Following on to questions like Sandbox for attachment accessment and How do I safely inspect a suspicious email attachment?.
Why don't we sandbox email clients company-wide?
I must be missing something. Why don't companies insist on email clients being sandboxed and disconnected for the LAN? This would be a great way to prevent phishing attacks, which are still the most common attack vectors of viruses and ransomware attacks. I often read variations of:
Phishing remains the most popular attack vector for all malware, including ransomware, because it never fails. (From here, for example)
This is what I have thought of so far that would be needed to implement this idea:
- Give every employee a second machine that is not connected to the LAN.
- Attach it to a separate ISP using a wireless connection.
- Ensure safety features such as anti-virus software are automatically updated.
- Install VM software as an added layer of protection, and to easily setup and clean the machines.
- Install the email client and basic editing tools, if needed.
- Connect the VM to a safe FTP server so as to enable transferring files sent & received via email.
- Train employees to open all attachments locally before transferring to FTP server.
- Word files should first be printed as FDP, or, if they are needed in Word format they should saved under a new name after ensuring macros are safe or deleted
- PDF files should first be printed to PDF to ensure they are clean and the newly printed version uploaded.
- Executables (assuming they need to be received via email) should be saved and run first locally and then quarantined for 24 hours after which they can be uploaded to the FTP server.
I understand the aggravation of not being able to send email directly from the "work" machine, as well as the expense of each employee having this sandbox. However, considering the expense of an attack, this would be great ROI, one would imagine.
What am I missing? there has to be a reason that this isn't being implemented (at least not very widely, or we'd hear about it).