When it comes to email security, the easy route is to block and whitelist. But easy isn’t always safe or right. My approach is about building a culture of visibility and control, even when protection gets tougher.
In our environment, nothing is whitelisted. Even trusted vendors can be compromised. A 20 year old approach of allowing known good sources means attackers slip through. Instead, every inbound email is scored. From call to action links to content heuristics. Fraudulent invoices to students? Scored, flagged, stopped.
Our layered approach blends our EES Microsoft toolkit, including DLP and ATP, with top tier systems like Barracuda Gateway Defense and Sentinel. Barracuda will block outright when clear, but when it is gray, Sentinel rechecks and pulls back what is risky. Nothing slips through unchecked.
That is where quarantine comes in. I did not just roll out bulk email detection for noise reduction. It was a culture shift. At first, I took some political hits. Users feared missing important emails. But I empowered them. Review your quarantine. Set rules. Choose what matters. Over time, they did, and now the noise is down.
We tightened outbound limits too. Student accounts no longer blast 500 recipients. We cannot control Microsoft’s 30 email per minute limit, but we can limit damage. Control is not about perfection. It is about layers and accountability.
This is not just protection. It is about trust. Trust that users see what is happening. Trust that IT is not blindly blocking. Trust that when something goes wrong, we are all part of the solution.
That is the balance we strive for every day.
How are you balancing user responsibility and trust in your email security strategy?