RE: Blocking personal email

["Mike MacNeill" <mmacneil () crosscountry com>]

It really doesn't matter if you block the retrieval of Hotmail or other
personal accounts in Outlook as it's not going to protect you.  All a
user has to do is read the mail through HTTP, download and execute an
attachment and it's going to spread through your system without the
infected mail being read in Outlook.  

Mike

-----Original Message-----
From: Tim V - DZ [mailto:iceburn () dangerzone com] 
Sent: Wednesday, November 27, 2002 11:53 AM
To: security-basics () securityfocus com
Subject: Blocking personal email 

In a company using the exchange / outlook combination is there any way
to block users from using outlook to receive non-exchange mail?  We are
concerned about people adding their personal email to the Outlook
accounts and subsequently being exposed to more viruses.  The mail that
goes through exchange is guaranteed to be scanned before it's viewed.  I
know that POP3 and SMTP can be blocked by ports, but what about services
like HOTMAIL where outlook can use HTTP to retrieve mail?  Is the only
solution to block that site (making it so users can't see any hotmail
pages in the browser either)?


Thanks,

-tim