Despite having
solid perimeter protection in place, it is still necessary
to inspect internal mail traffic. This is necessary
for many reasons:
• Scanning for viruses that enter through other
vectors, for example, personal Web-based email, removable
media such as USBs, remote laptop users whose virus
definitions may not be current.
• No single tier of protection can offer 100%
coverage, especially against new and emerging threats.
Post-attack virus cleanup of message stores using the
latest antivirus definitions is critical. Companies
running the latest defenses at the SMTP gateway are
often surprised when they are re-infected inside the
network. Often the cause is lack of adequate virus cleanup
at the mail server and even desktop tiers.
• Preventing authorized content from being sent
to unauthorized users within and outside of the organization.
Pains are often taken to secure internal Web sites for
access by appropriate individuals or departments, but
once downloaded to the desktop system, this information
can easily be forwarded to virtually any individual
within the company. Now, not only is there an exposure
that unauthorized users gain access to confidential
data, but they can also send that data outside of the
company walls. Preventing leakage internally is just
as critical as external or outbound data leakage.
• Preventing content from being accessed after
it has been sent. Upon discovery of an inappropriate
message, a rule can be created to block access to the
message immediately and clean the message from the message
store/database.
• Enforcing email usage policies throughout
the company, such as the use of inappropriate language
in email and the dissemination of unwanted or oversized
attachment content such as MP3 files, executables, and
others.
• Retroactive cleaning of message stores to
remove older, unneeded content, for example, internal
“housekeeping” memos. |
