Enable Sensitive Email Redaction
Sensitive Email Redaction is part of Material Security’s holistic approach to protect sensitive email data at rest. It provides an automated long-tail protection of sensitive content within messages by identifying sensitive categories of email, and redacting those sensitive emails after a configured grace period of time. Should the user need the email after it’s been redacted, they can retrieve it by passing a retrieval authentication challenge. This functionality is designed to enhance data security in the event of a breach, while minimizing disrupting users’ workflows.
Before You Begin
Review the Sensitive Categories guide to understand how this function works and can be applied to emails. Then return here to configure necessary settings.
Complete the Deploy Account Takeover Resilience guide.
Step One: Set Grace Periods
Grace periods are the amount of time a message will remain unlocked once retrieved. Once the grace period expires, users must unlock the message again.
Set grace periods at the Global level, then you can set each of your tenants to inherit the same settings or customize that tenant specifically.
To set grace periods:
From the left navigation, expand Email Redaction, expand Settings, then click Grace Periods:
Configure these three settings:
The Default Locking Grace Period pertains to sensitive messages specifically. It sets the amount of time an unlocked sensitive message, for example, an email with a credit card number, will remain in a user's inbox before it's locked again and requires authentication to unlock.
Set the Default Locking Grace Period at the Global level. Tenants inherit the Global setting unless you configure it otherwise.
There may be cases where a specific Sensitive Category requires a shorter or longer locking grace period. Set these in exceptions:
Message: set an exception based on the message's location in sub-folders.
Category: set exceptions based on specific Sensitive Categories, for example you might want to set Social Security Numbers or credit card numbers to a shorter grace period than the default.
You can edit this Grace Period as needed. Changes take effect immediately. In general, we recommend you don't make exceptions at deployment time but rather update them as you get feedback after deployment.
Retrieval grace periods define how long messages remain in a user's mailbox after they've been retrieved via successful authentication.
Smaller retrieval periods give users just enough time to read an email, but if they're going to need to return to it over a week or a month you should consider a longer period of time.
Once the grace period expires, messages relock.
Choose a time period from the drop down, or set a custom period, then click Save:
Retrieval Challenge Sessions are the amount of time Material awaits before issuing a new challenge after the user successfully authenticates via an MFA challenge. For example, 10 minutes allows users to unlock as many emails as possible in 10 minutes before challenging them again.
We recommend you keep this time period as small as possible.
Choose from an option in the drop down or customize your time limit. If you have a longer session configured in your Identity Provider — that session period takes precedence.
Grace Period Group and Account Exceptions
Often there are groups or accounts in your organization that require slightly different grace periods based on their roles and work. For example, your finance team probably handles a lot of invoices and you may want to set an exception to the Invoice Sensitive Category only for them. Or maybe you want to set a custom Retrieval Challenge Session for Executives specifically.
You can set Grace Period Exceptions at the Group or Account level in the Explorer:
From the left navigation, click Explorer.
Click Groups or Accounts.
Next to Protections, click the Edit icon.
Click Sensitive Email Redaction.
Inherit applies the default setting from above. Choose the option to set a custom or default, then make your changes and Save.
Note, configure Sensitive Category exceptions that apply to all users in the Default Locking Grace Period screen (see description in tab above).
Step Two: Force Unlocks
Occasionally you may need to force unlock an email box, for example to support a litigation-related discovery process or other scenarios when you need to rapidly unlock a portion of messages in an inbox.
Familiarize yourself with this process here:
From the Explorer, select the account to unlock messages for.
Click All Actions (or use the shortcut CMD+K), then select Force Unlock Messages.
Search for and select the messages to unlock, then click Force Unlock Messages again. Note, unlocking a large number of messages can take hours to days.
Force unlock confirmation screen Choose how long to leave these messages unlocked before re-locking in the Re-lock Grace Period.
Optionally, check the box to notify yourself when all the messages were unlocked. You can create additional notifications in Event Subscriptions (click the link in Material to go straight there).
Click Yes, unlock messages.
Step Three: Communicate with Users
Before enabling Email Redaction, let your users know what to expect from the process and how to retrieve sensitive emails. See Communication Templates for examples.
Step Four: Enable Email Redaction
Once you've configured the settings above, contact Material Support to enable Email Redaction globally or for the entire tenant.
Optionally: Run a Trial Period First
Optionally, enabled Sensitive Email Redaction for a few accounts or a group first to run a trial. This is a good opportunity to get feedback from users, soft launch the redaction process, and test your communication for a larger, org-wide launch.
From the workspace, click Explorer.
Click Accounts or Groups.
Check the box next an account(s) or group.
Click Edit Settings.
Select Override Sensitive Email Redaction, then toggle it On.
Last updated
Was this helpful?