Administrators confident about the safety of their data encrypted on company laptops should start squirming if a recent court decision passes muster in the United States.

The case involves a Colorado woman who has been ordered to open the encrypted drives on her laptop for federal investigators.

Unlike the cops on television shows and movies, who always seem to have a computer wizard on hand to decrypt a hard drive or crack a password, law enforcement authorities in Colorado, stymied by the encryption on a notebook in the possession of Romona Fricosu, simply went to a judge and asked him to order her to type in her password so they could see what was in the encrypted files.

In arguing against opening the files, Fricosu claimed doing so would violate her civil rights, in particular her Fifth Amendment rights against self-incrimination. Her reasoning was that the government, by forcing her to give up her password for decrypting the drive, were forcing her to incriminate herself if there were anything on the drive tying her to their criminal investigation of a mortgage scam. They believe Friscou is involved the scam that defrauded banks in the Colorado Springs area of some $900,000.

Federal District Court Judge Robert Blackburn didn’t buy that argument. Fricosu might be self-incriminating  herself if she were being asked to utter the password to the files or to give it to the investigators in some other way. However, she was only being asked to type in the password.

The government said it wasn’t interested in knowing what the password was. In fact, it said Fricosu could type the password into the laptop without any government operatives hovering over her. For that reason, the password could be treated like a key is treated in the physical world. Since the courts have ruled that the government can compel someone to give it the key to a safe or other repository of potential evidence in a case, Judge Robinson reasoned, it can compel Fricosu to type in her password.

Although the Fricosu case will be appealed and isn’t settled in law yet, it should give administrators some food for thought. It’s not that far of a stretch, for instance, from treating a password for decrypting files  as a key to treating passwords to anything that way.

That can have broad implications for your data’s security should you ever have to lock horn with any government for any reason. While Fricosu was involved in a criminal matter, the logic underlying the case could be extended to non-criminal government activity such as tax audits or compliance reviews.

With that in mind, should alternatives to passwords be considered? For example, if voice recognition were used to replace passwords, then the “utterance” test might be met and your data might be better protected against intrusive legal searches. Then there’s the question of whether other biometric solutions used for authentication are as legally vulnerable as simple passwords. If a retina has to be supplied to open a laptop, is that a potential act of incrimination?

One thing administrators should take away from the Fricosu decision, should it be upheld by the appellate courts, is that their passwords and the passwords of their organization’s users aren’t as safe as they as they used to be—and neither is anything that can be decrypted with a password.

Government can force you to decrypt your data

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Google recently hung a ‘going out of business’ sign on its Message Continuity service for users of Microsoft Exchange. Google will continue to provide the service to its users until their contracts run out, but after that, they’re on their own.

Since the service was launched a little over a year ago, “hundreds” of businesses have subscribed to the offering, which uses Google’s cloud to provide email continuity when a Microsoft Exchange environment is interrupted for any reason.

Hundreds of users, though, can’t compete with the “millions” of businesses that have moved their entire email operation to Google Apps, so Searchzilla has decided to scrap its continuity product for Exchange  and concentrate all its resources on its application suite.

Current users of the continuity product were “encouraged to consider using Google Apps as their primary messaging and collaboration platform” in a company blog written by Vice President of Product Management Dave Girouard.

The brusque departure by Google from the Exchange disaster recovery scene contrasts sharply with how it entered it:

“Google Message Continuity advances our commitment to providing rapidly deployed, cost-effective email management solutions for organizations of all sizes,” Enterprise Product Manager Matthew O’Connor wrote when the continuity product was announced.

Looking back on the announcement, it appears that Google’s “commitment” to the Exchange market was as solid as an adolescent’s commitment to the latest fad.

That’s not to say that Google’s intentions in offering an Exchange product weren’t clear from the start for careful readers of the company’s pronouncements. “Additionally, for organizations interested in eventually moving to Google Apps, Google Message Continuity can provide a smooth bridge to the cloud,” O’Connor slyly observed in his blog item.

O’Connor’s colleague, Rajen Sheth, the group product manager for Google Apps had a similar pitch at the time:

“Google Message Continuity can also help organizations transition to Google Apps down the road,” he wrote. “Since Microsoft Exchange and Gmail are always in sync with one another, there’s no need to migrate email data when eventually deploying Google Apps.”

Little did those who signed on for Google’s continuity solution realize when they did so that if they didn’t “transition” to Google Apps fast enough to suit the Ferret King, they’d be left looking for another business interruption solution within a year’s time.

Google has been criticized in the past for its flighty attitude toward product development. Some detractors maintain that Google often enters markets to be disruptive, not competitive. Like a sea gull boss, it will undercut competitors in a market and when things don’t work, abandon that market, leaving customers who had faith in the Google brand to clean up the mess.

That kind of product management may work with consumers, but it leaves something to be desired in the business world. Google’s competitor in the enterprise market, Microsoft, knows that. While the Redmond crew have suffered a few slings and arrows for sticking with products too long, their commitment to legacy products has been an important, if sometimes overlooked, part of their success in the business market.

Google’s forsaking of Message Continuity brings to mind some remarks by Microsoft Senior Director of Online Services Tom Rizzo in his famous “Google Graveyard Spooks Customers” blog written on Halloween last year:

“Google releases experimental products and tracks adoption to determine whether to continue providing them,” he wrote. “Its products are like spaghetti, Google throws them up against the wall to see if they stick.”

“The burials of de-supported products are more examples of what is convenient for Google and not good for business,” he added.

Google deserts Exchange users by killing Message Continuity

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Email compliance is always a hot issue. Yet even while there are laws and regulations governing how certain industries send, receive, store and secure email messages, 73.7% of people who responded to a survey admitted that they had violated email compliance policies at their workplace.

It is important to note as well that this number represents those who knowingly violate company email policies. The same survey showed that 42.7% of those asked claim that their company either doesn’t have email compliance policies, or they were unsure if such a policy was in place.

So what are some of the most common violations of these policies? Take a look:

1. Sending confidential information

When it comes to industries like education, healthcare and finance, sending personal and confidential information via email can violate not only company and organizational policies, but also federal regulations.

Still 45.7% of respondents claim to have accidentally sent information via email that violated regulatory compliance and 28% admitted to having done so intentionally.

This also leads to another serious problem, printing confidential emails. While most of the time these emails are printed and immediately filed away, there have been stories of confidential emails left on the printers at trade shows, hotels and airport lounges. Worse still, the information contained in the email almost always remains electronically stored on the printer itself as well.

2. Sending work-related emails from personal accounts

According to a report from a security vendor 71% of people surveyed have been educated on the risks associated with sending work-related email from their personal accounts. 47% of them don’t agree with these policies however, and deem it acceptable to use their personal accounts for work. In fact the same survey showed this to be a major concern among younger employees with 85% of workers under the age of 25 regularly sending work related emails from their personal accounts.

3. Sending inappropriate emails

Nothing can be more damaging to the reputation of a company, or individual employee, than an inappropriate email.

This is a hard statistic to measure because most often, people think of inappropriate emails as those that make the headlines due to racist remarks or sexual references. But these types of emails are only the tip of the iceberg.

Inappropriate emails include sending emails when angry, sending emails with poor grammar and spelling, jokes, slide show presentations, pictures of the grandkids and just about anything else that people find offensive or bosses find to be not related to work.

Most people think that the later list is mostly harmless but when you add up the hours lost in productivity and the customers you lose because you consistently spell the as teh, you can see where it can become a problem.

4. Inappropriate use of the email signature

If a company has a well written email compliance policy in place then it will most certainly contain some guidance as to how employees should write their email signature. Most people will ignore this.

Frequently, companies restrict signatures to the person’s name, contact information and a link to the company’s web site. Sometimes they will specifically address the use of quotations or sayings in the signature line – but this is often ignored.

