We Want to Quit but Can’t : Understanding Organizational Flawed Decision Makings on Email Security Practices

Despite growing security threats, email remains a prevalent communication tool in businesses worldwide. Organizations have implemented various security countermeasures, yet errors in decision-making often lead to ineffective or even harmful practices. This study examines a widespread but flawed email security practice in Japan in which a password-protected ZIP file and its password are sent in separate emails over the same channel. Its primary weakness is the lack of effective separation between the encrypted file and its decryption password: an adversary who gains access to both messages can decrypt the attachment, potentially exposing confidential data. A secondary, deployment-dependent concern is that encrypted attachments may reduce malware-inspection visibility when security systems cannot decrypt them. Through a mixed-methods approach, including a large-scale survey and in-depth interviews, we explore why organizations adopt and continue using this ineffective practice. Our findings reveal that the visibility of security measures to both senders and recipients significantly influences decision-making, often outweighing considerations of actual effectiveness. Additionally, peer pressure from competitors and business partners drives the perpetuation of insecure practices. In some cases, organizations struggle to fully grasp the risks posed by their current security protocols. These insights highlight the need for email security solutions that account for user perceptions and the complex dynamics of modern business environments.