forwarding company email to a contractor's email address

Question

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a contractor's email address. The company email accounts contain proprietary information and we are forwarding company data to a non-company account.

Can we block logging into our company network with the AD account? Should we force contractors to use the company email address?

How do other companies handle data sharing with contractors? I'm looking for standard operating procedure or process guidance. Thank you.

Answer 1

Not certain about blocking login but I think you can - I'm fairly sure there is a setting in AD that blocks login but whether that has other impacts, I don't know.

In regard to data sharing...

You should, at a minimum, have a data sharing contract between you and the contractor so that you can legally hold them to account.

If you need to keep tighter control on the information, you should restrict them to using your own mail system. Remember that, once the data leaves your email system, you have little control over the channels it goes over nor control over whether those channels are secure.

Ultimately, this will come down to a balance between cost, convenience and security and you need to understand both the risks and the impacts before you can make a sensible decision. If you work in a regulated industry or are a high-risk organisation then the risks and impacts are much higher and you should almost certainly be using only your internal system and be restricting to controlled devices. At the other end of the scale, you may see little impact at losing data occasionally or little risk that someone might be interested enough to try intercepting data and in that case, you wouldn't bother.

Answer 2

We prohibit the automated forwarding of corporate email to external email accounts as part of our Acceptable Use policy. This policy applies to staff, contractors and any other third parties who have access to our systems.

Please see the following write up on how to create Exchange policies that restrict or allow forwarding https://exchangepedia.com/2015/03/disable-automatic-forwarding-of-email-in-office-365-and-exchange-server.html

If your organization does not yet have an Acceptable Use policy I can suggest you grab a copy of the following template from SANS as a starting point https://www.sans.org/security-resources/policies/general#acceptable-use-policy

Good luck and keep up the good work. Forwarding enterprise email outside of the enterprise is a real problem.

Answer 3

I will more-or-less agree with @Julian Knight (+1) and argue that it is a question of balancing cost, convenience and security. It is definitely true that, once information leave your email servers you cannot do anything in terms of protecting it. On the other hand, you do want your contractors to be able to read the emails.

One may argue that deploying your own email system (e.g. by placing Office 365 on top of the exchange server, or even something much simpler such as webpine) instead of simply forwarding email to other email clients will prevent the emails leaving your servers unless the user logins. Yet, when the user does login and sees the email nothing can prevent him from copying and pasting the email text into a text editor.

Therefore there isn't a real security improvement in rolling your own email system instead of providing IMAP or POP3 access, over TLS of course (which isn't the same as forwarding but can be made to work as such with some kind of periodic job). The email text will always end on the computer of the contractor for him to be able to read it.

Moreover, rolling your own system or forcing contractors to use specific clients may be worse in terms of security than using a well defined standard such as STARTTLS - RFC 7812. Not only it may suffer from trivial coding mistakes, but a good contractor may be tempted to find these mistakes to automate his email retrieval.

I'm saying this from personal experience: a company I once worked for required all email users to install an outdated version of Internet Explorer because their email system would not work with a never version. A small python script with a clever User-Agent and a 10 line JavaScript interpreter did the trick of automated email retrieval.

In summary

Plain forwarding is a bad idea because the email may end on some third party server that is neither under your control or the contractor's control. Yet (in most cases), that does not mean you should allow email access only through approved clients. That is because, unless you plan to invest a big amount of development and audit time to make sure these approved clients will not leak the emails, you're better using well known standards.

And once you allow a contractor to read the emails, you should not be concerned that the emails end on the contractor's computer, they will end there no matter what you do. If the contractor has an email server of his own and wants to use IMAP over TLS to sync his server with yours there isn't much you can do to prevent it. If he gets that mail server compromised it is his fault, and it is not really different from him losing his computer together with company data on it.