Notifications
Clear all
Topic starter
24/06/2026 10:53 pm
TL;DR: Secure remote email access depends on message authentication, encryption, domain protection, VPN use, and offboarding discipline, according to DigiCert. The article shows that email trust failures are still identity failures first, because spoofing, unmanaged senders, and stale accounts undermine both confidentiality and brand trust.
NHIMG editorial — based on content published by DigiCert: Five Tips for Secure Remote Email Access
Questions worth separating out
Q: How should organisations secure email access for remote workers?
A: Use layered controls rather than relying on a single protection.
Q: Why do spoofed emails remain such a serious identity risk?
A: Spoofed email works because recipients often trust the sender before they inspect the message.
Q: What do security teams get wrong about email encryption?
A: They often treat encryption as if it alone proves trust.
Practitioner guidance
- Deploy S/MIME for high-trust mail flows Use certificate-backed signing and encryption for communications that carry approvals, sensitive data, or external commitments.
- Move DMARC from monitoring to enforcement Inventory every legitimate sender, including marketing platforms and other third-party services, then progress from policy=none to quarantine or reject once alignment is verified.
- Tighten remote access with certificate-based VPN authentication Require stronger authentication for remote email access than passwords alone, especially for staff using home or unmanaged locations.
What's in the full article
DigiCert's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step S/MIME setup guidance for users and IT teams.
- DMARC deployment stages, including how to move from monitoring to quarantine or reject.
- Email security considerations for remote users connecting from home or unknown locations.
- Practical email policy and awareness tips for reducing phishing and spoofing exposure.
👉 Read DigiCert's guidance on five tips for secure remote email access →
Remote email security: where identity controls still break down?
Explore further
25/06/2026 7:44 am
Email trust is an identity control problem, not just a mail transport problem. S/MIME and DMARC both exist because recipients need assurance about who is sending, not only whether data is encrypted in flight. That means email security belongs in IAM governance, certificate lifecycle management, and sender authorisation policy. Practitioners should treat mailbox trust as part of identity assurance, not as a standalone messaging setting.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when a compromised mailbox is used for fraud?
A: Accountability is shared across identity operations, email administrators, and the business owner of the mailbox. If the account was not offboarded, not protected with the right authentication, or not monitored for anomalous use, the gap is a governance failure as much as a security one.
👉 Read our full editorial: Secure remote email access still depends on identity controls
