Merthyr Tydfil County Borough Council (MTCBC) governs the Merthyr Tydfil County Borough in Wales. The council provides a range of services to its citizens, residents, and businesses, including social services, recycling and waste, planning, building control, trading standards, environmental health, education, and tax services, amongst others.
The challenge
Like other Councils, MTCBC employees regularly deal with sensitive information. MTCBC is ISO 27001 compliant, but risk assessments kept flagging that a secure email solution was required. “Our email security was a risk we needed to address,” said Ryan James, Corporate Information Security Officer at the Council.
“Like all local authorities, we used Government Connect Secure Extranet (GCSx) secure email. It allowed us to send emails securely to other government organisations or local authorities, but the sender and the recipient both had to have GCSx email accounts. So we could only use it within the public sector. And it was very clunky; staff needed an additional mailbox to use it, meaning they had to log into another mailbox, send the secure email, and then go back to their regular email,” Ryan said.
He continued, “As a Council, there are times that we’re working with residents, charities, the voluntary sector, and other third parties, and we needed a way of being able to email those recipients securely as well, ensuring that emails were encrypted. We started looking for other solutions and found Egress Protect”.
If your organisation is considering Egress as an email security solution, my advice is simple: Go for it.
Ryan James, Corporate Information Security Officer, Merthyr Tydfil Borough Council
The solution
Ryan and his team deployed Egress Protect and immediately realised its value. “It was so easy to use; being able to manage everything from our standard Outlook email client — literally being able to just click the button and the emails encrypted was a huge improvement.”
Additionally, Egress helped MTCBC bring users up to speed on the new solution. “It was important that users understand why we implemented the solution. We incorporated that info into our user awareness training and shared the sender and recipient guides from the Egress website. Egress helped educate our users on why the solution was in place and when and why they needed to use it. Our users can now make smarter decisions on when emails need to be encrypted.”
After years of successfully using Egress Protect, MTCBC deployed Egress Prevent to protect against accidental loss of sensitive information. Response to the additional level of protection has been positive. “Implementing Egress Prevent — our users are so grateful for that because they’re worried about getting something wrong and breaching GDPR. So the fact that they get a popup that says, “Are you sure you should be doing this? Should you be moving these to the BCC box?” puts our users at ease. Any one of us can make a mistake, human error is our biggest risk, so that extra layer of tracking has been welcome.”
Implementing Egress Prevent — our users are so grateful…the fact that they get a pop-up that says, “Are you sure you should be doing this? Should you be moving these to the BCC box?” puts our users at ease. Any one of us can make a mistake, human error is our biggest risk, so that extra layer of tracking has been welcome.
Ryan James, Corporate Information Security Officer, Merthyr Tydfil Borough Council
The results
Since deploying Egress Prevent,
- Egress analysed 112,627 emails and warned 623 users that they might be misdirecting an email
- Egress alerted 145 users to the potential of ‘display name impersonation emails’ where the sender may not have been who they said they were as part of a phishing attack
- Egress alerted 393 users that their email recipients had non-compliant TLS and that they should encrypt the email they were sending
MTCBC appreciates the fast, hands-on support that Egress provides. “Egress’ ongoing support is good. We appreciate the regular check-ins — it’s not a matter of ‘buy a product, and that’s it.’ And we appreciate Egress’ technical contacts as well. If there’s an issue that we need quick help with from a technical perspective, it’s easy to get that help. We also like that the products are continually developing, so there’s always something in the pipeline, something evolving to meet changing customer needs,” Ryan said.
“If your organisation is considering Egress as an email security solution, my advice is simple: Go for it,” Ryan concluded.