Email signatures that violate compliance policies can also be spotted by the font and color used as well. Generally, it is not consider professional looking to use multi-colored text or fancy fonts for the email signature.

5. Using work email for personal communications

Policy flaunters aren’t only using personal emails for work, but vice versa as well. One common misstep when it comes to email compliance is to fire off a quick email to a friend or spouse from your work account. Many people still don’t realize that the contents of their emails are subject to review by their employer. Even those who are aware of this continue to send personal emails from work or use their work email address to register for web sites or mailing lists online.

To reduce the number of people who violate email policies in the workplace, email administrators need to clearly define their expectations to all employees and take the time to enforce these policies. When people understand the rules and see that they are frequently, but fairly, enforced they will be far less likely to try to circumvent them.

5 Most Common Violations of Email Compliance

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

At one time or another, most email administrators are tasked with the responsibility of writing up policies that govern the use of email in an organization. These policies are necessary to:

• Protect against email based threats and vulnerabilities
• Reduce the organization’s liability if email is used inappropriately by employees
• Prevent misconduct when it comes to email use
• Educate employees on email etiquette
• Inform employees of email monitoring policies.

However, many email administrators find it tough to sell their coworkers, and even management, on certain aspects of the policies created. Instances of a company’s employees, brushing off email policies as insignificant, or simply ignoring them altogether, are far too common in today’s workplace.

Despite the importance of email policies, most people simply see them as either a barrier to getting work done or as a way that management can monitor and control their activity.

As email administrators, we can certainly do a better job when it comes to getting buy-in from our coworkers. To help with this, we have compiled a list of tips that can help you present new email policies, or changes in existing policies, with as little friction as possible.

1. Understand why you are creating these policies

The first step begins with the people tasked with creating these policies. As email (or IT) administrators, we have to realize that our number one job is to help our coworkers do their jobs more effectively. Too often, IT policies are influenced by things that make life easier for the IT staff and often at the expense of other departments. This immediately creates friction and a type of civil disobedience often follows.

If other employees see that any policies in place are not just to make life easy on IT, but exist to help the company as a whole, there is often less justification for not following them.

2. Explain the risks

Users often need to understand the reasons why they have to do something in order for them to comply. But taking a “because you are supposed to” attitude isn’t explanation enough. Provide them real life scenarios that show what can happen if they don’t follow the policies that are put in place. Oddly enough, people often find these examples intriguing and captivating. Compliance usually increases after they are presented with stories like these, but after a while the fear factor wears off. Keep users in touch with the various risks giving them a reminder every so often through company newsletters or blogs.

3. Review policies with other departments

One of the biggest threats to compliance is when upper management doesn’t buy in to your policies. This often happens when they feel that the email policies put in place restrict their team from being productive.

4. Provide data

If you are serious about email policies then there should be some way to track data. Provide users with data from your organization to help show a need for policies. For instance, if you have a policy in place regarding not responding to junk mail then show your coworkers how this helps reduce spam in your workplace. If you block executable files from being attached to email messages, provide evidence that this measure helps prevent malware outbreaks.

5. Realize that not every policy has to do with security

More often than not, email policies are looked at from a security/productivity standpoint. They help keep emails and information secure and confidential, and they help keep workers on task.

However email policies can also help protect and promote your organization’s brand.

By regulating how users write emails and how they craft their signature lines can really improve how current and potential clients see your company.

Even though other forms of communication are becoming more popular, businesses will continue to rely on email as the primary means of communication for years to come. Those who work to make sure email communications run smoothly will always find that compliance with policies that govern email use is often neglected. However when the right approach is used, the headaches that often accompany email related problems will most certainly decrease giving you more time to deal with projects you probably find a bit more interesting and much more worthwhile.

5 Ways To Increase Email Policy Compliance

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Back in October of 2009 the City of Los Angeles voted unanimously to outsource their email services to Google. While many other organizations have made similar moves, this move made Los Angeles the largest city in the United States to hand over its messaging services to Google, Inc.

For $7.2 million, all 30,000 city employees would be turning to the cloud for email.

This was a huge win for Google because not only did they beat out their rival, Microsoft, but a successful implementation would easily pave the way for future business with local governments.

Fast forward two years and one Los Angeles city councilman is asking why nearly half of the 30,000 employees haven’t yet moved to the new Google Mail system.

The answer is Google has “been unable to meet the security requirements of the city and LAPD for all data and information.”

Basically, there have been legal obstacles concerning whether or not Google can house law enforcement data, such as criminal histories and data related to investigations, on its servers.

Shame on Google?

From an outsider’s point of view, it looks as if Google is to blame for this catastrophe.

Especially when news stories lead in with headlines like, “Google ‘unable to meet’ security needs of city email.”

However Google isn’t exactly at fault here. They claim that working with the regulations surrounding municipalities, “is so new that the legal requirements around data protection are still evolving — and that some of those regulations came to light only after the contract was signed in late 2009.”

Instead of making the jump, the LAPD and other agencies have remained on their older email system using Novell’s email software with Google footing the bill.

But costs aren’t the only thing at stake. Using two different email systems has caused headaches and productivity problems for city employees, especially the IT department.

Who is to blame?

In all actuality, it is the Los Angeles City Council who is at fault here.

Google provides a product. When a customer wants to use that product, they have to do their research.

Most likely, the question arose at some point, “will our information be secure with you?” And most likely Google answered yes.

But that can’t be sufficient. When you are talking to a salesperson, you need to understand that A) the nature of their job is to sell you a product and B) their legal knowledge will not be on the same level as that of a lawyer’s. Before the vote even came before the city council a thorough review of the product and its adherence to federal, state and local regulations should have been completed by the legal team for the city or an outside agency. End of story.

Best practices

There are plenty of news articles floating around in cyber space about how a school district or government agency dropped the ball when making a huge technology purchase.

A simple search of Google Apps for Government + regulations in the time period of October 2007 to October 2009 returns quite a few results about how Google is ramping up its offerings for government agencies. There are even some pretty high profile publications that covered what Google is doing to get ready for what it hoped would be a wave of government clients.

But if you go past the first few pages of the search results you start to see a different picture. Many more results caution users who need to adhere to specific regulations to stay away from cloud based providers for certain services. Email being one of them.

Of course quite a bit has changed since 2009, and Google has gone a long way to make sure that their products are certified under FISMA (The Federal Information Security Management Act of 2002) so that the federal government regulations that govern email are met.

And while Los Angeles still sorts out its email mess, other municipalities and agencies continue to move email services to the cloud. Some of them successful, some of them plagued by problems.

However one thing that hasn’t changed is that organizations will continue to sign large contract for products and services without getting the whole picture ahead of time.

For Los Angeles, Not Every Cloud Has A Silver Lining

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

There was a time when using PST files were thought to be the solution to file storage problems. Getting emails out of the user’s mailbox and onto a shared repository not only freed up email inboxes from increasing file sizes, but also gave admins a central location in which all emails could be backed up and archived.

Add to these benefits the fact that PST files could be separated so emails related to a project, client, subject, etc could be stored and archived separately, and many would think that this solution was all that an IT department would need to manage their archiving and storage needs.

Of course PST files aren’t a panacea; they have many problems associated with them.

Working offline

More and more frequently, workers find themselves working remotely. When this happens, they don’t always have access to network resources so they find themselves working offline. This makes accessing PST files stored on a network device difficult, if not impossible, to use.

Workers who need to refer back to emails in their personal folders are pretty much out of luck.

Another, more common situation, arises when PST files are stored on a desktop computer at the home office and a remote worker is using a different computer; let’s say a laptop at home.

This user could not access his or her PST files if they cannot access that desktop computer where the file is housed. Now you may wonder why anyone would keep their PST files on the local computer as opposed to a shared network resource, but the scenario is actually quite common.

