Blanket blocking SMTP email services for security reasons at work

Question

I've read the help pages and other guidance on subjective questions, I am trying to keep this question as objective as possible, so I'm going to ask up front that people stick to backing any response with facts, first-hand experiences or examples.

My work is blocking email services, they claim for security reasons,

At work You are correct, we block SMTP and other email services to unknown servers from the Internal network as a security precaution.

That said we can make exceptions so if you can send me:

1. The server(s) involved
2. The ports you need (25,143,110 etc)

What are the main concerns when deciding to whether to allow these services?

My thoughts so far are not very objective, hence why I need some more professional help;

• Social engineering? People browsing non-work emails may have poor spam filters and inadvertently click on links to malicious websites, however I don't have any objective evidence that this would be a valid concern for the company... at least any more so than people browsing the web (which is totally unfiltered)

• I don't believe it to be an attempt to boost productivity as social media websites are not blocked, much better targets for employee time wasting these days.

• They haven't by default made exceptions for the most common email services, suggesting they still mistrust those and want to discourage email use as much as possible.

Answer 1

This is usually a damage limitation procedure, so that if a system within the network gets infected with spam-sending malware (which used to be really common, and is still a fairly common payload for botnets), it doesn't cause reputational damage to the business, or cause the legitimate business email to be classed as spam, due to coming from the same source as junk mail.

For businesses, this may also make it easier to ensure that all outgoing email goes through a known server, to add signatures or legal notices.

Answer 2

My work is blocking email services,... What are the main concerns when deciding to whether to allow these services?

First, keeping arbitrary email services open is not needed for company mail. Thus the main reason users might want this is to have access to private mail from inside the company network, maybe also by using private computers or mobile devices.

Offering a way to send mail using private accounts or systems can cause various security problems:

• The access could be used for sending spam or other bad mail. This could be done by malicious users or by infected systems. Since the origin of this mail (i.e. IP address) is the company this could impact the reputation and maybe put the company at spam related blacklist. This itself could impact the ability of the company to send important work related mails.
• Data leakage, i.e. using private mail to send company data to the outside world. Of course there are lots of other ways to do this but many users rethink what they are doing if the most obvious way to do it is blocked. Data leakage is often caused by non-malicious workers who just try to take work related information home in order to continue work there.

As for allowing to receive mail on private accounts from inside the company: This is definitely a problem of malware and phishing. In lot of environments it is not allowed to monitor access to private mail which means that you either allow unmonitored access and accept the risk or simply block it.

Answer 3

Aside from the thing you mentioned, it may also be a Data Loss Prevention measure, making sure people do not send out or transfer company information using personal email.

Answer 4

They might be blocking any outgoing connection which is not on port 80 and 443 for security reasons. It makes sense allowing systems to do exactly what they need to do and not more. And a whitelist approach usually works much better than a blacklist approach.

Sure, an attacker might use port 443 to extract information or control malware for exactly this reason, but you never know. It also makes it harder to use BitTorrent or other software which is not work-related.