CNET Virus Center
The CNET Virus Center
provides links to leading vendors of anti-virus and ant-spam software. vendors.
Memo to Clients
TO: CitiDexLI clients and their staff
FROM: Ralph Warren, CitiDexLI
RE: Email Virus/Spam Advisory
DATE: February 8, 2005
Over the past few weeks we have noticed a great increase in the virus and "spam" email that is coming to our company and our clients. We are taking action to address this problem by informing our clients and their staff of steps they can take to best manage this problem. We are sending this to you by fax and regular mail and putting this advice up on our website for client management (including a Help/FAQs page and our client "ticket system") at http://www.citidexliweb.com/index.html.
The current burst of email spamming appears to involve spoofing of email addressees. You may have seen emails coming to you or your staff that use a false or even a valid email address in your company's domain name. But these "spoofed" emails are basically forgeries of email from a targeted domain name. It is even more serious that many of the current "spoofed" emails include attachments with viruses (the recent worm type viruses).
Email spoofing is a huge problem right now. In the past week we have seen spoofed emails from the largest (Microsoft, Optonline, major New York universities, and others) to very small companies. There is nothing a company can do to directly stop forged emails that are using their domain name. However, you can take specific steps to effectively filter email coming into your company and use verification codes that allow your employees to identify trusted internal email. We suggest that you do the following:
- Install and regularly update Anti-Virus desktop software that screens incoming email. Most of the major vendors of Anti-Virus and Anti-Spam software provide tools that allow each desktop user to block, detect, and delete suspect or dangerous email. Symantec (Norton) and McAfee are well-know vendors of software that provide effective desktop protection. We have included links to their websites and independent reviews of Anti-Spam software on our client help files at http://www.citidexliweb.com/index.html. Many of these products integrate with MS Outlook and enhance its filtering capabilities.
- Be extremely cautions about opening any email attachments. Spoofed emails can use a valid email address of a trusted person within your company. Do not open any attachments that contain known viruses. In our client help file we list useful web sites you can use to identify dangerous email attachments. We also list common file types used to transmit viruses in email attachments. The next point suggests a way to increase trust in an email source.
- Use verification codes for all internal email. We suggest that you immediately develop new policies and procedures for internal corporate email. Each time a staff person sends an email to another staff person they should start the subject line of the email with a special code (just a few unique characters). In the following example the code CDX is used
To: projectleader@companyname.com
Subject: CDX: our monthly sales report is attached
Someone in your company should set up similar procedures as soon as possible. This is a good technique for increasing security and should help your staff avoid opening attachments from spoofed emails. Many large corporations and universities have adopted these procedures in recent weeks and we are encouraging our all of our clients to do the same.
If you have any questions please call us at 631-549-0064.
