- What are the arguments against warning end users that compose emails linking to external, non white listed domains?
- Are there available tools, including handling of necessary dialogues with users, that intercepts e-mails as described below?
In the function as a corporate employee, I recently received an e-mail requesting me to fill out an online survey. An external tool was used, so that both the sender's e-mail address and the link to the survey was on an external domain. There was no link to an authoritative, internal site where this external site was white listed.
I assume you agree that this is not OK(1). Logically it would follow that one would train users not to compose such emails, as that will lower colleagues' vigilance. But when I bring this issue up with my managers, they respond "it's OK to click this link", no further action taken.
Would a solution here be to introduce, at the corporate level, a filter of sorts that:
- Monitor incoming e-mail that contains external links that are from non-white listed domains.
- Infer (from name or otherwise) if the sender seems to identify as an internal.
- Halt or append the e-mail (remove links, supply warning including 1) best practices and 2) list out the removed links in a way that require manual work in order to execute them, e.g. inserting square brackets around the TLD or similar).
- Consider also appending e-mails including links to white listed sites, providing confidence and raising awareness.
- Warn the supposed sender about what has happened and again supply advice about best practice.
I would assume this would increase vigilance and make it harder to perform actual attacks, but I have not seen such a safeguard deployed for the clients I have worked for recently, all of which have experience with actual spear phishing attacks.
So again, the questions are:
- What are the arguments for not implementing said filter?
- Does any provider (e.g. Fireeye) provide such filtering(2) OOTB, preferably supporting an ADFS & Exchange-based infrastructure?
(1) Rationale: The e-mail cannot be distinguished from spear phishing; anecdotal evidence suggests that even IT pros easily succumb to this attack form; spear phishing "[accounts] for 91% of attacks" [W]; mature corporations train their users not to click links to external domains that are not authoritatively white listed internally.
(2) The functionality should include 1) reaching out to assumed internal users that, with good intentions, have used external tools to create bulk e-mail, as in the use case described above, and 2) managing an authoritative white list that can be made visible to end users.
Note: Question has been rephrased from "Why don't we warn end users that compose emails linking to external domains?".