3 ms·

There are often classes of employees where external email is completely unnecessary. I know of one financial institution who has implemented this. It wouldn't

There are often classes of employees where external email is completely unnecessary. I know of one financial institution who has implemented this. It wouldn't work well for many employees though. For example, try signing up for a legitimate service and guessing what email address the confirmation link will be sent from.

nefitty 5y ago
In a strict security environment, shouldn’t the employee request permission or, at the very least, give IT a heads up that they’re going to sign up for an external service? IT would vet the service and then apply the domains to the whitelist. I know how bad it sucks to have to ask permission for every little thing, but if the alternative means risking ransomware attacks, then the case should be laid out transparently to everyone in the org so they understand why the rule is in place.