In fact, it was considered a best practice since Exchange 4.0.

According to the Technet blog:

“A .pst file is a file-access-driven method of message storage. File-access-driven means that the computer uses special file access commands that the operating system provides to read and write data to the file.

This is not efficient on WAN or LAN links because WAN/LAN links use network-access-driven methods, commands the operating system provides to send data to or receive from another networked computer. If there is a remote .pst (over a network link), Microsoft Outlook tries to use the file commands to read from the file or write to the file, but the operating system then has to send those commands over the network because the file is not on the local computer. This creates a great deal of overhead and increases the time it takes to read and write to the file. Additionally, the use of a .pst file over a network connection may result in a corrupted .pst file if the connection degrades or fails.”

Bad files

Anyone who has worked with PST files knows that they have a tendency to become corrupted or damaged. There is an entire industry dedicated to developing tools to help email administrators fix damaged PST files, and Microsoft themselves have published a number of tools to help fix specific problems.

These problems can occur due to hardware failures, such as:

• A failure in the storage device
• A power failure
• Failure in a networking device
• Failure in the network infrastructure

Of course, the software itself also has been known to create problems:

• Incorrect file system recovery where PST data is incomplete or incorrect
• Malware infections that damage PST files
• Outlook being terminated abnormally
• Deficiencies in Outlook itself

Regardless of what caused the problem, if you encounter damaged PST files it costs money to repair them. It can cost even more if you are required to provide information from them but can’t because they are corrupted.

The intent behind personal storage tables makes perfect sense. However, in practice email administrators need to find a better solution if they want to stop wasting time with the hassles presented to them by Outlook’s PST problems.

Solutions that are made to be stored on network file stores and less likely to be corrupted by common tasks, not only make life easier for the IT department, but legal departments as well, since accurate, reliable information can be provided when it is requested, not when a company eventually finds a specialist to piece everything together.

Two Big Problems With PST Files

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

One of the most common applications to move to the cloud is email. Quite frankly, most small and medium sized businesses choose to let a cloud provider host their email because:

• Email services are always up and running
• Email can be accessed from anywhere
• It is scalable – you can increase or decrease as needed
• It is affordable (you only pay for what you use)
• It frees up resources (IT staff) for other projects.

Although attractive, cloud based email solutions can’t be something an organization just jumps into without proper planning.

In order to successfully implement a cloud based email solution for your business you need to first ask why. The answer to your question should define what your company stands to gain from a successful cloud solution. Once you know why your email should be in the cloud, it is time to start looking at how to move forward with planning your move.

Best Practices

One of the most practical ways to plan a project is to take a look at what other organizations with similar goals have done in the past and apply those practices that worked for them, avoiding, or modify, the things that failed.

Regardless of your industry, there are a few best practices that can be considered universal and should be a part of any organization’s planning stage.

Find out what your employees need

One of the reasons why organizations move email services to the cloud is because they pay only for what they need. A cloud provider makes money from the services they are able to sell. Knowing exactly what is needed can help you avoid paying additional costs and can also help you purchase the solution you need. Some things to look for:

• What are the mailbox size requirements?
• What are your archiving requirements?
• What type of backup and recovery solution is needed?

Does your email integrate with other business applications?

CRM, finance, project management, web applications and many other software packages that are part of the business workflow process are dependent on email services. Before you work with a cloud provider, make sure everything will integrate seamlessly.

Analyze security requirements

If your business is subject to regulations like HIPPA or Sarbanes-Oxley, then it is important that any cloud solution you use for email has the capability and expertise on staff to keep your business in compliance. If they are unable to supply this guarantee then you should be looking to another service provider.

Determine what you will migrate

The amount of data in your email and calendar history will have an effect on how long your migration to cloud services takes, and ultimately how much it will cost. While most organizations want to avoid the issues of keeping one foot in your current solution and one foot in the cloud, it may be necessary.

It may be necessary to utilize a hybrid approach for a certain amount of time until your organization can move entirely to the cloud.

Test, test and test again

Before anything is completely moved to the cloud it is important that you test the waters. Having employees show up one day to find that their email services have completely changed is bad enough. Not knowing what complications and challenges they may run into can easily kill your credibility.

By setting up a valid testing environment you can see the effect moving your email services to the cloud will have on workers and your company’s workflow.

Have an exit strategy

No one wants to start a project with the assumption that it will fail but if you have been around IT long enough you should know that not everything goes according to plan. If this is the case with your cloud migration, you have to be ready to pull the plug.

Making the decision to kill a project is hard enough but dealing with the ramifications can be even worse. Understand what contractual obligations you have to your cloud provider in the event that you need to terminate the contract. Not only that, but have a plan in mind for how you will minimize any disruption of service should your cloud solution not work out.

Cloud Based Email, Best Practices for Before You Move

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

In Understanding Email Encryption Part 1 I covered not only why encrypting email is important, but also the two different types of email encryption: asymmetrical and symmetrical.

There was another section that briefly mentioned some of the barriers that impede buy-in from management when it comes to an encryption solution. But these were only touched upon.

Unfortunately when it comes to making a pitch for encryption, those who understand the need for it are an easy sell. Those who either don’t understand it or see the need for it often cite one or more of these stigmas that are attached to email encryption as reason to avoid it.

Should you find yourself being stonewalled when giving your reasons for email encryption, here are a few points you can make to counter any disbelievers.

Of course the consequences that come from disputing your boss in front of others is something that encryption can’t protect against, so use them at your own risk.

Encryption makes us look paranoid

In the previous post I quoted a survey respondent as saying: “normal people don’t encrypt normal email messages” when asked about adopting encryption for email.

The problem is that society does tend to raise an eyebrow at those who act paranoid. Let’s be honest here, they are outright ridiculed.

And no one wants to be made fun of. But that is playground thinking. As a customer, client or employee I want to know that my personal or confidential information is being protected. Email encryption can make me look silly if I am sending a joke to a friend and I use DES cryptography, but if account information is being sent from my bank I want to see a bit of protection put in place.

One way to counter this is to ask, “would you rather someone think you a bit paranoid, or would you rather be in the news like the Oak Ridge Laboratory, CitiGroup, Sony, Target, Chase, etc.”

Encryption is too complicated for most users

15 years ago, email was too complicated for most users. There was a time when the telephone was complicated technology.

And yes, there was a time when cryptography for email messages was quite a bit of work but now it is rather simple and solutions operate seamlessly with your company’s email client.

Outlook offers two separate methods of encrypting email messages. You can encrypt a single message, using 3DES by going to the Message tab in the Options group and click on the Encrypt Message Contents and Attachments button.

After that you simply write your message and send it on its way.

Encrypting all messages can be done as well but that requires all recipients to have your digital ID to decrypt the contents.

Still, that doesn’t seem too difficult now does it?

Encryption is too expensive for us

Another stigma is that encryption is for large companies, not small or medium sized businesses – this isn’t entirely accurate.

Sure, an organization can spend a good deal of money on an expensive appliance that requires add-ons and plug-ins. But you don’t have to spend that much.

With Software as a Service models, even the smallest company can purchase a service contract for only what they need. Be it one user or a thousand.

There are even companies that cater these services to smaller organizations specifically to keep costs within reason.

Software as a Service solutions can also help negate the belief that encryption will be too much of an undertaking for your IT staff as well. Since the company is buying the service, there is nothing for the IT people to set up, configure, troubleshoot, monitor, etc.

Encryption, like any other technology, has changed over the years. But so has the need for it. There was a time when email wasn’t such a lucrative target for attackers. There was a time when regulations mandated certain security baselines be put in place. There was a time when using encryption required a Master’s Degree in Computer Engineering. But all that has changed. Let your company know it’s about time their mentality regarding protecting email messages does as well.

