Backing Up on Autoforward

Computerworld - Trouble Ticket

Issue: Outlooks autoforward feature emerges as a security risk.

Action plan: Disable it for employees who cant demonstrate a valid business use. And find out who those people are.

The other day, our CIO wanted to know why an executive vice president had been able to receive an e-mail containing a spreadsheet with sales forecasts. That didnt sound too alarming to me. An executive vice president is a likely person to be given clearance for that sort of data. Then the other shoe dropped.

It turned out that this particular executive resigned two months ago and is now working for a competitor. We have a couple of problems.

The first is that our employee termination proc­ess is broken. Ideally, we would have an identity management tool tied into our various enterprise systems. When an employee left the company, all access to our infrastructure and applications would be quickly removed.

Unfortunately, we have neither the budgetary nor the human resources to do that. What we do have is single sign-on and SecurID two-factor authentication for remote access. Single sign-on ensures that when a user is removed from one location, access across the board will be denied to that user. The benefit of Secur­ID in this regard is that departing employees must turn in their tokens to their managers prior to picking up their final paychecks.

The second problem is that autoforward to the Internet is enabled.

Microsoft Outlook is very flexible. Among its many bells and whistles is the ability to autoforward mail, which is useful if you ever need to read e-mail from some other mail account or if you need someone else to receive a copy of some of your e-mails. This feature has been incorporated into some of our business processes. For example, résumés are autoforwarded to our external hiring agency. But while its valid to allow autoforward for such business-related functions, I decided that the risk is too great to allow all employees to configure their email accounts so that they can forward mail outside the company.

Not So Fast

Disabling autoforward is a simple check-box operation. But just checking the box and saying, There, thats all set, could lead to business disruptions. We had to run this like a miniproject so that we could discover, as best as possible, all accounts with autoforward enabled. We did this by sending a global e-mail message and using Proofpoint to detect instances of it being forwarded to outside e-mail addresses.

We mainly use this tool, from Proofpoint Inc., to guard against spam, but it can also be used to conduct keyword searches on e-mail leaving the company. With it, weve been able to detect intellectual property and other confidential information being sent to unauthorized destinations.