Re: Best Practices on Web based email ?

["Nick Warr" <nick () mobilia it>]

Use SSL only, your mailserver (where everything actually mail related should
take place) can have antivirus, content filtering, etc. Webmail should only
be another interface to your mail server.

Nick
----- Original Message ----- 
From: <Bill_Roswell () oxy com>
To: <security-basics () securityfocus com>
Sent: Wednesday, September 03, 2003 3:06 PM
Subject: Best Practices on Web based email ?


Do you allow web based email? What is the best practice advice from a
security standpoint?  Do you have any restrictions since you can't
remove attachments or force a virus scan or force content/header
filtering?

Thanks,



Bill

Security Architect
Oxy Inc. IT-Security
Occidental Petroleum Corporation
Houston, Texas
713-215-7976


THIS MESSAGE CONTAINS CONFIDENTIAL INFORMATION AND TRADE SECRETS
OF OCCIDENTAL.  UNAUTHORIZED USE OR DISCLOSURE IS PROHIBITED.


---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event.  Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor.  Early-bird registration ends September
6.Visit us: www.blackhat.com
----------------------------------------------------------------------------



---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
technical IT security event.  Modeled after the famous Black Hat event in 
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------