Why don't we sandbox email clients company-wide?

Question

Following on to questions like Sandbox for attachment accessment and How do I safely inspect a suspicious email attachment?.

Why don't we sandbox email clients company-wide?

I must be missing something. Why don't companies insist on email clients being sandboxed and disconnected for the LAN? This would be a great way to prevent phishing attacks, which are still the most common attack vectors of viruses and ransomware attacks. I often read variations of:

Phishing remains the most popular attack vector for all malware, including ransomware, because it never fails. (From here, for example)

This is what I have thought of so far that would be needed to implement this idea:

• Give every employee a second machine that is not connected to the LAN.
  • Attach it to a separate ISP using a wireless connection.
  • Ensure safety features such as anti-virus software are automatically updated.
• Install VM software as an added layer of protection, and to easily setup and clean the machines.
• Install the email client and basic editing tools, if needed.
• Connect the VM to a safe FTP server so as to enable transferring files sent & received via email.
• Train employees to open all attachments locally before transferring to FTP server.
  • Word files should first be printed as FDP, or, if they are needed in Word format they should saved under a new name after ensuring macros are safe or deleted
  • PDF files should first be printed to PDF to ensure they are clean and the newly printed version uploaded.
  • Executables (assuming they need to be received via email) should be saved and run first locally and then quarantined for 24 hours after which they can be uploaded to the FTP server.

I understand the aggravation of not being able to send email directly from the "work" machine, as well as the expense of each employee having this sandbox. However, considering the expense of an attack, this would be great ROI, one would imagine.

What am I missing? there has to be a reason that this isn't being implemented (at least not very widely, or we'd hear about it).

Answer 1

What am I missing?

Usability.

Mail is tightly integrated into the workflows, both for internal communication and data exchange as for external. Using a separate machine to handle mail severely disrupts essential workflows and thus highly impacts usability and efficiency. This will basically result in users working around this problem - like trying to shift most of their tasks to the sandboxed machine, which includes storing sensitive documents there since they need to be transferred by mail.

This is like forcing users to use a sandboxed machine for Excel and Word documents since these might contain macros and are thus dangerous.

Apart from that it would not solve the problem of credential phishing at all, which is one of the main kinds of phishing.

Answer 2

There is a problem in the gain/cost ratio with your suggestion.

The common ways to secure corporate end user machine without too much usability loss are:

• end users should not have admin privileges on their machine and are stricly forbidden to install external software (both technical and legal constraints)
• internet access should go through a corporate firewall that forbids most incoming access and only allows outgoing HTTP/HTTPS access with white or black listing (no other outgoing protocol available)
• anti-virus platform and system updates are managed by the admin/security teams

For the mail, end user machines can only send and consult mail through a, internal server. Incoming mail is submitted to a security platform that

• uses a regurlarly updated anti-virus/anti-malware
• reject a number of extensions, often any executable file, Office files containing macros and encrypted archives

All the offending files are stored in a quarantine zone, and can only be extracted by the security team after manual control

This provides almost the same protection level as what you propose for a much lesser cost for the standard end user security zone.

Things can be different for higher security zones, but only a reduced number of machines are considered.

Those higher security zones can include (non limitative list):

• system admins machines - this zone is not necessarily more restricted than the standard one but is isolated to not suffer from a compromission on the standard zone
• mission critical machines - I have seen that in Meteo France (French Met Office): the previsionist ingenieurs did have a Unix workstation for the operational work with no mail reader installed, and a simple Windows machine for reading their mail and non critical tasks. The operational and standard zones were on distinct networks
• military grade machines: law can require special measure to prevent any authorized access to some documents. I have seen a dedicated network physically isolated from the standard network not speaking of internet. Data could only be exchanged manually under control of the security team on dedicated machines with manual control and using special devices that were securely erased before and after use.

The problem with those solutions is that their cost is rather high, so they are restricted to a very small number of machines. As usual the security level has to be proportionated to the estimated risk.