S 5.54 Dealing with unwanted e-mails

Initiation responsibility: Head of IT, IT Security Officer

Implementation responsibility: Administrator, User

Unwanted e-mails, which are also known as "spam", are sent out en masse, harass the recipients, and disturb the actual operation of the IT infrastructure, starting with the systems transmitting e-mails to the clients of the users. Unwanted e-mails include chain letters, unsolicited advertising, begging letters, junk mail, phishing e-mails, and e-mails with attachments containing malicious code. In particular, an e-mail poses a threat if attachments are executed, if the e-mail is based on HTML, or if the mail recipients are lured to visit manipulated websites via links contained in the e-mail.

A flood of unwanted e-mails or deliberate overloading via incoming e-mails cannot only block the e-mail system but can also give rise to considerable expense for the recipient. One way in which costs are incurred is through transfer charges, especially if the unwanted e-mails contain images or multimedia files. The burden is then compounded by the costs for filtering the e-mails and/or the employees' working time needed to view the incoming spam and to delete it.

In order to protect themselves against spam, users should be restrict disclosure of their e-mail address to the necessary minimum. Users should be particularly careful when giving their address, e.g. in newsgroups, mailing lists, prize draws, surveys or similar forms. In these cases, it should be considered to set up a throw-away address in order to avoid unnecessary disclosure of a potentially personalised "main address" to the wrong hands.

Conversely, care should also be taken to check the e-mail addresses of communication partners before passing them on to others. Indeed, if an e-mail is sent to multiple recipients, it is not necessary for everyone to know who else received the mail at which e-mail address. The "BCC" function (Blind Carbon Copy), which is offered by virtually every e-mail client, can be used to avoid this.

Also, your own computer should always remain free from malware, as there is malware which reads local address books and includes them in spam mailing lists.

Basically, all users should ignore and delete spam. Under no circumstances should a reply be sent, a link in the e-mail followed, or attachments opened, as this may have negative effects. A confirmation that the e-mail was received is also a confirmation that the e-mail address can be used for the delivery of spam and that the recipient actually reads these e-mails. In addition, there is a risk that computers are infected with malware and thus become part of a botnet. All employees should be briefed on this.

The following safeguards can be implemented against unwanted e-mails:

It should be noted that not all of these measures are advisable in all circumstances, as each of them impose certain restrictions. On one hand, for example, it might be advisable to refrain from basing e-mail addresses on user names in order to protect oneself from unwanted e-mail advertisements. On the other hand, however, abstract e-mail addresses can render communications with external parties difficult, as such addresses are harder to remember. The form of an e-mail address should always comply with internal organisational policies.

A high volume of e-mail traffic can also be generated by subscriptions to mailing lists. In general, regular checks should be made as to whether the subjects discussed in a mailing list are still worth reading. If not, the subscription should be cancelled. Users must be instructed to make regular (i.e. daily, if possible) checks of mail influx related to subscriptions to mailing lists. In relatively large organisations, mailing lists of professional interest should only be subscribed to by one staff member (e.g. the mail administrator) and then made available centrally to all other employees.

Spam should also be taken into consideration when designing websites. One way in which spammers try to add to their address pool is by using tools to perform automatic scans on websites in order to seek out e-mail addresses, e.g. for inquiries. Unfortunately, there are precious few effective ways of thwarting automatic scanning tools of this type. Therefore, careful consideration should be given to the issue of whether to publish e-mail addresses on websites and which ones should be published. Task-related e-mail addresses could be set up for this purpose. Needless to say, these will also be besieged with spam but the problem can be confined in this manner. Sufficient time should be provided for sifting incoming mails and separating the genuine e-mails from the spam.

Review questions:

© Federal Office for Information Security. All rights reserved.