Corporate email services often use web-based solutions like gmail or office365.
Is there any valid security concern in allowing third party email clients if two factor authentication is enabled on the email accounts?
3
-
Can you convince your IT and security departments that your third-party client is as secure as the ones that they've vetted? Did you use the same standards for accessing the email server(s), the same reliability and security of the 2fa, is the local cache handled the same? If you can access their SOPs and prove that your software is superior, you might have a chance but I would not count on it.– doneal24Nov 18, 2022 at 0:25
-
What is SOP? I'm not too familiar with the terminology.– John DoeNov 18, 2022 at 17:23
-
SOP = Standard Operating Procedure. Semi-exact definition of the requirements and procedures to used to choose and/or validate the software suitable for a particular application.– doneal24Nov 18, 2022 at 17:39
Add a comment
|
2 Answers
The most obvious problem is that, by allowing users to install email clients on their computers, the attack surface of the company's network is increased; the IT will have to (or even worse, they don't have to) maintain all the new software (email clients) that is installed to users' computers, which may or may not be done properly (allowing software vulnerabilities go unnoticed until otherwise).
Also, since the IT department has to allow access to IMAP/POP ports from everywhere, password spraying or plain brute force attacks may become an issue (attacking IMAP/POP servers is easier than a web based email service).
It's also a matter of company strategy against data leakage - they may not want you to have a copy of every email that reaches you by accident.
However, the biggest problem is that you weaken significantly any data breach protection mechanism you have in place. For example, several companies do not allow using USB sticks to trasfer data in and/or out of their users' computers. By allowing email clients, imagine how easy it is for every disgruntled employee to download sensitive or restricted company emails to any computer which is outside of the control of the company. This can go as far as corporate espionage, where an employee can find for example the next year's commercial plans, email the plans to themselves, download them to their computers and sell them to a competitor.
Although you can also do such things by using a web email client (e.g. by copying the email text or taking screen shots), it's a lot easier if you can download all available emails to your computer and go through them at the comfort of your home; a company can cut you out from their network at will, but they cannot raid your home and seize your computer in order to get back those emails you have (unless they have the legal right to - but at that point you know you did something wrong and you will have taken your counter measures). Plus, traffic analysis is far easier by monitoring selective downloading of attachments, than trying to figure out who has bad intentions when everyone downloads everything at their computer.
-
but corporate microsoft or gmail accounts ports are always reacheable through IMAP if a VPN is not mandatory for devices to access the accounts. What kind of email client vulnerabilities would pose a problem?– John DoeNov 18, 2022 at 17:27
-
1@JohnDoe I just realized that the first part of my answer may have been confusing so I rephrased it, in order to make it more clear. For the second part of your comment, a vulnerability that will allow a virus to be spread to the corporate network (e.g. the melissa virus)– user284677Nov 18, 2022 at 20:57
Is there any valid security concern?
Yes, the most obvious one being that there's now going to be third party clients having access to corporate email accounts, and by extension corporate data. Whatever browser/client you use can at the very least read your emails.
In a perfect world this wouldn't matter and it would be possible to completely handle security at the server side, since it will all boil down to some API calls and SMTP/IMAP connections, but realistically, these third party clients are their own programs, and may have their own vulnerabilities - it's not a realistic workload for your average IT department to handle.
The IT departments of most smaller orgs likely won't concern themselves with this kind of risk, since it's very generic and can basically happen anyway (ex. vulnerabilities in one browser vs. another, malicious extensions, etc.), but larger orgs will likely have policies in place enforcing that corporate email should only be accessed from corporate devices, which are ultimately administered by IT -- that way they can define what email clients/browsers have been vetted & approved, in addition to being able to force/centralize updates instead of leaving it up to the user.
-
shouldnt they priorize enforcing access to the accounts only from the corporate devices before bothering to disable 3rd party email tools?– John DoeNov 18, 2022 at 17:30
-
1@johnDoe for sure yeah. IT will typically only have visibility/administrative control over corporate devices. So the first priority would be restricting access to only those devices. Then for these corporate devices, each app they allow would bring with it some amount of administrative overhead to vet, deploy, secure, & monitor. Most IT departments are already stretched thin in my experience, so a smaller list is typically preferred unless there is a good justification or business directive. Nov 19, 2022 at 6:43