Question

An organization wants to protect the confidentiality of sensitive emails sent to external business partners. IT proposes encrypting all outbound messages using the sender's own private key so recipients can verify the origin. As the IS auditor, what is your PRIMARY concern with this proposed approach?

Accepted Answer

Encrypting with the sender's private key provides authentication and integrity but not confidentiality, since anyone with the sender's public key can decrypt the message

Answer

The approach requires each recipient to maintain a hardware security module to store the sender's private key

Answer

Asymmetric encryption is too slow to be used for any email communication, so symmetric keys must always be used instead

Answer

The sender's private key would expire before the recipient could open the message, causing delivery failures