South Africa's e-mail isn't safe

A Mimecast SA survey of over 300 IT professionals on their company's e-mail usage has found that South African businesses still regard e-mail as an operational function - a bit like ordering stationary - rather than a business-critical one.

With 80% of a company's intellectual property passing through its e-mail server, businesses must take steps to protect themselves. Not only do the majority of today's employees need constant e-mail access to do their jobs effectively but, due to recent changes in regulations and the threat of litigation, companies must have the ability to present forensic audit trails of retrieved e-mails dating back several years.

“This survey points out that at least half of SA companies are at risk of non-compliance. Security is still not being adequately addressed and the lack of e-mail archiving capabilities from the majority of respondents is a big concern. The survey confirms our suspicions that staff resort to their private e-mail in the event of an e-mail outage. So much for business continuity!” says Garth Wittles, managing director of Mimecast South Africa.

The results gave a clear picture of what still needs to be done:

* 68% of respondents are unable to present a full forensic audit trail and repudiation data for an e-mail sent three years ago. This is in direct contradiction of at least eight local Acts.

* 83% of companies are unable to prevent confidential data being sent via e-mail

* 46% of companies leave employees to store and delete their e-mail

* 28% of companies cannot retrieve an e-mail sent three years ago

* 84% of companies are unable to provide users with adequate archiving and a 10-year view of messages

Fifty percent of companies' employees work outside of the office e-mail system once the e-mail server goes down.

The cost of managing e-mail is increasing. “We found that a staggering 82% of respondents said the costs of e-mail security, archival and continuity had gone up in the past two years and yet, via this survey, there is widespread acknowledgement that their systems remain unable to address some of the basic compliance and security needs of the business,” says Wittles.

The answers to the question “How quickly could you retrieve an e-mail that had been sent in your company three years ago?” corroborated the opinion that companies are yet to integrate e-mail policies and technology into a cohesive strategy.

Twenty-eight percent of respondents couldn't retrieve a three-year old e-mail at all, and while 36% of respondents could do it in minutes, this number is reduced within smaller companies with less than 500 seats. This implies that enterprise customers are better prepared to meet compliance standards.

“The answers to this question revealed that 22% of respondents can trace an e-mail in hours and 15% in days. We assume that this 37% are still using tape back-ups which is a security and archiving risk all of its own. But more shockingly, compare these numbers with the 68% who can't present a full forensic audit and I have to ask, 'What's the point?' Even if the company can get to the message, they can't use it as evidence. The business value of retrieving e-mail goes beyond remembering what was said, it is about being able to use the e-mail to defend the integrity of the business.”

Companies should ensure their annual e-mail spend is supporting the protection of their IP, rather than funnelling the money into a system that just chugs along in an operationally adequate way.

The single difference between good e-mail management and great e-mail management is the ability to flexibly enforce security and HR policies across a business's entire mailbox environment while still providing absolute protection against internal and external threats.

“It seems that South African companies still have a fair way to go. The good news is that Mimecast's surveys in the UK and US presented very similar findings. E-mail is baffling a great many companies all over the world. Its reach and power has taken many by surprise and we are all exposed. It's IT management's job to recognise the areas of vulnerability and implement technologies to protect the business,” concludes Wittles.

For a full PowerPoint presentation of all the results please e-mail marketing@mimecast.co.za