Understanding Email Encryption (Part 2)

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

When looking at solutions on securing email, many people don’t take into consideration the type of business environment they work in. All too often, after spending a great amount of time and money, small to medium-sized enterprises find out that what works for a company the size of Bank of America doesn’t quite work for them.

To better help SMBs find solutions scaled to their needs when it comes to email security, I have compiled a list of 5 tips that address the risks and restraints that they face.

1. Get the right solution

Email security can come in any number of packages. Security solutions can be software based, deployed through an appliance or even in a hosted environment. Each type has a variety of advantages, but there may be some disadvantages based on your company size or industry so it is important that you weigh your options carefully.

It is also important to look to solutions that can provide the protection your company needs at a cost that works. Too many times people are under the impression that security appliances are seriously out of reach for most small to medium sized businesses. This isn’t the case. There are many solutions that organizations find affordable and feature rich.

Make content filtering a standard practice

Content filtering needs to be a two way street. Of course, you want to filter out inappropriate content from being received by employees and certain types of attachments need to be blocked to prevent the spread of malware and expose vulnerabilities. However how often do you consider filtering what leaves your business via email?

Many industries nowadays are highly regulated and sending sensitive, or even financial, information out through email can not only bring compliance issues to your business, but it may also give competitors an edge. Filtering what users send out can be just as important as filtering what they receive when it comes to securing your company’s email.

Practice recovery as well as backup and archiving

Do you brush just half of your teeth? Then why would you only test half of your backup and recovery solution? Many companies find out, only when it is too late, that their backup and recovery solution was not configured properly or that there is some sort of problem.

This can be alleviated by regularly testing the recovery portion of your backup. By simply setting up a server (or virtual server) on which you can replicate your email system you can frequently test the validity of your backups in a way that will not disrupt your current email process.

Create fair policies that management will enforce

One of the biggest mistakes that SMBs make when it comes to email security is to take an overly aggressive approach. Without the manpower and resources to fine tune security policies, it becomes easier to just restrict anything that could be a perceived threat. This becomes especially true in small IT departments because they are tasked with so many other responsibilities.

When creating policies, it is important to bring other departments to the table so that these policies do not restrict anyone from getting their work done efficiently and effectively. Involving others at the management level also helps them better understand the reasons behind email policies and the ramifications for not following them. Gaining this support will help when it comes time to enforce these policies and discipline those who violate them.

Educate your staff

When it comes to security, it is a common misconception that bigger, state of the art, expensive solutions provide the best protection. Even though this isn’t true, SMBs often feel that they are at a disadvantage when it comes to email security because they cannot afford to deploy such solutions.

What many SMBs don’t see is that they have a distinct advantage over their larger counterparts when it comes to educating end users. When you have a smaller number of employees to train you have the advantage of being able to spend more time with them to make sure they understand the material you are delivering. You also have the opportunity to be readily available to answer questions or address any concerns or issues that your users may have.

Developing a solid training series for email security can also help free up time for IT departments that find themselves tasked with too many responsibilities because users who are informed and educated require less oversight and less attention.

5 Essential Tips for SMB Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Advanced persistent threats make email security a necessity

Most email administrators consider security to be a large part of what they do. With so many laws and regulations governing the storage, discovery and retrieval of email messages, security has become a second job to many.

Unfortunately, many administrators either forget, or simply aren’t aware, that securing email requires much more effort than hardening the email servers against attack. In order to fully protect your organization’s email and their contents the mailbox also needs to be defended. Especially when you consider how popular Advanced Persistent Threats are becoming with large cyber crime syndicates who use email not only as a way to harvest sensitive information, but also as a method of attack through phishing and social engineering.

By implementing the following tips into your security plan you can help protect against these, and the many other threats that your organization may face:

Create email policies to regulate the communication of confidential information

Email communication has become second nature in the workplace. It is quick, easy and it gives us a record of our conversation so we can refer back to any information at a later date. However, if the conversation contains sensitive information like login credentials, financials, personal information, and the like, then it can be extremely valuable to anyone who may harvest those emails.

By simply setting up, and enforcing, policies that restrict certain information from being sent via email you can mitigate the damage done if emails are exposed. At the very least, your policy should state that user logins and passwords (and/or PINs) not be communicated via email.

Teach users to encrypt their messages

One of the best analogies I have seen to describe the need for encrypting emails is one that compares email to a postcard. Basically, anyone who comes across it can read the contents if they want. This can be stopped by encrypting emails to prevent eavesdropping.

Encryption is a hard thing for many people. It requires additional steps, training and, in some cases, third-party software (such as PGP) yet it is really the only way to keep your messages private in transit.

Encryption shouldn’t be limited to sending and receiving messages alone. Any email that is stored on a hard drive (think personal folders), a network drive, backup servers or archive systems should also be protected from any prying eyes.

Get rid of old email

A long time ago, storage space was a precious resource. Nowadays inboxes can be easily scaled to hold enormous amounts of data. Unfortunately that provides a greater possibility that an attacker will find something valuable.

Email should be moved, or deleted, when their life cycle is up. Make sure to check with any regulations regarding discovery and archiving before getting rid of the old stuff, but if you combine this with encryption you will be taking great strides to protect older emails.

Practice good network security habits

Make sure that desktops are continually scanned for malware that could possibly expose email login credentials, filter Internet content to protect against malicious websites, understand how to properly use a firewall and update server and client software as needed.

In addition to the employing technology to help secure your email systems you should also consider human factors as well. One of the ways that people first discover that their systems have been compromised is by noticing an anomaly. Be on the lookout for log-ins that just don’t seem right whether it be the IP address, the time of day or even the length of time.

This can be one of the most tedious tasks to undertake when it comes to security but it is by far the most important.

Put the right solutions in place

In many small and medium-sized enterprises, the email administrator alone cannot be as vigilant as he or she would like. Even in organizations where there is team of professionals dedicated to security use necessary security tools to help them do their jobs. Smaller companies need to understand this as well.

By employing technologies that help manage email, backup and recovery, archiving and security, you are plugging the little holes that provide that chink in the armor most attackers are looking for.

No one said that email security is going to be an easy task, but it is one that cannot be ignored just because it’s too hard or it costs too much.

Tips for Better Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Getting your co-workers to adhere to policies that govern the use of email in the workplace can be tough. Despite your best efforts, email is still used to send jokes, chain letters, pictures, slide shows and other inappropriate content.

For whatever reason, people don’t quite get that not only are email policies in place to protect them and the company brand, but there are consequences for violating these policies. Unfortunately, the only time when people begin to comprehend just how serious email policies are is when it is too late.

To better help your co-workers and employees understand why it is important to adhere to email regulations and company policies, here are a few real life examples that you can use to get the point across:

Sarah Palin

The mistake: Using personal email to conduct business.

Nothing of note was found when her official email archives were released to the press recently but remember back when her personal Yahoo! account was cracked? She had to answer questions regarding the use of her personal email to conduct state business instead of her official account that is subject to laws and regulations regarding public records.

Mark Foley

The mistake: Sending inappropriate messages while intoxicated.

The congressman from Florida was caught up in an email scandal when he sent a message to a former Congressional page requesting a photo. Although the email was sent from his personal account it did open up the floodgates and it was found that he had also sent suggestive text messages to the same young man. Foley later explained that he had a drinking problem and that the messages were all sent when he was intoxicated. After all this surfaced he was told to either resign or he would be expelled from the House of Representatives.

Neal Patterson

The mistake: Expectations that emails are private communications and bad etiquette.

Whenever a paper trail exists there should be no expectation that the communication will remain private. In 2001 Neal Patterson, CEO of the Cerner Corporation, learned this when an email he sent out to his senior staff was leaked.

