Malicious payloads
Malicious payloads have become very well known in recent times. While they're not viruses in the traditional sense, their impact is in many ways more pervasive, and the matter isn't helped by the fact that they use email to spread. We're talking here of the ILoveYou type of mail-bomb that, whenever opened, reads the local, personal address book and sends itself to every name it finds in order to spread. This sudden boom of mail volume is often enough to deny service, but worse, many of these things also have a payload that executes on the client and wreaks damage to a greater or lesser degree.

Historically, these have been mail-bombs that have taken advantage of the Outlook email client and have had little or no effect in a Notes environment, but no administrator should be complacent. There will be one that attacks Notes sooner or later. These mail-bombs have, in recent times, spread so fast that sites get infected before the virus scanner manufacturers get a signature file out. But all is not lost. You have several things that you can do. You can:

• Eliminate *.VBS and other scripting file attachments in email by automatically removing them. SecurIQ will do this.

• Turn off Windows Scripting Host on your client machines.

• Set your Notes admin and client ECLs so that un-trusted signatures can't do anything.

Spam
Spam is unsolicited mail sent in large quantities. Some of it is merely a nuisance, apart from the fact that it can overload your system and bring it down, causing a denial of service. Quite a lot of Spammers relay their Spam through any system possible, so that it hides the initial source. That can be more of a problem. There are email services that detect servers that allow relays and also maintain public lists of such servers and domains. Many Notes administrators consult these lists, and don't accept mail from listed domains. You might well do this. But you most definitely don't want to be on those lists yourself.

You can guard against relays with settings on the Domino R5 server configuration document. You should also check against the MAPS (Mail Abuse Preference Service) at http://mail-abuse.org regularly to ensure that you aren't on any of the blacklists. Group SecuriQ.Wall will take you a bit further. It will count emails from the same source, person, or domain name, and if more arrive over a given time than you've defined as okay, it starts to block them.

Breaches of confidentiality and breaches of etiquette
You want to be able to trust your employees to keep your company's secrets inside the company. But that trust, especially in a large company, only goes so far, and then you have to get a bit more aggressive.

You need to be able to check that your secrets are not leaving the company in your email.

These days, more common than loss of company secrets by email is legal action taken by employees and others against companies for comments of a personal, sexist, or racial nature written in emails. Not only do you not want these actions coming your way, but you also don't want such emails being sent to customers or suppliers and damaging your business relationships with them.