-1

Overview: I am interested in having an e-mail account designated for receiving anonymous tips as part of a larger anonymous tip infrastructure at my business. My professional domain's e-mail is provided by a popular web-based e-mail service. Because I am soliciting information about potential wrongdoing, I am concerned that someone might send me an e-mail containing malicious code and compromise the larger group of e-mail accounts through my professional domain. In theory, I would only use the e-mail to receive the files, but I would evaluate them on a separate air-gapped machine. This is where I don't really understand (a) the risks if I simply downloaded any relevant attachments and (b) potential mitigation strategies.

Questions: First, should I be concerned about simply using an e-mail address within my professional domain to download files to external media for evaluation on an air-gapped machine? Second, would simply auto-forwarding e-mails from the professional domain e-mail to an external service like Protonmail reduce the likelihood that a file compromises the e-mail service associated with my professional domain?

Thank you!

Improve this question
0

1 Answer 1

Reset to default
0

Clearly, if your service is vulnerable to receiving malicious files by e-mail this needs to be addressed anyway!

However, if you explicitly ask for such mails, you remove the legal recourse. Therefore I suggest you check with the people running those services. It might even violate their terms of service to send and receive malware.

In general, there are plenty of reasons why "files at rest" might still compromise a system. Many mail gateways scan incoming e-mails for viruses, and virus software is often vulnerable itself. The debate whether AV makes a system more or less secure is still ongoing. Some MTAs try to do all kinds of clever things but you cannot really find out without contacting the people running the system.

In rare cases forwarding might circumvent some of these checks. Again you cannot rely on that without contacting the admins.

Improve this answer
3
  • Thank you for the response @Elias. On your first point, any e-mail address is vulnerable to receiving malicious files unless I'm mistaken. My concern is that soliciting anonymous tips of wrongdoing might make me more likely to receive malicious files. I'm not sure why legal recourse is an issue. I am not specifically asking for people to send me malware and nor would I knowingly send malware to the hypothetical Protonmail address.
    – Tigelle
    Commented Feb 20, 2018 at 11:23
  • Well, vulnerable as in "getting a malicious e-mail is a problem", not "can receive (malicious) e-mail". ;)
    – Elias
    Commented Feb 20, 2018 at 19:52
  • ok, makes sense.
    – Tigelle
    Commented Feb 21, 2018 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .