6

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click contacts.. add contacts)

My concern about this is that LinkedIn will not only have access to contacts, but also corporate email as well. (which may contain private or confidential information)

My second concern is that many multi factor authentication systems appear "compatible" with this solution, meaning that the LinkedIn is acting as a MITM

Question 1

How should I restrict this type of activity from occurring? What IP addresses should I block on the firewall from accessing my Exchange server?

Question 2

Obviously end users should be informed of this risk and be culturally adapted to not doing such a thing. What is an example communication should I send out that would educate users on not using their corporate credentials on 3rd party sites?

|improve this question
5

There are two different matters here, Outlook Social Connector LinkedIn integration and LinkedIn Outlook contact import. These are totally different things.

  • Importing contacts from Microsoft Exchange: In this case, LinkedIn has no access to your Inbox at all. LinkedIn could indeed have access to the user's inbox. The whole process is controlled by an API provided by Microsoft Exchange itself, it's called Exchange Web Services (EWS). It's up to you to configure the access rights and information shared by EWS.

    You can block this by using the Set-OrganizationConfig cmdlet, then setting the EwsApplicationAccessPolicy value to EnforceBlockList and adding LinkedInEWS to your block list. Now your users won't be able to import their contacts and send them to LinkedIn.

  • Outlook Social Connector LinkedIn integration: In this case, the core of the deal between Microsoft and LinkedIn was to provide social functionalists for Outlook, and to provide LinkedIn an access to millions of address books and inboxes in the corporate world. So if you don't want LinedIn to have access to your inbox, you shouldn't integrate LinkedIn with your Outlook Social Connector.

|improve this answer
  • 1
    I will have to disagree with your understanding of what Web Services can do. I have written C# apps that use EWS, and Outlook for Mac uses EWS. Both have access to the inbox, and more frightenly the "notes" section of Contacts and Notes where 3rd party passwords are often stored. – random65537 May 28 '13 at 14:47
  • @makerofthings7 LinkedIn would have access to the full contact list, including all the fields. It's up to you to inform your users. As far as you'd know, your users might have their last name as a password. – Adi May 28 '13 at 14:50
  • @makerofthings7 and it appears that you're correct. Apparently EWS (if not configured correctly) could spill all of the user's data. I've edited my answer. – Adi May 28 '13 at 14:55
  • I'm trying to figure out the command syntax for the commandlets to Permit MacOSX and deny others. Do you have any idea what this may be or is that best suited for serverfault? – random65537 May 28 '13 at 14:59
  • @makerofthings7 I'd say ServerFault or SuperUser. – Adi May 28 '13 at 15:01
-4

Answer 1) These applications do not arbitrarily connect unless they are given permission to connect. The method to "restrict" is to not allow access whenever it prompts you for access. You can try blocking an IP, but there is a likelihood you will only block yourself from being able to access LinkedIn as a whole. Aside from this, if they're using a CDN (Akamai, etc.) you'd need to block a variety of addresses.

Answer 2) Most corporate networks have security teams. Those security teams get their guidance from senior management. Policies may already be in place to alert users (guidelines, AUPs). If you feel that strongly about it, bring it up to management/

|improve this answer
  • 4
    I believe you have some misunderstandings about who approves the access (users vs. admins) or what the gist of the question is (admins preventing users from permitting access) as well as how CDNs work. – Xander May 28 '13 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.