No one would argue that email is both an enabler and time-saver, allowing organizations of all sizes to manage most business activities efficiently with limited resources. The channel speeds up information exchange, especially since virtually everyone has an email account these days.
But that doesn’t mean email comes without downsides. Hence it can be a risky choice for communicating confidential information. Commercial agreements, for example, contain a lot of sensitive data that can disrupt operations and damage business relationships when falling into the wrong hands — something that can happen both accidentally and intentionally due to human errors and malicious insiders and outsiders.
Let’s takes a closer look at the challenges of contract management via email and how to overcome them with cybersecurity technologies, specifically data loss prevention (DLP) and online signatures.
There is usually little control over how documents are used and shared when you work via email. Anyone is free to send, download, forward, and modify contracts. And the likelihood of human error keeps increasing in a situation where multiple versions emerge and become scattered within and outside your organization. For example, someone may have added sensitive pricing information without considering that another user, unaware of the update, was planning to share that with a third party.
Digital signature platforms, where contracts are centrally managed and stored, help avoid problems like this. Such applications make it easy to keep track of progress and modifications and ensure that everyone is working on the same document, with a clear understanding of the latest status and pending comments, if any, before proceeding with the signature process.
In parallel, DLP solutions give users the ability to quickly check whether confidential data — names, bank account details, addresses, or else — are present in a commercial agreement before using or communicating it externally.
The more people get involved in the review of a document, the longer and more complicated it becomes. With email, everybody can add recipients in the TO, CC, and BCC fields. And here again, the risk of accidental emailing is present, notably due to autofill and confusingly similar names.
Online signature software makes sure this doesn’t occur by letting administrators define user roles and the actions that can be taken by each person — i.e., add, review, comment, and/or sign contracts. DLP solutions provide similar capabilities with the possibility to restrict the use of large recipient lists as well as define email addresses for specific purposes (e.g., email@example.com or firstname.lastname@example.org).
Cybercriminals target small businesses just as much as they are after large organizations, so beware of man-in-the-middle attacks (MITM) — through which one or several third parties interfere with the communications of recipients and senders by reading their messages, downloading attachments, and modifying content in unnoticeable but misleading ways. In the case of contracts, hackers could alter clauses to benefit themselves or conduct espionage and learn more about the business relationship between two companies.
Both online signatures and DLP solutions reduce the risk of successful MITM using authentication and encryption protocols. This includes configuring DKIM and DMARC adequately to avoid email spoofing and enforcing HTTPS with SSL certificates to provide a safe environment where visitors and users can upload business data.
Printing out a contract, signing it, scanning it, emailing it and then continually monitoring if it came back signed correctly by one or more parties is cumbersome. And more than that, the document may not always be recognized as binding in court.
Online signature platforms, on the other hand, are typically compliant with legal frameworks and allow to record essential information about each signing party — identities, dates, IP addresses, as well as activity logs.
In light of security breach notification laws that require to inform customers of data breaches, DLP solutions also have a role to play in ensuring legal protection and compliance mostly by preventing errors and detecting scams that may affect contractual parties.
All in all, while email is a critical communication tool, there are instances where its use can be detrimental — contract management being a good example. Both small businesses and large organizations can mitigate risks in that case by combining online signature and DLP technologies.
About the author:
Alexandre François is Head of Content and Marketing at Safesend Software. He enjoys sharing best practices and practical tips that individuals and businesses can use to protect themselves against cyber threats and accidental data loss.