Re: Email Encryption

[Gregory Boyce <gregory.boyce () gmail com>]

On May 14, 2008, at 4:08 AM, pete.hill () sit-up tv wrote:

> Hi there,
>
>
> I am currently running through a PCI program at my company and am  
> looking for recommendations on an email encryption tool.
>
>
> We currently use a licensed version of Winzip, but I have heard that  
> this may not be up to job as far as passing a PCI DSS audit is  
> concerned.

Email encryption wouldn't generally be in scope for a PCI audit unless  
you're emailing credit card info.  In general your best bet would be  
to avoid this.

If you do need email encryption s/mime or PGP are generally the way to  
go.

> Is Winzip good enough?  and if not, what should we be using to get a  
> pass on this?

It sounds like you are actually looking for file encryption, but the  
files maybe transported via email as well.  PGP offers file encryption  
as well.