34

This was prompted by my CEO asking to get permanent access to everyone's inbox.


He wants for his email client to be configured so that as well as his own email account, he can see the contents/activity of everyone else's as well.

What are all the reasons why this is a bad idea from a security perspective?


Related corollary:

What are all the steps he would have to take to prevent anybody gaining access to/abusing his now god-mode account?

  • 14
    Not exactly a security issue, but there is a MASSIVE privacy issue. – schroeder Oct 14 '16 at 14:01
  • 4
    Isn't privacy part of security? – symcbean Oct 14 '16 at 15:22
  • 38
    Doesn't the CEO have work to do instead of micromanagement? – user2320464 Oct 14 '16 at 16:37
  • 4
    Also posted at workplace workplace.stackexchange.com/questions/77750/… – Jared Smith Oct 14 '16 at 19:19
  • 4
    @SnakeDoc there is an aspect to privacy that includes 'constant monitoring' or monitoring by your manager. You are correct in that your company emails will be logged, stored, and potentially reviewed as part of an investigation, but it is not sane (or legal in many countries) that your manager gets to read all your communications on a whim. This is an example of where security and privacy are different. – schroeder Oct 15 '16 at 7:12
40

So many reasons:

  • Security Risk
  • Legal Liability
  • No Plausible Deniability
  • Not Scalable
  • Memory and System Requirements
  • Unnecessary and Redundant
  • Unproductive use of his time
  • There are better ways to monitor employees
  • Et cetera.

The biggest reason is the security risk. If someone stole his computer, or hacked into it, they would not only get his email, they would get all the email of the entire company, including any trade secrets and confidential information they may contain. Sure, all that information is on the mail server, but the mail server usually has much better security attached to it.

The second is that it is redundant. If he needs access to an employee's email, he can get access to it through IT. He doesn't need it popping up on his computer in real time as well.

And if he is looking at everything, he is focusing on nothing. There is no way he can keep up with emails everyone in the organization sends and received. If he has specific concerns about particular employees, then look at those email accounts. It's more focused and a more productive use of his time.

If he is concerned about certain types of emails, a system can be put into place that flags emails and employees that might need to be reviewed.

Another issue is memory usage. Is his computer actually going to be able to handle 100,000 to 1 million emails in Outlook (or whatever mail client he is using). Probably not.

Besides all of this, such an invasion of people's privacy could cause a hostile working environment, and harm productivity.

Then you have the legal liability. If the CEO gets a copy of every email, and he does not read all of them, and one of the employees does something bad that the CEO does not catch, the CEO could be accused of approving the conduct or casting a blind eye. Instead of the CEO having plausible deniability, prosecutors might accuse him in being complicit in a crime, simply because he did not read every single email the organization sends or receives.

And, this is not scalable either. The more employees he has, the less he will be able to review all the emails. The bigger the organization, the more likely he will be held accountable for an email he didn't have time to read.

There are much better ways to monitor employees than this.

For example, if he really needs that much control over what employees say and don't say, then create a compliance department that spot checks employees, or implement a ticket system which tracks all emails in and out of the system that can be logged into and spot checked from time to time.

Many systems work with email that give advanced functionality, such as:

  • ticket systems
  • project management systems
  • team collaboration systems
  • etc.

In fact, such a system, that he can log into anytime, might be a much better solution, and give him the access and sense of security he is looking for.

Setting up his computer to access everyone's email account is too risky.

  • 17
    And one additional point: what if they're not using email? At least, at all of my most recent employers, we've used email sometimes, but also Skype, Slack, IRC, intranet/extranet and forums, actual physical speech, and a bunch of other non-email channels. Even if you read 100% of email traffic, you'll only be accessing a small percentage of corporate communications. – flith Oct 14 '16 at 21:58
  • 7
    CEO to IT: Can you please install another 32GB of RAM in my computer? Microsoft Outlook is asking for more memory... – phyrfox Oct 15 '16 at 9:08
  • 1
    How about morale? – candied_orange Oct 16 '16 at 6:51
  • 1
    Just a sidenote about Outlook. There is a maximum limit to the size of the .pst files used to store the data. Outlook Some versions of outlook will not produce any warning that the limit is approaching. If the file size is exceeded, Outlook will not be able to read the file at all and fixing that might require manual editing of the file. I've had such case in a company where everyone was CCing the director and at the same time using scan-to-pdf software that was making ~1 MiB per page scans. The result was that after ~2 years worth of e-mails, outlook became unusable. – AndrejaKo Oct 16 '16 at 16:49
  • 2
    @phyrfox CEO to IT: Now a program called "swap" has filled up my hard drive with "system files". Please delete it. – wizzwizz4 Oct 16 '16 at 19:15
15

Disclaimer: I am not a lawyer.

