3 ms·
> People connecting through our VPN have access to an internal-only SMTP gateway machine that doesn't require SMTP authentication. This part sounds... not grea
by voytec 2y ago
> People connecting through our VPN have access to an internal-only SMTP gateway machine that doesn't require SMTP authentication.
This part sounds... not great. Even bad actor within org could send messages as someone else: president to payroll etc.
- spogbiper 2y agonot great indeed. is this organization not under any compliance requirements? unauthenticated SMTP is not going to pass even the laziest of security scans. although neither is VPN access without MFA