The email, which berated and threatened managers by stating, “As managers, you either do not know what your EMPLOYEES are doing or you do not CARE. In either case, you have a problem and you will fix it or I will replace you,” caused a 22 percent drop in the company’s stock.

Climate Research Unit, England

The mistake: Confirming a cover-up using email.

Much of the research from the CRU is used by the United Nations for its global climate reports so when an email surfaced from Phil Jones, the head of the CRU, that read, “I’ve just completed Mike’s [science journal] Nature trick of adding in the real temps to each series for the last 20 years and from 1961 for Keith’s to hide the decline,” you can imagine what happened to the credibility of this group.

Galleon Group

The mistakes: Fake emails to cover up security fraud.

Galleon founder, Raj Rajaratnam told employees to create a fake email trail to make it appear to the SEC that some of his recent stock purchases were based on price rather than inside information he had received.

“You just have to be careful, right?” Mr. Rajaratnam told the former Galleon employees in a taped conversation. He later explained that he would send an email asking about a stock “so that we just protect ourselves.”

He was found guilty on 14 counts of conspiracy and securities fraud and faces sentencing on July 29^th.

Lee Abrams

The mistake: Sending offensive content via his company’s email system.

The chief innovation officer of the Tribune Co. resigned in 2010 because he sent an email memo with a link to a video that he thought was funny. Some of the people who received the email didn’t quite see it in the same light. In fact, they found it offensive and complained. Originally, Abrams was suspended by the company indefinitely but later left his position.

As you can see, and hopefully your co-workers understand, that when it comes to the inappropriate use of email the intent isn’t taken into consideration. Even something that the sender views as harmless often carries the same consequences as something done maliciously.

Email Scandals That Should Make Us Think Twice

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

In just one week Google, the International Monetary Fund and Citigroup have all made headlines as a result of email associated with them being under attack. The reason we continue to see companies make the news as a result of email attacks is that email security is sometimes ignored when it comes to training users properly and making good decisions. In some cases, having the latest and greatest when it comes to security tools even creates a false sense of security that causes us, and our users, to overlook the little things. A multi-layered defense that has been properly configured with all the best technology can be rendered useless if the little things are forgotten.

This list displays some of the most common mistakes that are made when it comes to email security and a brief description of what you can do to prevent them.

Leaky emails

There are many times when sensitive information is passed along via email. If everything is encrypted properly you, and your users, often assume that it will only be seen by the appropriate people. Unfortunately this isn’t always the case. Too many times a recipient may answer an email with sensitive information and hit the reply all button without checking to see who will be receiving the email.

The fix: Put a policy in place that addresses sensitive emails and reply to emails. However a policy alone isn’t enough. Make users aware of the policy through training and keep a record that all users were trained/informed of the policy and repercussions of not adhering to it.

Trusting others

When we receive emails from family, friends and business colleagues we often blindly open them without much concern. Especially if they are contacts we communicate with on a regular basis. However malware can easily be spread through emails by attachment or embedded code and links.

The fix: HTML in emails should be blocked if this is a concern, as should the ability for your users to receive attachments that are scripts or executable files.

Passwords that are easy to guess

Remember when Sarah Palin’s personal email account was breached? It was because her password was easy to guess using information the attacker found on her Wikipedia page. Companies often list information on corporate sites that provide attackers enough information to guess passwords as well.

The fix: Enforce strong passwords or password phrases for all users. Also, make sure that people don’t give up information that may be used to guess their passwords when providing bios.

Ignoring malware protection on the desktop

While scanning all emails for malware needs to be done, the desktop should not be ignored. And all too often it is. Malware definitions are outdated, software is not configured to run properly or protection is completely left to the user.

Even if you have a policy that enforces strong passwords, a keystroke logger can easily give up even the most complex password combination.

The fix: Email administrators should work closely with IT security to make sure that the desktop and network security isn’t lax so passwords are tougher to expose.

Failing to check on backups

Some companies and industries are required, by law, to back up and archive emails for a set period of time. Others are not required to do so. Regardless of the laws, every person and company should be in the practice of backing up emails. Emails often provide important records and information that could be lost.

But what happens if you need to restore your emails and find that something went wrong? Maybe the backup was incorrectly configured or the backup location was insecure. In any event, the inability to restore emails from a backup can render the entire solution useless.

The fix: Frequently test the ability of your backup solution, and staff, to restore emails.

These five tips may seem basic and simple. But that is the point. Working in IT we often gravitate towards the more complex issues and ignore simple techniques and solutions until it is too late. By taking the time to do the little things when it comes to security, we build an even stronger foundation for all the bells, whistles and technologies that really impress us and our bosses.

5 Simple Mistakes When it Comes to Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Developments in cloud based computing have shown quite a bit of excitement and promise, especially when it comes to small to medium sized businesses. Those who evangelize the cloud will often cite the many benefits of moving to a cloud based email service. The litany of favorable reasons to examine moving email services off site that are oft quoted fall into line with the reasons used to move to any new technology:

• Ease of scalability
• Ease of software updates
• Email access anywhere
• Better disaster recovery
• Ease of implementation
• And of course, reduced costs

So when a vendor, or even someone in your own organization, throw these at management looking to save money and increase productivity then it seems like the question moves from why should we move to the cloud? to why has it taken us so long to move our email to the cloud?

Is it really that easy?

Cloud based email services make a whole lot of sense for many organizations. By doing a bit of research, you are certain to find at least one case study on how moving your email to the cloud helped someone in your specific industry. Yet even with good reasons and plenty of research to support this decision, nothing should be done without considering every angle because over the years if we have learned one thing, when it comes to IT nothing is risk-free.

So what does an interested SMB need to consider when all the arrows point to moving to the cloud? Let’s take a look.

1. Control

When your email resides on servers that are housed at your location, you are responsible for configuring the software, maintaining the hardware, updating and patching the server(s), cooling the room, etc. But you also have complete control over your email and backups. Moving to the cloud means you are giving up control and possibly ownership. This lack of control can lead to real world problems. For instance, if your organization has a one year deletion policy, is your cloud provider able to adhere to that? Conversely, if you have a no delete policy can this be achieved as well?

A rarer occurrence, but one that has much harsher repercussions is the event that an investigation needs to take place. Will emails be available for forensics when needed? If so, will there be any issues with the chain of custody and proving that the investigation was tamper proof?

2. Availability

Unless you have been living under a rock you are well aware of the attacks against Gmail over the recent months. The decision to move email services to a cloud provider should always be based on how well the provider can ensure that mail servers will deliver an acceptable percentage of uptime. Of course it’s one thing to say that you guarantee 99.9999 percent uptime and quite another to deliver so when a cloud provider makes a claim regarding availability, make sure your IT team speaks with the sales engineers, not just the salesperson, to see what exactly is in place to eliminate things like interruptions and denial of service attacks.

3. Security and Spam Protection

One of the biggest draws to the cloud for email is the fact that the provider will take care of security and anti-spam. Again, this is something that you are entrusting to the provider and giving up control over. If you are unhappy with the amount of spam that gets by the filters, or if the false positive rate is higher than an acceptable rate you can’t simply switch to a different solution.

This should be at the forefront of any discussions you have with potential email service providers. Find out what solutions they have in place and research them just as if you were buying the protection for your own servers.

4. Cost

Of course cost is always the number one reason SMBs look to the cloud. It is hard to find anyone who will say that a cloud based solution isn’t less expensive in the long run than running, securing and maintaining your own email servers. However the numbers may not always equal the level of service you expect. Costs may not always be transparent. A cloud provider may charge extra for business grade anti-spam protection. Perimeter security or virus scanning may also require additional costs. Finally, storage is never a one size fits all solution so this will always present itself as a variable.

