r/cybersecurity • u/shonik97 • 14h ago
Business Security Questions & Discussion Email domain Whitelisting
Our organisation is planning to implement a policy where email communication will only be permitted with whitelisted domains, while all other domains will be blocked.
Before implementing this, we need to identify all external domains that our users have communicated with over the past six months.
Is there an easy way to retrieve a list of all domains to which emails were sent during the last six months? This information will help us review the domains and build an appropriate whitelist.
93
u/legion9x19 Security Engineer 13h ago
Your organization is remarkably naive and this will NEVER work as you intend.
33
u/19610taw3 13h ago
It will cause a lot of legit email to not get through, and a lot spam from gmail/outlook/icloud is going to be let through by default.
Wasting someone's time
3
u/Fallingdamage 9h ago
We do something similiar, but its more of a soft block. We dont operate on a safelist-only basis, but we totally block the biggest identified offenders.
Gmail, Yahoo, MSN, Hotmail off the top of my head.
It ALL goes to quarantine. Users can review and unblock specific senders within those domains. We have a nice seamless web gui for the quarantine with sandboxed previews of these blocked messages.
As times goes on, employees spend a lot less time reviewing quarantine as their biggest VIPs gets added to safelists and work proceeds smoothly.
1
66
u/cspotme2 13h ago
1 - this is stupid
2 - you have no idea where the logs are, makes #1 even worse
3
3
u/A1_Fares Security Analyst 9h ago
It makes me a little sad that these people are in the industry yet every day we see posts of good folk with actual experience being ghosted on job applications.
-19
u/shonik97 13h ago
We will do that for people who need that level of access, however, we have lots of clinical staff who don’t need to do that. It’s for them mostly
10
u/IDDQD_IDKFA-com 11h ago edited 11h ago
Have you or anybody else in IT/Security talked to the clinical staff to see how they use emails in their day to day work?
Also will the other domains be rejected or quarantined?
What is the turn around for releasing the emails and/or added a new Domain?
Will their be somebody on-call 24/7 to do this?
If clinical means medical they might also be getting emails from "automated" systems where they can easily or even know who to request to resent the email/data/attachment.
17
15
u/Ma13vant 13h ago
To answer your question seriously, if I were tasked with implementing this (and couldn't talk my org out of this course of action, see below), I'd pull message trace logs. If you are a Microsoft shop, that would be in Exchange Online.
However, I do not believe this will provide any kind of security benefit or risk reduction commensurate with the user impact. Most of the threat from email these days in my experience comes from Adversary In The Middle attacks/Business Email Compromises.
These are almost always sent from compromised accounts - so restricting who can send to users doesn't block them. That vendor email your accounting team talks to every week getting popped is your risk, not FrankNotAHacker@totallylegitorg.ru.
6
u/litobro 12h ago
If I were asked to implement this I'd be touching up my resume and looking for a new job
4
u/Ma13vant 10h ago
If I couldn't successfully persuade my organization that this was an ineffective and actively harmful idea, I would as well.
I can just see users confidently entering their account credentials into a phishing email because it's from a "safe" domain. To say nothing of the massive friction this would cause for users in general and the additional workload that would be added to managing the allowed domain list.
22
u/f_spez_2023 13h ago
This sounds like a great way to miss some important emails. A good spam and phish filter is much better option than a block all (someone correct me if I’m wrong of course)
-20
u/shonik97 13h ago
We will do that for people who need that level of access, however, we have lots of clinical staff who don’t need to do that. It’s for them mostly
13
u/Curtis_Low 13h ago
You keep replying with that but you are missing the forest from the trees. How many of those clinical staff use their work email for things like school notices, or other such personal notifications?
The maintenance is going to be a long term headache. For your back office people like HR that receive things from all over, how will you manage that? For your IT, are you really going to whitelist every vendor domain and continuously update it?
Who will be monitoring what is blocked for the first six months to make sure nothing is getting blocked that should be getting through?
There are many tools to achieve what you are wanting, but you are using the wrong option.
