RE: email fowarding

From: Ben Corman (ben.corman@jefferson.edu)
Date: 06/28/02 

From: "Ben Corman" <ben.corman@jefferson.edu>
To: "'Marcus James'" <marcus01@post.com>, <security-basics@securityfocus.com>
Date: Fri, 28 Jun 2002 13:23:48 -0400

I don't like the idea of employees forwarding their corporate mail to
non-corporate addresses. If you have no control over the system they are
forwarding their mail to, you can't be sure of the security of that
system. For example, just look at all the security problems that hotmail
has over the years. I wouldn't want confidential email hanging out on
hotmail's servers. It would be much safer to set up a web interface to
the mail system. At least then you can audit that system for security
holes.

-Ben

-----Original Message-----
From: Marcus James [mailto:marcus01@post.com]
Sent: Wednesday, June 26, 2002 6:44 PM
To: security-basics@securityfocus.com
Subject: email fowarding

Here's the situation:

One of the companies I work at enables certain users to foward their
email to an external address of their choice. So internal email sent to
an employee may be fowarded externally to a hotmail account for example.
What I am trying to determine is what the best practices are in this
regard. My gut-feel says that this is not a good idea since email is
"inherently insecure" and may be intercepted and so on and so forth. But
on the other hand is this such a big deal? I'm not sure.

A second question: Would forcing users to use a web interface to access
their email instead be "more secure"?

Thanks... 

-- 
__________________________________________________________
Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

Save up to $160 by signing up for NetZero Platinum Internet service.
http://www.netzero.net/?refcd=N2P0602NEP8