The cloud is definitely a solution worth looking into for a number of reasons, however as a smart business move it would be equally prudent to look at all of the considerations as well prior to signing any type of contract.

4 Considerations for Cloud Based Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Just about every business organization is aware of the need to archive email for compliance purposes, and many understand how an effective email archiving solution can help reduce the amount of resources wasted by the company’s mail server(s).

Unfortunately, the new wave of employees doesn’t quite get that. According to a recent study of how younger employees use corporate email, businesses could find themselves at risk due to the social media savvy employees who find corporate email too restrictive.

The root of the problem

As companies hire younger workers who grew up with social media, there is a shift in how the workforce balances their work life with their social life. To the younger crowd, using social media as a way to be more productive at what they do for work appears to be perfectly acceptable because they are using the tools at their disposal to get things done. While most managers may think that this divergent style of thinking is productive, you would be hard pressed to find an IT department so welcoming of this trend.

When it comes to email, policies often dictate the size of an email inbox. In addition to the amount of storage permitted, email policies often block certain types of attachments as well to help protect against malware infections on the corporate network.

In order to get things done, it is common for younger workers to work around these restrictions by using personal email accounts and social media to communicate when they find corporate email too confining. From the numbers, you can see just how rampant the use of personal email is:

• 79 percent claim that they send work emails from their personal email accounts and one in five claims to do this on a regular basis
• 71 percent realize that there are security risks inherent to using communication tools outside of the corporate email environment
• 47 percent feel that it is perfectly acceptable to send work emails and documents to their personal email accounts
• 36 percent of incoming mail sent to work inboxes is not work related
• 52 percent stated that their personal email is better than their work email compared to 29 percent of people over the age of 55 who feel the same way

The security risks associated with using personal, unrestricted email in the corporate environment are clear. There is no consistency with spam prevention, no consistency with content filtering and no consistency with malware prevention. However what most people still fail to understand is that there are also legal issues that this practice brings about and that comes into play with email archiving.

Messages sent to and from personal email accounts are not included in the company’s archival storage because it is not part of the corporate email server. All it takes is a reminder of how Morgan Stanley was fined 15 million dollars in 2006 for delays in handing over requested emails to the SEC for anyone to see just how serious it is that all communications that are readily accessible.

But compliance isn’t the only reason that corporate emails need to be archived properly and not left to chance in someone’s personal inbox. As nearly all companies face litigation at one time or another, the need to produce evidence relevant to a case is just as important as being able to produce emails for a government agency. This simply can’t be done effectively and efficiently if important emails are sent or received through an employee’s personal email.

The solution?

The need for email archiving is not going away. If anything, the need to save and store communications is growing. The solution to the younger workforce’s reliance on rogue email communication is to realize what it is that makes these workers effective and work with those skills.

No football team would ever draft a quarterback with a rocket arm and pinpoint accuracy and then declare themselves a running team so why would a company hire technologically savvy workers and then try to restrict that which makes them so desirable in the first place.

The corporate culture needs to educate new hires as to the importance of email archiving and how business is done while still finding the room to make concessions that allow the younger generation of workers to be successful.

The Problem of the Tech Savvy Workforce

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

With another round of issues facing users of Microsoft’s Exchange Online service the launch of the Business Professional Online Services replacement, Office 365, is starting to face questions by consumers who are starting to think that Microsoft’s cloud based services may not have much of a silver lining.

Exchange Online is a hosted messaging solution, like Google’s Gmail for businesses, and is based on the same technologies that run the ever popular Exchange server. However as this is a hosted solution, the business does not need to dedicate the same resources towards messaging as they would if they were running their own email servers on-site. Since messages are stored in the cloud, Exchange Online users have “From virtually-anywhere” access to e-mail. Also touted by Microsoft’s website is:

• Improved email security
• Enhanced operations efficiency for a company’s IT staff
• 25-gigabyte mailbox storage size for the standard license

Most importantly, users who have become reliant on Microsoft Outlook and its tools can find the move to hosted email seamless unlike the issues that arise when using Outlook with other hosted email services.

What seems to be the problem?

In early May, most BPOS users experienced loss of service for up to nine hours one day followed by sporadic outages over the next couple of days. Without email services, many businesses found their productivity crippled.

Ironically, email services hosted in Microsoft’s beta offering of Office 365 were not affected by the outages and service here did not have any of the issues that BPOS had. However the timing of these recent problems couldn’t be any worse.

Microsoft’s reputation is still tarnished by the problems associated with Windows Vista and Internet Explorer is often thought of as an inferior product when compared to competitors, so making headlines once again due to service related issues is not the best thing when launching a new product. Even if the product addresses the problems you are infamous for.

Is there light at the end of the tunnel?

Most people understand that there is no such thing as 100 percent uptime when it comes to technology. Ask Gmail users if their service is always up. Things are bound to fail at times. And to Microsoft’s credit they responded to the problems quickly, provided users with a temporary workaround to restore service and they identified the root cause of the issue in a short period of time. Unfortunately most people aren’t in the habit of giving Microsoft much credit for anything.

What we can learn from this

Email administrators understand all too well the importance email service plays in the ability for a business to operate efficiently. When email is down workers grow impatient, management grows frustrated and the email administrator’s popularity rapidly wanes.

In order to handle a disruption in productivity any business that relies on the cloud for essential services, like email, should have a back-up plan. One thing that is promising with Office 365 is that it offers a hybrid approach to email. Using Exchange Server 2010 on site in the hybrid deployment scenario that Microsoft offers can help an organization better deal with outages in their cloud services. Conversely, being able to access email via the cloud keeps things moving when the Exchange server goes down as well.

Microsoft’s Office 365 community website points out that the cross-premise messaging solution (hybrid deployment) offers the following features to help lure potential customers:

• Mail routing between on-premises and cloud-based organizations
• Mail routing with a shared domain namespace (For example, both on-premises and cloud-based organizations use the @contoso.com SMTP domain)
• Unified global address list, also called a “shared address book”
• Free/busy and calendar sharing between on-premises and cloud-based organizations
• Centralized mail flow control; the on-premises organization can control mail flow for both organizations.
• A single Outlook Web App URL for both the on-premises and cloud-based organizations
• Move existing on-premises mailboxes to the cloud-based organization
• Centralized mailbox administration using the on-premises Exchange Management Console (EMC)
• Message tracking, MailTips, and multi-mailbox search between on-premises and cloud-based organizations

Despite recent problems, Office 365’s email solution looks rather promising. One Microsoft is able to do some PR related damage control it looks like they will be able to make a solid run at cloud based email services and give Google Mail something to think about.

Is Microsoft Exchange Online Only Half-Baked?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Everyone knows that without an active practice of management in place that our lives and every facet of our businesses can result in a chaotic existence. We need to manage our checking accounts, our income and expenses, the food we eat, the amount of paperwork we keep, etc.

The same concept of management applies to our email systems. We need to implement a usage and accounting email system to track and report how much of our computer resources are being consumed so that we can properly bill out to the various departments we support in our organizations.

Administrators also need to monitor the flow of emails that are incoming and outgoing from their systems so as to create trending reports and to project when systems will become overloaded. Trending and analysis of email communications make it easier for administrators to request additional resources from their IT departments in terms of bringing newer and larger systems online. It may be that those resources are physical in nature or that the newly requested resources are virtual resources. The point is that, without monitoring and managing their systems resource usage and having the corresponding reports to support their trend analysis, administrators will have a tougher time in asking for upgrades or more system resources.

Managing your email systems also involves the practice of archiving an organization’s email messages so that they can easily be recalled at a later date when needed.

