It’s time to add your spam filter whitelist to your spring cleaning routine.
For some of us who have been using the same spam filter for years, we may have a long list of allowed addresses or domains. Because phishing email is involved in 91% of breaches, I can’t stress enough how important it is to manage your whitelist.
As security has evolved, I continually find things that I did months or years ago that I would do differently today. So, I am learning to go back and review the things that are on autopilot to make sure they meet my current standards.
On spam filters – and many other things, for that matter – we all get in a hurry sometimes. So we make broad changes just to make sure that email gets through. Maybe you had 2 or 3 emails blocked from Gmail, so you decided to allow all of gmail.com through the filter. While you got those emails through, you increased your risk of getting malicious emails.
Why revisit and clean up your whitelist?
It’s the unintended consequences that get us many times.
With the increase in spoofed email addresses that appear to come from a CEO or co-worker, it is important to make sure that you have not whitelisted your own domain. And this is more common than you think. You may have your newsletter sent from an outside firm or other applications that do not send through your email server that need to come in. The easy answer is to allow entire domains, but rarely (if ever) is it the right choice. In many cases , whitelists are a free pass through your email security system.
There are typically 2 levels of whitelisting to be aware of. First is the global level, which your IT company or IT administrator needs to review. Then there is your personal whitelist that you can clean up yourself. Both are important to review.
I encourage you to take some time this week to clean up your whitelist and improve your email security. You may be surprised at what you find!
This article was authored by Ryan Pieken, Sr. Consultant CIO / CISO Services.
Recent Posts / View All Posts