There will be legal problem in some country. In France (and AFAIK in major European countries), every employee is entitled to have some privacy even at the time and place of work. Every restriction to that rule must be justified.

Here are some examples of do and don't:

  • look at the inbox of an employee without serious reasons and procedure: don't
  • log all internet requests of all employees : do (it is even required to conform to the internet provider requirement)
  • manager has access to the above logs: don't
  • when an employee is absent for an unacceptable period of time, and he is supposed to have important informations in his inbox, access the inbox: do - but there should be a manager and an administrator, and they should only read relevant mails
  • if the volume of dowloaded data is abnormally high, examine the logs: do
  • in previous case, require that the employee shows what he downloaded and explain why: do - if the employee refuses, it constitutes a fault and is liable to punishment

No law specifically enforces that, but jurisprudence is consistent on it (at least in France).

  • 1
    This is consistent with company policys ("Betriebsvereinbarungen") that I've read from several different German companies, so I think these rules are also the standard in Germany. I haven't read any case law on it, though. – Sumyrda Oct 14 '16 at 22:08
  • It is legal in France for management to request and get access to an employee's email account for as long as it is for professional work-related aspects. The French Privacy Agency (CNIL) states this clearly. – David Brossard Oct 16 '16 at 0:12
  • 2
    Consequently, if an employee wants to keep certain emails private, they need to place them in a folder clearly labeled as private or personal in which case management is not to go inside that folder. – David Brossard Oct 16 '16 at 0:13
  • Hmm. As an American, it's very interesting to get some different perspectives on this issue from other countries. Because here, generally speaking (there are 50 state jurisdictions in the U.S. + 1 federal, and I'd never claim to be fully familiar with the laws of all of them) an email that is sent to or from the company account of a particular employee still (oversimplifying) belongs only to the company, and the company has all rights to oversee it. Now, where things get a little stickier is when an employee accesses their own personal email account/s using a company device.. – mostlyinformed Oct 16 '16 at 7:30
  • The points listed are correct for France, provided that the users have been informed about the measures. This is subject to discussions (not approval) by the delegates of the employees and the comité d'entreprise (which is a specific independent body funded by the company). – WoJ Oct 22 '16 at 6:21
6

What are all the reasons why this is a bad idea from a security perspective?

I don't think it's terribly bad. It is a risk, and some of the consequences could be quite strong, but it's mostly bad for micro-management, employee-employer trust, employee privacy, legal consequences, action auditing and accountability kind of reasons. Purely in terms of security it adds one endpoint which can access all the email, and that's still inside your office. It's not great, but it's probably not the end of the world.

I will assume Outlook talking HTTPS to Exchange over a LAN, so the network link is reasonably trusted. Most of the risk that I can see is:

  1. The CEO's account becomes a target - especially if you have webmail or mobile access from the internet. One password will get everyone's email from anywhere in the world - is it a strong password, and changed regularly? Even though an administrator could gain access to all the email from a mail server, it's easier to have a long admin password because nobody types it all day every day and logging into an administrator mailbox through Outlook Web Access is still not enough on its own to see all the email.

  2. The CEO computer instantly becomes the easiest way into everyone's email, and would be a great target for attackers. It's not behind locked doors like a server is, and someone is using it for everyday work like browsing websites and opening email attachments - high risk activities for malware and ransomware, which people don't (shouldn't) do on servers.

    a) The CEO presumably has access to a lot of other systems and sensitive data - an attacker could be an employee; malicious employee Alice emails innocent employee Bob an exploit email, intending for the CEO to see it and open it from Bob's mailox, because it has a clickbait subject line - and then exploiting the CEO's access. Same risk ("CEO's computer is tempting"), but from a social engineering view rather than a phishing form/malware/0-day browser exploit view.

  3. Any malware / ransomware which affects email, and gets past antivirus on the CEO's computer would be able to affect every mailbox / every employee instead of just one person (assuming his access is read-write, not read-only). Again, servers are not used interactively for daily work and they don't have Outlook installed. The risk of it happening is increased because the CEO is opening more email destined for more people, and the consequences of the CEO being got by it are higher.