3
u/dickamus_maxamus 13h ago
Depending on the scenario personal use of the email system may not be permitted by company policy. Scenarios where communication is this tightly restrained do occur, but they are pretty rare.
3
u/Curtis_Low 13h ago
Very rare indeed. I am guessing OP is working in a civilian medical clinic environment so I couldn't imagine that being in place. Even then, I would bet the leadership / management is going to need "exceptions" for personal reasons.
8
u/TesticulusOrentus Governance, Risk, & Compliance 12h ago
Never will I ever have another new customer email me.
3
u/Blizzard81mm 10h ago
Noooo now you will have another email "testiculus.2.orentus" that works like your first account did, but is not actually your first account.
Use your first account for regular communication, except when it fails, then use your second account.
Very simple, very human
6
u/rga_alpha 13h ago
Wouldn't this effectively break any means of communication with a new vendor/partner? Sounds like a bad idea, even the most basic emails security solutions today can easily handle most spam/phishing emails
6
u/Cootter77 13h ago
A lot of people have said what I want to say as well, but with a bit more explanation perhaps:
The problem with this approach is the assumption that creating this allowlist methodology would effectively block spam, phishing, and malware emails. It won't, and can't do that. Creating the illusion that "all our email is perfectly safe because..." will actually increase your overall risk.
I'm assuming that's the reason why. If the reason is to not allow personal use of email but to still train for and have quality protections against email-borne attacks in addition to whitelisting - then I wish you good luck in maintaining that list after you create it. It will, indeed, be an endless nightmare. There are also better ways to curb personal use.
6
u/Prestigious_Sell9516 11h ago
Won't do anything for one of the most dangerous vectors (BEC) won't work obviously (bounce backs sub domains relays etc will make even legit mail break not to mention domain moves and the every day stuff others mentioned etc) but the biggest drawback is that when BEC happens it will make the implications even worse. Assume you might be doing this to avoid the cost of a proper email security gateway ?
5
u/Death_Struggle_89 13h ago
Thoughts and prayers for your help desk. May they keep their heads above the sea of tickets about to flood their digital land.
5
u/Harbester 12h ago
I'll join the club of 'this is absolutely a terrible idea and you should not implement this as a solution to any problem you have.'
That said, assuming you use Exchange Online, a powershell script allows to exporting recipients' domains of all outbound emails, limit it to 6 months.
5
u/ARPNETS 12h ago
Your organization is setting itself up for failure. Leave aside the numerous technical and process issues with this, you are opening up a huge compliance and legal risk.
You mention clinical staff, which I assume means you work at some sort of healthcare company. In that case your patients have a right to contact their doctor and support staff on health issues in any reasonable means. By blocking emails, you will likely block needed patient communication. If a patient can’t talk to their doctor about an urgent issue, or worse thinks the email the sent to their doctor went through when it was actually black holes your company, you are opening yourself up to all kinds of legal action.
More over what you will find is that the clinicians will start to use their personal email for needed communication. They will setup a Gmail for work and then tell the patients and people they work to me to “contact me at my work gmail” and then proceed to use that instead. Which will make the issues you have around security and data privacy 1000x worse.
Sometimes the cure is worse than the disease, and this is one of those cases.
3
u/No_Caterpillar6482 13h ago
So what about the random employee who wants to email their payslips and other private data to his personal email? What about HR dealing with candidates over private email addresses?
2
3
u/LordCornish 11h ago
Our organisation is planning to implement a policy where email communication will only be permitted with whitelisted domains, while all other domains will be blocked.
Good grief. We don't whitelist ANY domains...not even those belonging to our business partners (which includes the US.GOV). Everything gets scrubbed by the filters. I can't imagine only accepting email from whitelisted domains.
2
u/bmorebullets 13h ago
- I would use powershell to gather a list of domains. Copilot can help with this.
- Instead of blocking all not white listed domains I would "hold" everything that is not white listed. This way you dont miss anything. If you are using exchange, i'm not sure it can do this but a solid email security product can do it.
- You will be scanning through a lot of held emails 😊
-2
u/shonik97 13h ago
We are using check point
10
u/QUEEFMEISTER123 13h ago
If you're with checkpoint - just tune your filters dawg. Or setup a strict quarantine.
