Rossander’s Security Reader

This Tip was first run in October 2006. This "encore tip" is a reminder to be professional in email.

Halloween is a time for scary stories – tales of vampires and ghouls rising from the dead to terrify innocents – a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is sometimes all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

Americans have a bad habit of treating email very casually – as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the message is private and that recipient will understand the context and correctly interpret our tone.

In fact, email is more like a postcard – anyone can read it while it’s in transit and any of the recipients can save it, forward it or post it to the internet. Electronic copies can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. Emails can be subpoenaed and forced into the public record. You have no right of privacy in your email, either sent or received. When you write an email, you must assume that it will be read by an unknown and unforeseen audience.

That unknown audience will assume that you carefully crafted and wordsmithed your message (or, if not, that the hurried email is evidence of the writer’s “real state of mind”). They will not believe that you were “just joking” and won’t care that you were trying to dash off a quick note. They will interpret the tone according to their own preconceptions.

Always assume that anything you write will come out at the worst possible time and in the worst possible light. Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow’s newspaper.

Remember, email can come back to haunt you.

Have you ever received an error message about an email that you didn’t send? Or wondered why someone from your own company’s email address is sending you ads for Viagra or financial alerts for penny-stocks? Have you gotten a spam message from yourself? If so, you’ve just seen email spoofing in action.

Anything about an email can be edited or overwritten including the From, Return-Path, and Reply-To fields. Commands inserted into the header of the email can make the message appear to come from anyone, anywhere saying whatever the sender wants it to say. Spammers and other hackers know that their response rate is 10% higher if they can match the recipient’s name – they rely on curiosity and trust to trick you into opening a malicious message. The trick is built right into the hacker tools that are used to generate mass-mailing worms and other malware.

If you think you received a spoofed message, simply delete it. Most email programs allow you to block future messages from that address but that approach is no longer effective at actually stopping spam. The problem is that blocking User1@spoofvictim.com still lets junk through from User2@spoofvictim.com, User3, etc. The odds that the spammer will pick the same victim next time are negligible. But if you ever do get a legitimate message from User1, you’ll never see it. If there really is enough spam from one location to justify a black-listing, our spam-filter vendor will find it and include it in their master list. That fixes the problem not just for your email but for everyone else at the same time.

Do not send a complaint to the person that you think sent you the spam. If it was a spoof, they can’t do anything about it anyway. If it was not a spoof, all you’ve done is confirm that you’re the kind of person who opens spam messages. You’ll get more spam, not less. You can, however, forward a copy to spam@uce.com, a department of the Federal Trade Commission which collects and reports on spam trends.

If you think that your address has been spoofed, delete that message too. Some virus writers are deliberately mimicking the email error messages in the hopes that you’ll open the attachment “explaining the problem” and infect your computer with their program. If you don’t remember sending the message, trust your memory. It’s very likely a scam.

This article was originally published in the Jul/Aug 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

Are personal e-mail accounts acceptable for work? What are the advantages and disadvantages to your agency? The lines between personal and professional life often become increasingly blurring. One of the advantages of allowing personal use can be that a few minutes to check e-mail during a lunch break can help staff feel connected and productive for the rest of the day.

Keeping personal e-mail accounts separate from work e-mail accounts can have some real advantages for your agency.

• First, it helps to keep business and personal issues separate. Work is completed on the employee’s official e-mail account, and they can talk to family and do their Internet shopping via the personal account.
• Second, it keeps a lot of the spam messages out of your agency e-mail box. Spammers can find you in lots of different ways but some of the most common involve scanning internet chats and shopping sites for e-mail addresses. If you use a work e-mail address and the spammers find you, they can rapidly invest the account – and you can’t easily change it because that’s were customers expect to find you. In addition, if you use one of the free web-based services like Hotmail or Yahoo and the spam gets too bad, you can always abandon the account and open a new account.
• Third, if set up correctly, it’s portable. When you’re no longer an active employee, you will lose the companyprovided e-mail address. A personal address provides continuity during your transition. If you use one of the web-based services, you’re not even dependent on your personal Internet service provider.

Here are a few things to keep in mind.

• A good rule of thumb to follow is to not allow use of a personal e-mail account for work-related communication. Customers and coworkers expect us to communicate through a consistent channel. In these days of spam and e-mail spoofing, messages from any address other than your regular domain will be met with justifiable suspicion.
• Make sure that you tell employees that you retain the right to monitor personal e-mail if they check it on a work computer. Employees have no right to an expectation of privacy in anything they do on a work computer or system.
• Remind them that if they’re on your work computer, all the normal rules about professionalism and appropriate use still apply, even though it’s their "personal" account.

All sorts of problems come with an e-mail box that gets too large. Bloated e-mail boxes are a technological and administrative headache. Self-discipline over the size of files that we store or that we attach to e-mail is part of good discipline and e-mail courtesy.

One technique for controlling the size of files is to use lower-resolution graphics wherever possible. For most uses, the lower resolution version looks the same on the page even though it takes one-tenth or even one-hundredth the space. Your communications team should have low-resolution versions of all your logos and graphics. These should be used for all e-mails and internal documents such as meeting minutes and presentations. Make sure your staff know where to find the approved versions of all your official graphics.

A second technique is to scrupulously avoid attaching unnecessary graphics to your e-mail in the first place. Graphics in your signature block are specifically discouraged. While some people think that they add a "personal" feel to the message, they go out on every e-mail, bloating both your and your readers’ e-mail boxes. Furthermore, they often fail to display correctly, especially if the message recipient uses a different e-mail program than you do, and frequently cause the message to get trapped in the recipient’s spam or virus filters. Keep graphics to an absolute minimum in e-mail.

Many people keep a personal email account separate from their work email address. I recommend this practice for several reasons.

First, it helps to keep business and personal issues separate.

Second, it keeps a lot of the spam messages out of your work email box. If you use one of the free web-based services like Hotmail or Yahoo, you can abandon the account and open a new account when the spam gets too bad. If the spammers infest your work account, you’re stuck.

Third, if you set it up right, it’s portable. Few people are lucky enough to work at one company for their entire career and all of us hope to retire someday. When you’re no longer an active employee, you lose the company-provided email address. A personal address provides continuity during your transition. If you use one of the free web-based services, you’re not even dependent on your personal Internet Service Provider. You can switch from AOL to RoadRunner and back without ever making your family and friends change their address books.

There are a few things you should remember about your personal email account, though.

• Never use your personal email account for work. Customers and coworkers expect us to communicate through a consistent channel. In these days of spam and email spoofing, messages from any address other than your official work address will be met with justifiable suspicion.
• In almost all situations, your company does have the right to monitor your personal email if you check it on a work computer (and in some situations, is obligated to do so). If you’re on your work computer, all the normal rules about professionalism and appropriate use still apply.