Unlike its major competitor PGP, InvisiMail integrates seamlessly with Netscape Navigator, as well as Eudora, Pegasus, Calypso, TurnPike, Parsons E-mail 200, and Microsoft’s Internet Explorer, Exchange, and Outlook.
Another advantage to using InvisiMail Enterprise, compared with using PGP, is that it can issue X.509-style certificates for key verification. This is a feature that should be available soon in PGP.
In short, InvisiMail Enterprise’s ease of installation and configuration, its invisibility to the end-user, and its price make it a hot product to consider for any company concerned with the security of Internet e-mail.
Patrick Marshall is senior technical analyst at Federal Computer Week’s test center and an InfoWorld contributing editor.
THE BOTTOM LINE: VERY GOOD
InvisiMail, Enterprise Edition, Version 3.0
InvisiMail brings its background encryption/decryption services for e-mail to network and Internet proxy servers.
Pros: Runs in background; fast encryption and decryption.
Cons: No auto-import of directories or address books.
Price: $59 to $100 per seat; $8,900 for 100 users.
Platforms: Windows NT, Windows 98, Windows 95.
Copyright (c) 1998 InfoWorld Media Group Inc.