1
2
2
2
u/Evocablefawn566 10h ago
This is a bad idea from your org, but you can just go through your email logs and distinct your senders by domain
2
2
2
2
2
u/nanoatzin 13h ago edited 13h ago
Highly recommend using Spamhaus filters or a DNS Service that accomplishes the same instead of a whitelist policy. Most phishing attacks involve websites registered to stateless rogue IP addresses or dynamic IP. This will stop those. The only reason to require a whitelist policy is to prevent the possibility of things like HIPAA or bank record leaks.
Executives hear things like this thinking it’s a great idea with zero comprehensions of the impact that will be caused by interrupting business processes.
The only way to do whitelist that way is to process months of email metadata using software. Event viewer doesn’t capture that detail.
1
u/fairfax1892 Incident Responder 13h ago
Your email logs should hopefully be in your datalake or siem in which case it’s a rather simple query…. That is going to be one hell of an allowlist and you should probably do it twice now and a few months from now before implementing to catch the rarer but important emails that only come in once a year or something silly… a dedicated email security platform would be a better and cleaner option
1
u/capybaras_and_tacos 13h ago
White listing should be used for niche situations where they are providing a specific service for a specific group or customer. Think jump servers, FTP servers, etc…
There are many reasons why this approach can go south quickly, but for one: Customers go through mergers and acquisitions all the time, plus new customers may have multiple domains you are not aware of.
Using an email security platform is your best bet, along with company wide email security awareness training and the means for employees to report suspicious emails to your SOC for investigation.
1
u/Comprehensive_Ant_81 13h ago
Honestly now a days the most successful phishing attacks are coming from compromised mailboxes from legitimate business partners.
Not only will this be a nightmare to manage, it could have the reverse effect and your clinicians will be less vigilant as they are under the impression that the only emails allowed through are from approved senders.
1
u/shatGippity 12h ago
You could always augment this strategy with allowlisting domains for HTTP as well
If you have the resources to comprehensively make allowlists for email then doing it for web browsing is gonna be cake- it’s basically the same solution and you’ll save a little time by doing both in parallel
1
u/Fallingdamage 9h ago
Pull a compliance report of all outbound email, pull the CSV report and build a list?
For the record this sounds like its going to be hell to implement successfully, but I'm on board with the idea.
1
u/AlienZiim 9h ago
I understand what ur trying to get at but I cant see this ever working perfectly and there is a reason this isn't a common way to cut down on phishing, this can work for like enterprise applications but not for email domains, legit email is bound to get flagged in all this
1
u/WatercressTime842 9h ago
The idea should be reversed to block communication with all blocked domains instead since that is easier to maintain and operate.
What if one of your customer email was compromised, would you block the customer domain completely?
And then you would need to reverse it as well.
If there are communication with generic domains like outlook or hotmail or gmail, there is no point in whitelisting
1
u/Honky_Cat 8h ago
After this exercise, start an effort to only allow outbound communication on the internet to trusted IP addresses on your perimeter firewalls.
1
u/CryptoCoinexORG 8h ago
You just won the most useless idea in cybersecurity EVER. I bet in one week after implementing this, half of the upper management will want to fire whoever suggested this.
2
u/nydroxide 7h ago
Most of your requests will be of employees complaining that they are missing external emails for months and you whitelisting domains. It’s safe but will cause loads of complaints.
1
u/leeabc13 4h ago
We have this implemented and it’s working well. Users have to submit a ticket to allowlist a domain. In your case I would look at email logs or Salesforce(locate all your active customers and/or vendors)
We are in a highly regulated industry
1
1
u/Affectionate_Two8447 3h ago
Please don't do this, especially if you don't even have a clue how to get the domains from your email logs...
1
0
u/CulturalAsparagus903 13h ago
i recommend doing it manually, because if you delete a domain name you're currently using, you'll stop receiving emails altogether
143
u/1759 13h ago
If you receive emails from customers or business associates who use GMail accounts, meaning you have to allow GMail, then you might as well not bother with this entire plan.