. If you claim to do something and then can’t prove it in an audit, you’ll fail that same process and you’ll be out of business before you know it owing to a loss of client trust and confidence alone. It’s important to note that, auditing is a double edged sword. Sure, you are stating your compliance to a set of narratives (direct instructions exactly how you conduct business, and the operation itself), but auditors will look for any chink in the armour - this is what they are paid to do. This is why you never self audit, but always gain independent attestation of your controls by a third party with no bias.
I’ll just leave this here. It’s very thorough, and a great read.
) in favor of channeling limited resources into uBlock Origin. Heh, I do not blog much. When I do it is more to scratch some itch than commit to any kind of “going concern”.
@crazycells good question. Gmail being provided by Google is going to be one of the more secure by default out of the box, although you have to bear in mind that you can have the best security in the world, but that is easily diluted by user decision.
Obviously, it makes sense to secure all cloud based services with at least 2fa protection, or better still, biometric if available, but email still remains vastly unprotected (unless enforced in the sense of 2fa, which I know Sendgrid do) because of user choice (in the sense that users will always go for the path of least resistance when it comes to security to make their lives easier). The ultimate side effect of taking this route is being vulnerable to credentials theft via phishing attacks and social engineering.
The same principle would easily apply to Proton Mail, who also (from memory) do not enforce 2fa. Based on this fact, neither product is more secure than the other without one form of additional authentication at least being imposed.
In terms of direct attack on the servers holding mail accounts themselves, this is a far less common type of attack these days as tricking the user is so much simpler than brute forcing a server where you are very likely to be detected by perimeter security (IDS / IPS etc).
