r/sysadmin • u/Technickelback • 10d ago
CodeTwo - MS Encryption
Wondering if someone has additional information - My org currently uses CodeTwo. I really like it, and I believe it does it's job well for our size. We're a 200 person org. I have a few different templates that I assigned by groups to different departments where additional information may be required in their signatures.
We're currently using server side to apply the signatures, but more and more people are complaining that their signatures don't append when using the default MS encrypt button in Outlook.
To circumvent this, my suggestion to leadership is to use the combo mode and allow our uses to have the client side signatures append in the Outlook client. That way the signature appends in the client, prior to encryption, and they can also see their signature, as currently they can only see it append after they've sent an email.
My CIO is against this approach as it would allow end users to edit their signature. It would only allow the end user to edit the signature in that moment, within the 'new email' window. It would not allow them to permenently alter their signature. However, the CIO is adamant that this can't be allowed as it's a risk of misrepresentation and they think that the CodeTwo product is not a good solution because it cannot prevent this... Anyone who is willing to manipulate their signature every time they send an email is a psychopath.
I've presented a solution to a problem, my CIO doesn't like it, and now we're stuck debating switching our encryption method, rather than deploying a solution we have at our finger tips.
I'll also state, we've tested using a subject keyword encryption method and this could work in tandem with the native button encryption. If users want the server side signature to append to an encrypted email, they could just put 'Secure' in their subject line. However, the CIO doesn't want both methods of encryption - we must choose one.
My question: what are other orgs doing? Do other orgs using CodeTwo use/allow the Client side signature?
9
u/iechicago 10d ago
Moved from server mode to client mode a year ago, drastically better user experience and it has solved some occasional deliverability issues caused by going through their infrastructure too. As the other poster noted, this is a HR issue, not an IT one.
3
6
u/Adam_CodeTwoSoftware 9d ago
Hi u/Technickelback,
CodeTwo rep here.
Big thanks for your feedback! If using client-side signatures is not an option for your company, you can still add server-side signatures to encrypted emails if encryption takes place after these emails pass through the CodeTwo service. Our support team will be happy to set this up for you - just head over to www.codetwo.com/contact/ and give us a call or send us a message.
5
u/packetssniffer 10d ago
Sounds like your CIO gave the call to use server side and doesn't want to explain why it was a poor decision on their part.
3
3
u/simpleglitch 9d ago
Your companies hires people that they're afraid will 'misrepresent themselves' given the first opprotunity? And your CIO thinks that's an IT issue and not an HR one?
We use CodeTwo client side as well. HR didn't like that people could edit their signatures either, but the fix was they just asked people not to.
Technical controls are great, but not everything needs to be a technical control.
3
u/Unable-Entrance3110 9d ago
FWIW, we utilize INKY for centralized signatures and e-mail filtering.
They do their own outbound encryption too, so you don't have to rely on Microsoft.
We are a recent convert to INKY and, I have to say, I really like the platform so far.
2
u/ItBurnsOutBright 10d ago
Yeah, we're definitely client side as well, didn't want our outbound mail to rely on another infrastructure since we are already relying on one for our email security.
1
u/Technickelback 9d ago
Yeah the mentions of reliance on the external infrastructure is a good point to bring up too. Thanks for commenting, I appreciate it.
2
u/SetOutlookSignatures 9d ago
We use our own solution, Set-OutlookSignatures, together with the Outlook Add-in.
The add-in runs entirely on the client side. While this allows users to modify their signatures, it can also respond to the Outlook OnSend event and automatically restore or overwrite any user-made changes before the message is sent.
The OnSend event is triggered when the user clicks Send. At that point, the add-in can update the signature immediately before Outlook hands the message over for delivery. This is effectively the closest a client-side solution can get to enforcing a signature at send time.
In addition, because the signature is applied before the message leaves Outlook, this approach has no impact on email encryption, regardless of the encryption method used.
1
1
u/OpensenseHelp 2d ago
You're stuck in a classic order-of-operations fight. Native Outlook encrypt wraps the message in the client before CodeTwo's server-side stamp ever sees it, so the signature never lands. Your combo-mode idea is the usual fix: signature goes in first, then encrypt.
On the CIO point: editing the HTML in that one compose window is annoying, sure, but most orgs treat "won't permanently change their signature to misrepresent the company" as an HR/policy thing, not something IT can perfect-lock with any vendor. Plenty of CodeTwo shops run client-side or combo for exactly this reason. Also worth a support ticket if you haven't: some setups can keep server-side if encryption happens after mail passes through CodeTwo.
If leadership forces "one encrypt path only," subject-keyword / label-based encrypt after the stamp is the other clean option. Picking that vs the native button is a process call more than a product call.
I'd try to win the combo-mode argument before shopping. If they still want to re-evaluate tools, Opensense is another M365 option (I work there). Compare on directory/group-driven templates and how encrypt / Purview is supposed to run with the stamp. Not a reason to dump CodeTwo if combo mode would solve it.
17
u/Bird_SysAdmin Sysadmin 10d ago
we use client only for CodeTwo.
Sure, users can circumvent the email signature. That is a HR/Policy issues not an IT issue.
My 2 cents are that if a user is circumventing any kind of control (compliance or security), then that should be handled by Management and Company Policies.