General and secure email is a key part of personal and business communication. However, as ubiquitous as email is, it is fraught with vulnerabilities. A particularly stubborn myth persists among many users. That is the belief that typing “[secure]” in the subject line of an email somehow guarantees its security.
This misconception, though seemingly harmless, can have serious repercussions. Understanding why this practice is ineffective is crucial in fostering safer communication habits in both personal and professional contexts.
Contents
Understanding Email Security
Email security is a complex field, often misunderstood by the general public. At its core, a secure email is one that is both encrypted and authenticated. Encryption ensures that the content of the email is only readable by the intended recipient, while authentication verifies that the sender is who they claim to be. Without these two pillars, an email is susceptible to interception, tampering, and unauthorised access.
Many people, however, misunderstand what makes an email secure. Including words like “[secure]” in a subject line is often, but mistakenly, believed to activate some form of built-in protection, akin to flipping a security switch.
Unfortunately, this is not how email security works.
How Secure is Secure Email?
Secure email has its limits. Encrypted email, for example, is encrypted in transit but often is not at rest. Also, both the sending email account and the recipient need to be secure.
An example is the nhs.net domain. It is secure when and email is sent from one nhs.net email to another, but not to others like outlook.
Often company emails sent between colleagues are partially secure because they will be sent within the organisation’s systems, stored on their servers and protected behind firewalls and anti-virus software. However, the emails themselves are not secure.
Email was never meant to be secure and like much of the internet security was very much an afterthought.
The Origins of the “[secure]” Subject Line Myth
The myth surrounding the “[secure]” subject line likely stems from a misunderstanding of how secure communications are initiated.
In some secure email systems, tags or triggers like “[secure]” can be used to notify the system to encrypt the message before it is sent. However, this functionality is specific to those particular systems and requires that the email client or server is configured to recognise and act upon these tags.
The critical role of encryption in secure communication cannot be overstated. Encryption converts plain text into a scrambled format that can only be deciphered by someone who has the correct decryption key. Without encryption, any email tagged as “[secure]” is just as vulnerable as any other unprotected message.
After all, if emails could be made secure at the press of a button there would be a button – or it would be done automatically.
Why Typing “[secure]” Doesn’t Make Email Secure
Typing “[secure]” in the subject line without enabling actual encryption is akin to locking your front door but leaving the key under the doormat. It gives a false sense of security. The email, in reality, travels across the internet in plain text, accessible to anyone who intercepts it. The illusion of security can be more dangerous than no security at all, as it encourages complacency.
The psychological impact of believing an email is secure simply because of the “[secure]” tag can lead users to share sensitive information more freely than they otherwise would. This misplaced confidence puts both individuals and organisations at significant risk.
It’s like putting “do not read” on a postcard before you send it. It isn’t going to stop anyone reading it if they want to.
How Email Providers Handle “[secure]” Tags
Contrary to what some might believe, most email providers do not take any special action when they detect the word “[secure]” in the subject line. This tag is treated like any other text, with no inherent functionality tied to it. Without specific security protocols in place, the email is sent in plain text, and the recipient’s server handles it no differently than any other email.
Instances of misuse of the “[secure]” tag are abundant. Many users, including professionals, mistakenly assume that this simple addition is sufficient to protect their communication. The misunderstanding perpetuates a cycle of misinformation and vulnerability.
The Dangers of Relying on “[secure]” in Subject Lines
Relying on “[secure]” in subject lines exposes several vulnerabilities. Firstly, it creates a false sense of security that can lead to the exchange of sensitive information over unprotected channels. Hackers and cybercriminals can exploit this overconfidence to intercept and manipulate emails.
Furthermore, there are legal and compliance risks involved. Many industries, particularly those governed by strict regulations such as healthcare and finance, require that electronic communications meet specific security standards. Misunderstanding these requirements and relying on ineffective measures like the “[secure]” tag can result in significant legal liabilities.
Real Security Measures for Email
To genuinely secure an email, encryption must be employed. Encryption tools such as PGP (Pretty Good Privacy) or S/MIME (Secure/Multipurpose Internet Mail Extensions) ensure that the contents of an email are accessible only to the intended recipient. These tools encrypt the message on the sender’s side and decrypt it on the recipient’s side, rendering it unreadable to anyone who might intercept it.
In addition to encryption, two-factor authentication (2FA) is another critical measure. By requiring not just a password but also a second form of verification—such as a code sent to a mobile device—2FA significantly reduces the risk of unauthorised access.
The Importance of User Education
Educating users about the realities of email security is vital. Awareness campaigns and training programs can dispel myths like the effectiveness of the “[secure]” tag and promote the adoption of genuine security practices. Companies should invest in ongoing education to ensure that all employees understand the importance of encryption, strong passwords, and the dangers of phishing attacks.
Providing resources and tools to facilitate secure email practices, such as user-friendly encryption software and clear guidelines, is also essential. The more informed users are, the less likely they are to fall victim to security breaches.
-
you can learn more about managing email here.
What Are The Consequences Of Failing To Protect Data?
Failing to protect data could create serious financial, operational and reputational risks for organisations.
Spending time, effort and money reacting to problems can severely impact an organisation’s ability to operate its day to day activities and severely reduce customer trust.
In addition breaches that involve personal data could lead to action from regulators like the Information Commissioner, or legal action from people affected.
Conclusion
The importance of understanding and implementing real email security measures cannot be overstated. Myths such as the “[secure]” tag offer nothing but a dangerous illusion of safety.
Moving beyond these misconceptions to adopt genuine email security practices is essential for anyone who values their privacy and the confidentiality of their communications. The path forward involves education, the use of proper encryption tools, and a commitment to staying informed about evolving security threats.
By doing so, individuals and organisations can protect themselves from the myriad risks that come with unsecured email communication.