This was prompted by my CEO asking to get permanent access to everyone's inbox.
He wants for his email client to be configured so that as well as his own email account, he can see the contents/activity of everyone else's as well.
What are all the reasons why this is a bad idea from a security perspective?
Related corollary:
What are all the steps he would have to take to prevent anybody gaining access to/abusing his now god-mode account?
So many reasons:
The biggest reason is the security risk. If someone stole his computer, or hacked into it, they would not only get his email, they would get all the email of the entire company, including any trade secrets and confidential information they may contain. Sure, all that information is on the mail server, but the mail server usually has much better security attached to it.
The second is that it is redundant. If he needs access to an employee's email, he can get access to it through IT. He doesn't need it popping up on his computer in real time as well.
And if he is looking at everything, he is focusing on nothing. There is no way he can keep up with emails everyone in the organization sends and received. If he has specific concerns about particular employees, then look at those email accounts. It's more focused and a more productive use of his time.
If he is concerned about certain types of emails, a system can be put into place that flags emails and employees that might need to be reviewed.
Another issue is memory usage. Is his computer actually going to be able to handle 100,000 to 1 million emails in Outlook (or whatever mail client he is using). Probably not.
Besides all of this, such an invasion of people's privacy could cause a hostile working environment, and harm productivity.
Then you have the legal liability. If the CEO gets a copy of every email, and he does not read all of them, and one of the employees does something bad that the CEO does not catch, the CEO could be accused of approving the conduct or casting a blind eye. Instead of the CEO having plausible deniability, prosecutors might accuse him in being complicit in a crime, simply because he did not read every single email the organization sends or receives.
And, this is not scalable either. The more employees he has, the less he will be able to review all the emails. The bigger the organization, the more likely he will be held accountable for an email he didn't have time to read.
There are much better ways to monitor employees than this.
For example, if he really needs that much control over what employees say and don't say, then create a compliance department that spot checks employees, or implement a ticket system which tracks all emails in and out of the system that can be logged into and spot checked from time to time.
Many systems work with email that give advanced functionality, such as:
In fact, such a system, that he can log into anytime, might be a much better solution, and give him the access and sense of security he is looking for.
Setting up his computer to access everyone's email account is too risky.
Disclaimer: I am not a lawyer.
There will be legal problem in some country. In France (and AFAIK in major European countries), every employee is entitled to have some privacy even at the time and place of work. Every restriction to that rule must be justified.
Here are some examples of do and don't:
No law specifically enforces that, but jurisprudence is consistent on it (at least in France).
What are all the reasons why this is a bad idea from a security perspective?
I don't think it's terribly bad. It is a risk, and some of the consequences could be quite strong, but it's mostly bad for micro-management, employee-employer trust, employee privacy, legal consequences, action auditing and accountability kind of reasons. Purely in terms of security it adds one endpoint which can access all the email, and that's still inside your office. It's not great, but it's probably not the end of the world.
I will assume Outlook talking HTTPS to Exchange over a LAN, so the network link is reasonably trusted. Most of the risk that I can see is:
The CEO's account becomes a target - especially if you have webmail or mobile access from the internet. One password will get everyone's email from anywhere in the world - is it a strong password, and changed regularly? Even though an administrator could gain access to all the email from a mail server, it's easier to have a long admin password because nobody types it all day every day and logging into an administrator mailbox through Outlook Web Access is still not enough on its own to see all the email.
The CEO computer instantly becomes the easiest way into everyone's email, and would be a great target for attackers. It's not behind locked doors like a server is, and someone is using it for everyday work like browsing websites and opening email attachments - high risk activities for malware and ransomware, which people don't (shouldn't) do on servers.
a) The CEO presumably has access to a lot of other systems and sensitive data - an attacker could be an employee; malicious employee Alice emails innocent employee Bob an exploit email, intending for the CEO to see it and open it from Bob's mailox, because it has a clickbait subject line - and then exploiting the CEO's access. Same risk ("CEO's computer is tempting"), but from a social engineering view rather than a phishing form/malware/0-day browser exploit view.
Any malware / ransomware which affects email, and gets past antivirus on the CEO's computer would be able to affect every mailbox / every employee instead of just one person (assuming his access is read-write, not read-only). Again, servers are not used interactively for daily work and they don't have Outlook installed. The risk of it happening is increased because the CEO is opening more email destined for more people, and the consequences of the CEO being got by it are higher.
Often, employees will have accounts with third party websites as part of their jobs - supplier ordering systems, provider payment gateways, cloud hosted apps like Salesforce - and they will be tied to the employee email address for login. Resetting passwords through "I forgot my password" will cause an email to the employee email address.
a) This means the CEO could see all those "your new password is: X" emails, and potentially have access to any of those systems by other accounts instead of their own. Without suggesting that the CEO would misuse this, it gives a malicious employee some deniability - an order was changed to have expensive things on it? The logs say the employee did it, but the employee contends that the CEO has it in for them and has full access to their account and that they did nothing. (Risk relates to guarding the CEO and company against the actions of bad employees).
b) This is even worse with your comment in the linked Workplace thread where you say the CEO leaves his computer logged in when he's not around - anyone who can walk into his office could be at fault.
c) The CEO's computer presumably still breaks and needs fixing - helpdesk employees - present or future - have a way to see everyone's email that they should not be able to - and with no audit trail, and plausible deniability for why they 'saw' something in their boss's email.
d). An employee who walks up to the CEO's computer while the CEO leaves it unlocked could (possibly?) drag and drop/copy mail into their own mailbox to read later at leisure. Anyone's mail.
If the CEO ever follows a tutorial online such as "how to archive my email", there's a risk they will archive everyone's email onto a USB key (or similar) (or clear down someone else's mailbox with some misclicks). Risk is unchanged (human error), but consequences could be higher. Not sure if it's really security related, but guarding against the consequences of human mistakes is part of securing systems.
The CEO's computer hard disk becomes much more interesting, especially if Outlook caches in offline mode, e.g. when the computer is replaced or retired. Hopefully it's encrypted and you have a 'wipe old disks before disposal' policy, but if not it could have even more data on it for someone to read.
Notable other points:
Just having mailbox access in Outlook is not enough to give the CEO permission to 'send email as' one of the users, so the risk of mass contact spam, or extra sending is not changed. (I think - Send As doesn't work, but maybe abusing the 'outbox' could?)
Many companies have email archiving systems which either intercept email on the way in/out of the company for the purposes of spam/antivirus checking and also archive it, or explicitly connect into the servers and archive the email. Administrative users and managers can then gain access to look at any email. You could demonstrate to the CEO that "the CEO having access" is not the risky thing, it's the CEO having on-by-default access on his everyday computer, using his everyday account which is the risk, and that there are industry standard ways of auditing email which he could check on, which you could implement. This way you aren't just convincing him out of it, but you are offering a more (stable, trustworthy, regulatory compliant) way to achieve the same goal.
Employees may send (private) passwords over mail.
He can’t completely prevent it from being misused / hijacked.
Someone could always pretend to be him and ask for a password reset at I.T. Or his PC could get infected and keylogged. Or Microsoft could have a vulnerability in Outlook. or, or, or....
Depending on how nosy he is, he may be risking violating common law: more info
