There was no good reason for this distribution list to be externally available. That led me to ask our email administrators how many of our distribution lists are configured similarly. The answer was astonishing: We have more than 3,000 distribution lists (and just 4,000 employees, mind you), and more than 400 of them are externally available. I can't see any reason why our external partners would need more than 20 or 30 lists. Clearly, we have a process problem.
In fact, some of our help desk staffers have been marking distribution lists as externally available by default. They will be educated to do otherwise. We are also going to audit all of the externally available lists and eliminate any for which there is no business justification. From now on, no distribution list will be externally available without my approval.
To ensure compliance, I'm having our security analyst investigate whether we can use our security incident and event management tool to alert us when a newly created distribution list is marked as "externally available." I've also asked our email administrators to investigate why our external spam-filtering service didn't protect us from this attack. And finally, this is a great opportunity to send out a global email to warn everyone about phishing attacks and provide tips on how to spot one.
This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at email@example.com.