logoalt Hacker News

tempaccount5050yesterday at 7:15 PM2 repliesview on HN

Yeah I don't see why that's necessary. I'm sure you can always reach out to HR and ask (I have facilitated this in the past, pulling contact lists and phone numbers) but that also gives them ways to exfiltrate data. It's company data. Just think of all the info you have in your inbox. Unless you've managed offboarding for high level IT positions it seems harsh, but the risk is just too high to allow the user to do that stuff themselves.


Replies

scottlambyesterday at 7:24 PM

> Just think of all the info you have in your inbox.

Meh? Sure, stuff that would help assemble a credible phishing attack, but not customer SPII or huge amounts of intellectual property or anything. If the assumption is that employees' inboxes are full of dangerous things, I would focus on fixing that.

show 1 reply
BrandoElFollitoyesterday at 7:23 PM

High level IT positions are not risky. This is the db admin who can do most of the damage.