RE: email foRwarding

From: Wolf, Glenn (glenn.wolf@we-inc.com)
Date: 06/27/02 

From: "Wolf, Glenn" <glenn.wolf@we-inc.com>
To: security-basics@securityfocus.com
Date: Thu, 27 Jun 2002 10:45:24 -0700

Sounds like a policy issue. If users are doing this so they can get their
email "on the road" or from home, it would probably be worthwhile to set up
a web-mail interface instead. Email IS inherently unsecure (think
post-office personnel reading your postcards). What needs to be weighed is
whether you can create a MORE secure email access point than, say, hotmail,
which has had its own problems... ;)

Glenn

-----Original Message-----
From: Marcus James [mailto:marcus01@post.com]
Sent: Wednesday, June 26, 2002 3:44 PM
To: security-basics@securityfocus.com
Subject: email fowarding

Here's the situation:

One of the companies I work at enables certain users to foward their email
to an external address of their choice. So internal email sent to an
employee may be fowarded externally to a hotmail account for example. What I
am trying to determine is what the best practices are in this regard. My
gut-feel says that this is not a good idea since email is "inherently
insecure" and may be intercepted and so on and so forth. But on the other
hand is this such a big deal? I'm not sure.

A second question: Would forcing users to use a web interface to access
their email instead be "more secure"?

Thanks...