In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that lots of users have cookies, which are older than two years.
This leads me to the question: is it reasonable to block Cookies completely company-wide?
Do some security issues exists that support this idea, i.e. pros?
Or is this just a bad idea, e.g. in terms of user-comfort?
You can use black lists of tracker or advertisement websites (from ad-block software) to filter cookies that you can safely remove. You should leave legitimate cookies because you should not hinder your users in their work without a really good reason.
However, you can change default settings in the browsers to keep cookies until the browsers are closed. This will allow users to change the setting on the website that matters. You should document this change of policy and communicate it to your users before applying it.
Surprising that the cookie database is still storing 2+ year old cookies. I have never seen that. Generally, most cookie generation logic implements an expiration policy - and expired cookies should be removed from the DB. But that's just one part of your problem.
Your main question is "blocking cookies enterprise-wide"? To answer that, its technically certainly possible and in some modern web-architecture that's one way of implementing security in websites - going cookie-less and using authentication tokens. Authentication token has lot of advantages over cookies - one being you don't really need to store them on DB anymore. But to implement authentication token architecture requires changes in the website/application's logic. You have to really do the cost benefit analysis.
Now, you have to remember one thing that there are many websites which supports only cookie based authentication. If you enforce no-cookie policy in your organization, then you cannot use those as well.