Here are five benefits of Email Management:

1. Reduced Litigation Costs
   It is a given that companies and organizations should have some methodology for storing old email messages. An email archiving system should be able to captures every email, – along with their attachments – that comes into or out of an organization. A complete archiving solution would also include some capacity for scanning and indexing of email messages. Indexes should, at the very least, be based on: who the sender is, who is the recipient, the message content, attachments, metadata, etc. and classified according to results. Because all email is preserved in the archive in its original form (ensuring that no messages are tampered with, altered or deleted) for the entire retention period set by the company, there is no backup media restoration to contend with. Having a storage system that is easily searchable is one goal of an email archiving system. Another goal is being able to reproduce the original email messages on demand. Each of these goals will have long-term benefits by reducing the costs of litigation.
2. Increased Recovery Time
   Having every megabyte of data stored on backup servers is an important starting point for post-disaster recovery, but having a well-defined archiving system for email can help a business get back up and running much more quickly after a disaster occurs. Essentially, knowing where data came from (and thus, where it should be restored to), can be the difference between a calm recovery and a frantic one.
3. Reduced Exposure to Spam
   Having an automated technology in place that can easily identify and delete spam can be a great benefit to any organization. It can help to save the most important non-renewable resource that any company cannot lose. And that is Time. Organizations can save a lot of time that might otherwise be wasted on reading spam email messages by blocking spam before it ever reaches an end user’s inbox. Good anti-spam solutions can block email messages based on their addresses, subject lines and content. Look for solutions that can also block based on origin and on non-existent recipient addresses.
4. Reduced Exposure to Security Threats
   Everyone knows that viruses can severely impact an organization’s operations if their email servers are running in an exposed mode. When exposed servers are unprotected then viruses can and will attack. And once a server goes down it can have a domino effect on the rest of production. The result is that all departments within a company or organization will experience severe downtime and with downtime comes loss of money and services.
5. Reduced Compliance Costs
   There has been a number of regulatory bodies defining the compliance measures that organizations must follow for their respective industries. Compliance regulations govern many industries such as: financial services, manufacturing, health care and customer care. When companies stay in compliance with their respective regulatory agencies then the benefits can include:
   • More effective auditing practices.
   • Well-defined retention and disposal policies.
   • Identification of confidential and/or sensitive information.

5 Email Management Benefits

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Email has become a vital part of our lives, crucial in to business and the way we work in this new information age. With literally billions of email messages being sent every single day, it has become quite literally indispensable. Each business worker sends an average of 36 emails a day, and they receive as many as 74 in return. This huge volume brings into sharp focus issues of mailbox size, as well as the attachment size for files that go with the emails that we send and receive.

Specifically, I am considering the issue of email attachments from the perspective of businesses and their employees.

Most corporations, in order to try and balance storage capacity with backup and restore time, and data recovery, will place restrictions on the size of their users’ mailboxes. Companies will also restrict the size of an attachment that users can send via the corporate email server. Sometimes, companies will also place restrictions on the size of email attachments that can be received as well.

I recently came across an interesting bit of research in the UK by Virgin Media Business, which shows that these limitations that organizations place on attachment and mailbox size are actually holding back the country’s public sector with regards to efficiency.

In many cases, public sector workers are instead resorting to the use of public file sharing services to transmit company files and other sensitive information. Of course, this creates a huge problem with regard to corporate data security. The survey, which was completed by ten of the largest public sector organizations in the UK, came up with some very surprising and sometimes even disturbing results.

Interestingly though, it also showed that by relaxing the limitations on attachment and inbox size, increased productivity and a reduced security risk would result.

The survey found that a lot of the restrictions these organizations placed on employees were unnecessarily tight. As a result, productivity was being impacted and a lot of confidential data was being put at risk. The results also indicated that a great many staff were constantly attempting to find methods of circumventing the tight restrictions, as they were worried that important messages and/or attachments would not be received.

Focusing on the limitations placed on mailboxes, the survey showed that some 69% of workers were unable to send or receive email messages that are bigger than 10MB, while 89% were limited to 15 MB for sending and receiving mails.

On average, workers in the UK are restricted to sending messages no bigger than 12.5 MB in total, and they are also restricted to a mailbox size of just 140 MB, which is not that big at all when you consider those 74 messages we receive each day.

These tight restrictions that have been placed on UK workers mean that they are very often unable to send or share large documents and files with colleagues and/or clients. In order to get by this problem, workers are instead making use of public file sharing websites such as DropBox or YouSendIt in order to upload and share the files there. Another way round the problem is to simply use personal email accounts.

Now, while this stop gap approach may work for the time being, and many workers and even bosses seem to be quite comfortable with the practice, doing such a thing is incredibly risky. Sensitive company data can easily be put at risks when it is transmitted using these methods.

Moreover, as the trend is for businesses and their workers to need to share ever-larger files with their co-workers, mailbox and sending limitations have the potential to become a massive hindrance. In many cases, employees will experience errors with their emails because either the attachment they are trying to send exceeds the limit of the recipient’s mailbox, or because it is already full.

In my own organization, we too have similar network restrictions, which are in place to balance bandwidth management with data storage, while maintaining a backup and restore time that is acceptable.

Currently, the restrictions in our office are that attachments can go up to a maximum 20 MB, but there are no restrictions to what we can receive. Our mailbox size meanwhile, is restricted to 2 GB.

These restrictions are justified, based on the number of employees we have, and the current storage capacity we have available.

However, I wonder if this will always be the case? When I consider the temptations of my staff to make use of public file sharing services, I am sure that when it comes round to me evaluating our data storage capabilities again, I will seriously consider raising these numbers a bit.

So a few thoughts to leave you with. What is the maximum mailbox size of your organization, and what’s the maximum attachment size?

Instead of just arbitrarily setting them, you may want to consider if these limits are justified, or if they need to be increased.

The Tricky Question of Balancing Mailbox Size Limits

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Is your email inbox literally bursting at the seams every time you open it? If it is, then don’t you think that perhaps it’s time to get a little more organized? Having an overflowing email inbox is the main cause of your email client slowing down, and it also means you waste time not being able to find crucial emails in a hurry.

I understand it might seem like a daunting task to get yourself organized, but it’s really not so difficult when you know how. The first step on the road towards organization is cleaning up your inbox, followed by some intelligent archiving of your emails. In this post I’m going to outline my simple Microsoft Outlook system for keeping my emails tidy, and I’ll also throw in some tips on how you can archive your older emails too. And even if you use another email client instead of Outlook, you can probably apply these tips anyway.

The most important tool that Outlook has is the AutoArchive feature. It allows you to do all kinds of things, including directing where archived data should go and specifying how old items need to be before they are archived.

1 – Globally Configuring AutoArchive

Setting up AutoArchive is a very easy process. Go to Tools > Options > Other > AutoArchive, and then choose the settings that work best for you. My personal preference is for a weekly cleanup, and to be informed when it’s about to do so. Another thing I like is to collect all of my archived data into just one archive folder (Archive.pst), and then as the year progresses I will manually move the old data to monthly archives. These are the settings I recommend for easy organization:

• Turn on – AutoArchive every week
• Turn on – AutoArchive prompts
• Turn off – expired item deletion when AutoArchiving
• Set Archive.pst as default archive file

2 – Setting AutoArchive Properties for Individual Folders

If you want to set the properties for your individual folders, do this:

Select the folder > Right Click > Properties > AutoArchive and then choose the settings you want. Don’t forget to repeat this for each folder that you wish to archive.

Recommended settings:

• Turn on – Clean items more than 1 month old
• Turn on – Move old items to default archive folder

3 – Manually Move Archived Files to Monthly Folders

This should be done each month, in order to have a nice organized monthly record of all your emails, just like mine. To do so, you need to create a new folder each month, something like “Archive 2010 December n.pst”.

