In the wake of the Visual Basic Script (VBS) SST, or Anna Kournikova e-mail virus, a lot of ink and toner -- some of it mine -- has been spilled on ways to foil future incidents. Many of the solutions are simple, obvious ones that fall under the category of "due diligence" and include installing application and OS patches and keeping anti-virus software up-to-date. More elaborate precautions such as adding virus protection to e-mail servers and modifying system policies also are advisable. For a discussion of the nuts-and-bolts of securing your e-mail systems, take a look at recommendations I made in my column last week.

File attachments to e-mail are coming in for an unfair share of the blame in cases such as SST, which is like blaming the diskette for carrying a boot sector virus. Some IT managers have gone to the ludicrous step of completely banning e-mail attachments from their systems. I'd bet the guys who thought up those policies are really proud of themselves. They should be; this is a proactive step that makes them look like they're willing to take drastic action to protect company assets.

While these hard-nosed, take-charge types pat themselves on the back, I'm wondering how many employees at their shops access browser-based e-mail or instant messaging and are using them without the knowledge of the IT big shots? I'm wondering how many have modems and access to analog lines as backup to the corporate Internet connection?

After all, it's great to be stopping malicious code at the firewall, but we humans are clever and will dodge obstacles in our path. Think about the trouble the U.S. Central Intelligence Agency has had with their former chief spook, John Deutch, who may have mishandled hundreds of classified documents on unsecured home computers with Internet access (only to be pardoned by outgoing President Bill Clinton). If IT doesn't allow us to move files via the corporate e-mail system, we'll find a way around it even if we're unwittingly compromising security. Do these anti-attachment zealots honestly believe it's better to move files via FTP than via an e-mail system with anti-virus protection?

For many people, file attachment is the best thing about e-mail (I don't know how I'd function without it). Every few months, I delete the stale items, saving myself the paper cuts I'd get from shuffling through a mountain of press kits. At the risk of being called a tree-hugger, I'll even add that e-mail attachments probably save a few trees every year, although I don't believe in the "paperless office" -- yet.

That aside, one of the primary reasons for e-mail and networking computers was to do away with SneakerNet. Shops with a no-attachment policy might also want to consider disconnecting those pesky CD and floppy drives to eliminate other sources of infection. Here's another idea: Maybe the truly proactive security manager should insist that the openings of all CD and floppy drives on desktop computers be glued shut.

A much more realistic approach to the problem of the current crop of e-mail viruses is to apply the available patches. The SST incident wasn't as nasty as the LoveBug virus, in part because patched systems weren't affected, period. The ignorant, overworked, or sloppy seem to be the ones who were bitten. But even an overworked IT department has had months to make sure that the patches were on corporate systems and to assist home and remote workers with the task of hardening their systems.

The big problem isn't file attachments; it's the consultants, home office users, and telecommuters who pose trouble. It's not enough to ask the telecommuter to make sure the computer she uses is secure; all computers in the household have to be patched.

Just as King Canute commanded the tides to halt in vain as a demonstration of the difference between the powers of God and the power of kings, the believers in a no-attachment policy are ignoring the water lapping at their knees. Attachments aren't a "necessary evil," but an effective way for users of heterogeneous systems to transfer files. If we wanted text-only e-mail, then we should have stuck with PROFS. So if you're worrying about file attachments in e-mail but don't know if your Windows systems have the latest patches, it's time to get your priorities in order, and fast.

» posted by abennett

InfoWorld

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine