Just as Internet access must be managed to protect against
lost productivity, security breaches and improper use, so too must e-mail use
be carefully administered. E-mail
policies protect against unauthorized data access and distribution, the
introduction of dangerous viruses and other security threats and lost
productivity. Without effective e-mail policies, self-replicating viruses could
easily slow network traffic to a halt, Trojan horses could jeopardize sensitive
data and the organization could even become liable should an employee use
organization-provided e-mail to send harassing or offensive messages to others
(both inside and outside the organization).

Dangers are well documented

Entire books
have been written that provide guidance for avoiding lawsuits that could arise
from improper e-mail use. E-mail’s been
shown to present “serious operational and financial risk to the global
banking industry,” among others, according to a report
authored by the Gartner analyst group. Renowned zoologist Jane Goodall even labeled
e-mail “the most dangerous form of communication.”

Is e-mail getting a bad rap? Certainly, used improperly,
e-mail messaging poses threats that cannot be ignored. But with a combination
of technological protections (server-based antivirus, group policies that
prevent end users from triggering executable e-mail attachments, etc.) and an
enforced e-mail use policy, organizations can mitigate the risks while
leveraging e-mail’s benefits.

Start with technology

Users should already be precluded from downloading and
installing malicious and/or time-wasting files on your network. Leverage
server-based antivirus and antispam controls to eliminate threats before they
even make their way to end users’ desktops. Effective server management and
proper filter maintenance help ensure phishing attempts are minimized and users
remain free to use e-mail as intended: solely for the fulfillment of job
responsibilities.

In addition to deploying software-based group, system and
local policies, network monitoring software should be implemented to help
identify potential threats. Using firewalls or Microsoft’s Internet Security
and Acceleration Server to block access to popular third party e-mail services,
such as Gmail, Hotmail and Yahoo Mail, can further decrease your organization’s
risks.

Finish with a policy

Technology solutions, however, aren’t foolproof. End users
will occasionally (intentionally or not) circumvent your network’s security
initiatives. It’s very difficult to block every conceivable Web-based e-mail
site, and some are bound to be missed.

Introduce umbrella coverage by implementing an E-mail Use
Policy. By clearly describing what behaviors constitute acceptable use of
organization-provided computers, networks, systems and e-mail accounts, and by
stating the penalties that result from policy violations, the organization can
eliminate remaining risks.

Even if the organization’s firewall fails to block a third-party e-mail site,
and should a server-based application fail to remove a new e-mail borne virus,
having a policy in place that prohibits executing files received via e-mail can
prevent a new outbreak. Further, policies can stop employees from using
organization-provided e-mail systems and accounts for personal use; no longer
must your organization foot the bill for a marketing representative’s side eBay
business or an accountant’s inclination to forward chain e-mail messages.

TechRepublic’s E-mail Use Vulnerability Assessment can help
gauge your organization’s policy needs. The interactive Microsoft Excel
spreadsheet lists several criteria you rank based on your organization’s
specific situation. The tool returns a vulnerability score you can use as a
more objective measure in determining whether a policy is warranted within your
organization. Plus, the spreadsheet helps provide justification to end users
when rolling out such a policy.

Should a policy be required, review TechRepublic’s E-mail
Use Policy. The ready-made template can be used as-is. Or, you can customize
the pre-prepared policy to address your organization’s specific needs.

However you build it, be sure your organization’s e-mail use
policy addresses all of the following:

  • Descriptions
    of what constitutes acceptable use of organization-provided computers,
    networks, systems and e-mail accounts
  • Prohibitions
    against using organization computers, systems and/or networks to access
    personal e-mail accounts and/or sites
  • Prohibitions
    against using organization-provided e-mail accounts to send harassing and/or
    offensive messages
  • An
    acknowledgement from the employee that they’ve read the policy and agree
    to its terms
  • The penalties associated with violations

Drafting and distributing the policy doesn’t complete the
process. It’s critical that Information Technology departments enforce the
policy. Without monitoring and enforcement, the effort becomes nothing more
than a futile paper exercise.

For more on implementing effective policies, review the
following TechRepublic articles: Use
a policy audit to ensure that your policies are followed
, Learn
how to win support for your new IT policy
and Creating
an IT policy that works
.

Add the following blurb highlighted at the end including a link to 6071339

You can quickly implement an email usage policy in your organization by
downloading TechRepublic’s Email Usage Policy. Included you’ll find a
risk assessment spreadsheet that will help you determine the importance
of such a policy to your organization’s security along with a basic
policy that you can use and modify. You can purchase it from the
TechRepublic Catalog or download it for free as part of your
TechRepublic Pro membership.