- Email protection vs. phishing attacks
In our daily work, we encounter various types of attacks using the email service. One of the most common is impersonation, very often aimed at phishing for sensitive information or convincing the end user to perform a certain action that could lead to information leakage.
Regardless of the protection methods used, the weakest link here remains the end user, whom - in addition to regular awareness campaigns - we can support with additional information when the message they receive comes from outside the company's mail organization.
- Method No. 1 - transport rule
The most common solution for distinguishing messages coming from outside the organization is to create a transport rule, adding, for example, in the subject line of the message and/or at the top of the message body, information/warning that the message is coming from outside the mail organization. In this way, we are able to inform all our users that a message is coming from outside (even if it would appear otherwise from the displayed address, with the impersonation of the sender) and warn users against sending sensitive information to this address.
Although there is, of course, a corresponding PowerShell command, due to the multitude of options, it is more convenient to create a transport rule using the administrative console (https://admin.exchange.microsoft.com/#/transportrules).
To do this, select '+ Add a rule' and then 'Create a new rule':
Then, as part of setting the conditions of the rule, set:
- The name of the rule, which will identify it uniquely
- As a condition - apply the rule for messages coming from outside the organization
As an action - add the prefix '[EXTERNAL]' to the subject line of the message and sample text formatted as html ("<p style="”color:red”">The message comes from outside the organization. Be careful and do not send sensitive information to the sender's address.</p>")
Within the 'Set rule settings' step, there is no need to change anything (alternatively, for example, you can add a comment describing the rule in more detail).
In the last step, review the settings of the created rule and confirm its creation:
After creating a rule, remember to enable it (by default, the created rule is disabled). To do this by selecting the rule and changing the status of the 'Enable or disable rule' switch:
When enabled, the rule takes effect immediately - external messages are marked as defined within the rule:
- Method #2 - global setting of 'External in Outlook'
A lesser known method of informing users about messages coming from outside the organization is to use a built-in functionality called 'External in Outlook'. This functionality is only available in Exchange Online, is disabled by default and, when enabled, covers all users in the organization.
Enabling the 'External in Outlook' functionality results in all externally sourced messages being marked as External in the mail clients - Outlook, Outlook on the web and mobile Outlook. As a result, a 'External' label is displayed next to the sender's name in the list of messages, and a mail tip is displayed within the message itself, explaining that the sender of the message is from outside the user's mail organization.
Admittedly, there is no way to influence the content of the label and the content of the mail tip warning, but both the label and mail tip display in the language configured as the language of the user's mailbox, which can be important for multinational organizations.
To enable the functionality, make a PowerShell console call to Exchange Online. By default, the functionality is disabled, which can be confirmed using the 'get-ExternalInOutlook' command:
Using the 'set-ExternalInOutlook' command, the functionality can be enabled, as shown below:
After using the command, it may take several hours for the functionality to take effect, so don't be surprised if it doesn't work right away.
Here's how external messages display in the desktop version of Outlook:
And in the web version (where, in addition, the mail tip includes a link to block the sender):
If you have external contributors or partner trusted companies, individual addresses or entire email domains can additionally be added to the 'AllowList' attribute of the External in Outlook functionality. As a result, messages from these senders and email domains will not be marked as external, which can be useful in some scenarios of implementing this functionality:
- Similarities/differences, pros and cons
The aforementioned methods are different, and although technically nothing prevents them, they are unlikely to be used simultaneously so as not to multiply information about the external origin of the message.
The transport rule seems to be more flexible - not only can we (through an additional condition) decide which of our users are covered by such a rule, we additionally have influence over its content and the placement of that content. The downside is undoubtedly
the fact that any words added to the subject or body of a message remain in that message when the user replies to such a message (unless they are removed by another dedicated transport rule for outbound messages). For multinational organizations, the downside may be that a dedicated transport rule would have to be prepared for each language group, potentially complicating the solution.
On the other hand, the 'External in Outlook' functionality is simple (just a simple enablement), but as is usually the case with simplicity comes less flexibility. A definite plus is that the displayed labels in mail clients depend on the configured mailbox language.
- Support and development of Microsoft and Nintex based applications
- Application design and development including digital processes
- Invoice management
- Requisition management
- Contract management
- Modern Intranet
ISCG sp. z o.o.
Al. Jerozolimskie 178, 02-486 Warsaw
NIP: 5262798378
KRS: 0000220621
Phone