> I was shocked that they recommended we install ad-blockers as a corporate policy.
It's solid policy. The problem with ads in this regard is really that they allow random strangers to run code on your machine. That's never a good security practice.
Imagine I only visit websites like the New York Times.
If an evildoer with a browser 0-day wants to target me, without an ad blocker any of a thousand companies can pay a few cents to have their javascript served to me. If I run an adblocker, there are a lot fewer ways to get their code in front of me.
A statistical argument, in other words - that being exposed to code from 10 vendors is safer than being exposed to code from 1000 vendors.
Yes, it is. Which is a pretty large problem, and is why I don't allow JS to execute by default. I do whitelist specific things if the need is great enough.
Do you supposed it is possibly more true for ads? There's "well, technically, yes" and then there's "which is the more realistic threat, an ad network or the JavaScript that the NYT serves up?"
It's solid policy. The problem with ads in this regard is really that they allow random strangers to run code on your machine. That's never a good security practice.