Block Unnecessary File Types
Description
Block unnecessary file types attempting to enter the enterprise’s email gateway.
Implementation Checklist
Tool Recommendations
Email security platform with anti-phishing, safe attachments, safe links, and automated investigation/response
Microsoft · Per-user subscription (P1/P2)
Advanced email security with targeted attack protection, BEC defense, impostor detection, and URL defense
Proofpoint · Per-user subscription
Cloud email security with threat protection, continuity, archiving, and security awareness training integration
Mimecast · Per-user subscription
AI-native email security platform detecting BEC, phishing, and account compromise using behavioral analysis
Abnormal Security · Per-mailbox subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Malware Delivery via Executable Email Attachments
IntegrityAttackers deliver ransomware, trojans, and backdoors through email attachments using dangerous file types (.exe, .scr, .js, .vbs, .hta, .iso) that are not blocked at the email gateway, relying on users to execute them.
Macro-Enabled Document Exploitation
ConfidentialityWeaponized Office documents with malicious macros (.docm, .xlsm) or legacy formats (.doc, .xls) pass through the email gateway without file type restrictions, enabling initial access when users enable macros as instructed by social engineering.
Archive-Based Evasion of Security Controls
IntegrityAttackers wrap malicious payloads in nested archives (.zip, .rar, .7z, .iso) or password-protected containers to bypass email scanning, and without file type blocking at the gateway these containers reach user inboxes.
Vulnerabilities (When Safeguard Absent)
No File Type Restrictions at Email Gateway
The email gateway permits all file types as attachments, including executable files, script files, disk image files, and other dangerous formats commonly used as malware delivery vectors.
Incomplete Dangerous File Type Block List
The email gateway blocks some obvious file types (.exe) but misses other dangerous formats such as .iso, .img, .vhd, .js, .jse, .wsf, .hta, .lnk, and .one files that attackers actively use to deliver malware.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Email security configuration (SPF, DKIM, DMARC records) | Verified quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |