My organization currently sends out emails directing our customers to login and

Question

My organization currently sends out emails directing our customers to login and view information on a customer portal site we have developed. The content of these emails is usually pretty generic since we prefer to send all confidential information to our customers through this secure website.

I have recently been asked if we should eliminate all URLs that link to our customer portal from the emails that we send out. The justification for this request is to deter attempts to hack our customer portal. Since this request came from executives and not security experts I would like your opinions. Would this in any way decrease our chances of our customer portal being attacked?

One more piece of potentially useful information is that a link to this customer portal is published at the bottom of our public website.

Explanation / Answer

Unless you are sending specific strings in the URL to provide pass-throughs (where a user can click to log in without authenticating) there is no more danger with out without links. The reasoning for this is, someone can stumble unto your portal as it stands (provided it is on the public Internet which it would have to be unless you established some form of SSLVPN/VPN connection to an intranet).

If your goal is to provide an exclusive connection point to a specific site intended ONLY for ONE specific client, you could create a firewall rule that explicitly allows connection from your client's netblock to that site. This ensures no one but the client from the location specified can connect.

Now you state: "a link to this customer portal is published at the bottom of our public website" so there is no more or less danger than sending it in an email. So if your goal is to minimize who can access this portal, it may be a better approach to determine where your client's connections are coming from, make a firewall rule to allow those, and deny everything else.

Related Questions

Navigate

• Browse (All)
• Browse M
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.