开云体育

I am attempting to get our community association to adopt?. ?The vice president of the association asks: ?“How secure is this email service?”

On Fri, Feb 28, 2020 at 06:40 PM, Brad Reese wrote:

I am attempting to get our community association to adopt?. ?The vice president of the association asks: ?“How secure is this email service?”

?

How should I reply?

I think the opposite should be asked - how secure are members own email accounts.?

Frances

?
--
Moving to Groups.io (without easy transfer)

GMF Wiki: (unofficial) Help for members (and would-be members) and group managers

Mark Fletcher has a long internet history - see this post?/g/GroupManagersForum/message/29653

He is security conscious, as he must be to stay in business.

Frances
--
Moving to Groups.io (without easy transfer)

GMF Wiki: (unofficial) Help for members (and would-be members) and group managers

Is this person’s question “security” or “privacy” which are not the same.?

From my experience, the groups.io platform is as secure or more so than others.?
Email addresses are exposed to other group members who receive messages or digests via email rather than reading on the web (privacy). If members’ email accounts are not secure, then the group’s emails and content may become vulnerable (security).

You can set pretty high levels of viewing privacy in the settings to avoid “outside” (public or non-group member) visibility and restrict who can join but the potential for exposure comes from “inside” - an approved group member sharing messages outside the group, a group member who’s careless or hacked or has their email address spoofed. So it’s definitely as Frances pointed out, dependent on individual members’ email accounts.?

Something else to keep in mind - what you see is not always what you get. Stuff (like an email address or menu) that doesn’t show up on a tablet may show up appear different on a computer browser.

On 2020-02-28 at 3:24:18 PM, Brad Reese <brad@...> wrote:

I am attempting to get our community association to adopt groups.io
<>. The vice president of the association asks: “How
secure is this email service?”

How should I reply?

The cheeky answer is that the question needs refinement before it's
answerable. Here goes a non-answer answer. Hooray for lazy Saturday
afternoons with a good cup of tea. :-)

As with all things in security--whether online or offline--your organization
will want to figure out which threats it cares about and how much it's
willing to do to protect against and mitigate occurrences of those threats.

After understanding that, you can then research/ask more specific follow up
questions.

Some questions to get you started:

* What assets need to be protected?

* Who are your organization's potential adversaries?

* What are their capabilities?

* What is the probability and impact of various adverse events?

* What events do you care about countering before or mitigating after
occurrence?

* What are ways your organization could to safeguard/minimize/mitigate
against these threats?

* What has Groups.io implemented to counter/mitigate the threats that you
care about?

* What trade-off between spending money, convenience, and robustness is your
organization willing to make?

* What level of testing/validation does your organization need?

* How will you learn and re-assess after you have more experience?

Hope this helps, but I won't be offended if the response is akin to,
"Thanks, but that's a lot of work, and we don't care that much." :-) That's
implicitly going though the exercise, so my work here is done. :-)

--
Christopher W. <lists@...>