  4. Often, employees will have accounts with third party websites as part of their jobs - supplier ordering systems, provider payment gateways, cloud hosted apps like Salesforce - and they will be tied to the employee email address for login. Resetting passwords through "I forgot my password" will cause an email to the employee email address.

    a) This means the CEO could see all those "your new password is: X" emails, and potentially have access to any of those systems by other accounts instead of their own. Without suggesting that the CEO would misuse this, it gives a malicious employee some deniability - an order was changed to have expensive things on it? The logs say the employee did it, but the employee contends that the CEO has it in for them and has full access to their account and that they did nothing. (Risk relates to guarding the CEO and company against the actions of bad employees).

    b) This is even worse with your comment in the linked Workplace thread where you say the CEO leaves his computer logged in when he's not around - anyone who can walk into his office could be at fault.

    c) The CEO's computer presumably still breaks and needs fixing - helpdesk employees - present or future - have a way to see everyone's email that they should not be able to - and with no audit trail, and plausible deniability for why they 'saw' something in their boss's email.

    d). An employee who walks up to the CEO's computer while the CEO leaves it unlocked could (possibly?) drag and drop/copy mail into their own mailbox to read later at leisure. Anyone's mail.

  5. If the CEO ever follows a tutorial online such as "how to archive my email", there's a risk they will archive everyone's email onto a USB key (or similar) (or clear down someone else's mailbox with some misclicks). Risk is unchanged (human error), but consequences could be higher. Not sure if it's really security related, but guarding against the consequences of human mistakes is part of securing systems.

  6. The CEO's computer hard disk becomes much more interesting, especially if Outlook caches in offline mode, e.g. when the computer is replaced or retired. Hopefully it's encrypted and you have a 'wipe old disks before disposal' policy, but if not it could have even more data on it for someone to read.

Notable other points:

  • Just having mailbox access in Outlook is not enough to give the CEO permission to 'send email as' one of the users, so the risk of mass contact spam, or extra sending is not changed. (I think - Send As doesn't work, but maybe abusing the 'outbox' could?)

  • Many companies have email archiving systems which either intercept email on the way in/out of the company for the purposes of spam/antivirus checking and also archive it, or explicitly connect into the servers and archive the email. Administrative users and managers can then gain access to look at any email. You could demonstrate to the CEO that "the CEO having access" is not the risky thing, it's the CEO having on-by-default access on his everyday computer, using his everyday account which is the risk, and that there are industry standard ways of auditing email which he could check on, which you could implement. This way you aren't just convincing him out of it, but you are offering a more (stable, trustworthy, regulatory compliant) way to achieve the same goal.

  • 1
    +1 to this; email may also allow access to third-party systems like the CRM systems, code repos, and more. It could be a PR nightmare if anyone ever discovered that the password was CEO123$5 or something silly. – phyrfox Oct 15 '16 at 9:07
  • 3
    " Purely in terms of security it adds one endpoint which can access all the email, and that's still inside your office." Not if it's the CEO's laptop. Especially not if he leaves it on a train, or on the back seat of his car. – David Richerby Oct 15 '16 at 12:52
  • CEO123$5? That's the combination I have on my luggage! – Wayne Werner Oct 16 '16 at 2:27
3
  1. Employees may send (private) passwords over mail.
  2. He can’t completely prevent it from being misused / hijacked.

    Someone could always pretend to be him and ask for a password reset at I.T. Or his PC could get infected and keylogged. Or Microsoft could have a vulnerability in Outlook. or, or, or....

  3. Depending on how nosy he is, he may be risking violating common law: more info
  • While I agree with all your points, one could say the same thing for the email admin account (which can do the same as the OP's scenario). Is there something specific to the CEO account that introduces unique risks? – schroeder Oct 14 '16 at 14:03
  • 2
    I might add that the risks go in the opposite direction: the CEO is exposed to every phishing attempt and infected attachment. – schroeder Oct 14 '16 at 14:04
  • Technically there's little difference. But i would argue the chances of a domain admin being phished is way lower than a CEO – J.A.K. Oct 14 '16 at 14:15
  • 15
    I agree, but I meant that in this scenario, the CEO is phished when anyone in the org gets phished. "Wait! Why is that guy getting a zip file with the executive salaries! opens" – schroeder Oct 14 '16 at 14:19
  • Ah! i didn't understand the comment at first but that is an excellent addition to the mentioned risks. +1. – J.A.K. Oct 14 '16 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.