The infrastructure team in our medium enterprise has requested blocking of all executables at the firewall. We have a firewall which is capable of DLP, so therefore this can be set up fairly easily. I'm not sure if this is a good idea or not. My questions are:
- Is this common practice in enterprises?
- What are the advantages and disadvantages of doing this?
- What are some other options that may be preferred?
The reason they want this is to protect the network, and specifically users PC's. One obvious disadvantage is that we may end up blocking a valid business exe. Another option is to use some sort of application whitelisting, but this only addresses part of the problem. Anything else I am missing?
Thanks for your help.