By doing this, your archived files will be nicely organized when you come to view them all in Windows Explorer or the File Open box. Creating a new PST file is very easy, simply follow these steps:

Select File > Personal Folders File (.pst) > Choose a folder > Enter the name > Click Create. Make sure that the descriptions you use each month are consistent, so that Windows will file them in a nice, organized way. As for the other options, I just leave them all set as default. You should now be able to see the new PST folder listed in your Folder List or Outlook bar, and it will contain only one folder – Deleted Items.

4 – Copy Data Before You Move It

It is strongly recommended that you copy your data before you attempt to move it. Once you have successfully copied the data, you can then delete it from its source. You need to do this because copying or moving files is very resource-consuming, and will slow everything else on your computer down. Should you get the “Low Resources” message flashing up on your screen, there’s a good chance that something will go wrong with the operation and you could lose data. So always make a copy first.

5 – Tidying Up Your Monthly Archives

Once a new month begins and there is no more data for that month coming in, you can tidy everything up before dumping it into your new PST folder for the past month. You may or may not want to take out any old attachments, and you should also check that no records are saved in the Deleted Items folder.

You can open an archival PST file by selecting File > Open > Personal Folders File (.pst) > Choose the file you need > Click OK. Note that you only have to open these archival PST files when you are moving data into them.

When you want to close a PST, simply right click it on your Outlook folder list and select the “Close” option.

6 – Compacting Your PST Files

Doing this will not only leave everything nice and tidy, but it will save a load of space on your hard drive too, so it’s always a good idea. First of all, you need to close any applications you have running, including the Task Scheduler. Now, right click on the PST you wish to condense > click Advanced > Compact Now. This may take a while, even several minutes depending on how big the file is, but whatever you do, do not interrupt the process. Once it’s finished, clear all dialogs and finally close the folder.

7 – Don’t Let Your Archive.pst Get too Big!

You should routinely check your archive.pst folder (before each monthly archive) to make sure it doesn’t get too unmanageable. My personal rule is to compact it when it gets too big, but if it’s over 80MB then you should carry out some manual pruning first, because the compacting operation is somewhat untrustworthy.

7 Tips For Managing Outlook Email Archives

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

With so many businesses still trying to figure out how to leverage social media in the workplace, email continues to be the primary method of communication among employees. Whether they are communicating with co-workers, managers, customers or distributors email still reigns supreme. In fact, 94 percent of all American Internet users send or read email every day according to the Pew Research Center. In the workplace it is estimated that workers spend 41 percent of their day handling email according to the Radicati Group.

While email is still a primary means of communication among people in the workplace, many businesses fail to put in place a policy that governs how employees use email while they are on the clock. Business owners or IT managers tend to overlook laws and regulations that dictate how email should be used and stored. In small-medium sized businesses there is less of a perceived need for a email policy because employers sometimes don’t see the need to regulate things such as email and Internet use. Unfortunately this can land them in legal trouble.

Current laws state that employers can be held legally liable for the content of email sent from computers owned by the company. Furthermore, failing to retain emails sent by employees can also put businesses out of compliance for Sarbanes-Oxley and other regulations.

To protect your business from legal troubles you can either abolish email altogether, or govern how your employees use this tool in the workplace with a documented policy on email usage.

Since the latter is much more practical, let’s look at five things that your email policy needs to address:

1. Personal use of the email system. Some businesses allow employees to use company email for personal communication. Some strictly forbid it. Others take a hybrid approach, allowing personal use to take place during non-work hours granted the emails sent and received abide by other policies. Whichever route you take, make sure that it is clearly spelled out in your policy in a way that cannot be misconstrued.
2. Rules governing what can and cannot be sent over the company email system. Email can be used to share files, multimedia, pictures, etc. While any IT department would most certainly want to keep large attachments to a minimum to conserve bandwidth and storage space, this usually isn’t what causes most of the problems. Obviously it is necessary for your email policy should explain what is inappropriate to send using the company email system. Make sure to cover the distribution of any offensive, or disruptive messages, including messages containing offensive comments about race, gender, age, sexual orientation, pornography, religious or political beliefs, national origin or disability.
3. Email retention policies. If your company is required to comply with Sarbanes-Oxley then you have an obligation to make sure that records, including emails, are retained for a certain period of time. You also have an obligation to inform employees that emails will be archived and how long they will be retained for. Even if you are not required by law, keeping an archive of emails can help your company fight a lawsuit or investigate issues dealing with employees. Make sure this is a part of your email policy and follow up with your IT staff with a records audit from time to time.
4. Email monitoring. As the owner of your email system you have the right to monitor employee email messages at any time but you do need to inform your employees of this. Explain to them that any messages sent, or received, using company equipment are subject to being viewed even if the employee considers them to be of personal nature.  Having this policy in place protects you should a situation ever arise where you need to monitor an employee’s email and it helps curb inappropriate use of the email system but it is rather sensitive so you should check with your company’s lawyer on how to word this properly.
5. Best practices for email usage. You should also use this section to explain expectations for email protocol when it comes to writing and addressing messages. An email sent out can be the first impression a potential client or partner gets of your company and you want it to look professional. For example, some basic email etiquette rules include not writing emails in all capitals, enabling spell checking, including a signature that conforms to your company format, using proper grammar and punctuation.

Once you have drafted your email policy it is important to understand that if a policy is put in place but then not enforced cannot be later relied upon to discipline an employee who violates the policy. So while creating a reasonable email policy is important, enforcing it is necessary as well. Don’t put anything in writing that you do not plan on enforcing later.

Five Things Your Email Policy Needs to Have

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The fruits of a partnership announced last year by HP and Microsoft have finally ripened with the announcement of a new series of application appliances aimed at simplifying the deployment of critical business software programs, including Exchange 2010.

The Exchange appliance, the HP E5000 Messaging System, will be available in March starting at $36,000, plus the cost of a software license. It’s designed to meet the design goals of Exchange 2010–including the creation of low-cost large mailboxes that can be scaled quickly to meet growing data demands and are available 24 hours a day, seven days a week–and to reduce the complexity of deploying and optimizing storage for critical business messaging.

With the new appliance, an organization can cash in, with a minimum of pain, on Exchange 2010 benefits, such as boosting user productivity by removing archival functions from the desktop with the elimination of *.pst files, improving performance by adopting new IO patterns that reduce IOPS requirements by 85 percent and decrease storage demands and costs with built-in replication for direct attached storage.

According to HP, in the next 12 months, more than a third of all IT organizations will be upgrading to Exchange 2010 to take advantage of those benefits. When doing so, those enterprises will be facing some hard questions. For example, how should they configure their server? What type of storage should be used? How much network bandwidth will be enough, and should they virtualize or not?

Those questions and others can be easily addressed by the new messaging appliance, HP maintains. It claims the new box can “radically simplify” the delivery of Exchange 2010′s innovations to an organization and because it’s optimized for the software, it can give an outfit everything it needs to streamline deployment, ensure high performance and availability and keep the total cost of ownership for the deployment attractive.

When designing the E5000 system, the HP design team had three goals, according to Dean Steadman, the company’s worldwide product manager focusing on unified storage solutions for Microsoft applications. It wanted the product to be complete, simple and agile.

• Complete. It had to address highly available servers, storage, networking, Windows licensing, support services and Exchange best practices. For example, it addresses high availability by combining HP hardware redundancy with Exchange’s Database Availability Group features. “E5000 customers can sleep at night knowing that their high availability, performance tuning and capacity planning was designed by the industry experts,” Steadman boasted.
• Simple. As much of the system as possible is pre-configured at the factory. Microsoft Windows Server 2008 R2 Enterprise Edition is preloaded on the hardware and all its storage formatted and configured. Those moves alone should save administrators a day’s worth of deployment time, according to Steadman. What’s more, the system contains custom tools to further speed up deployment and quickly integrate the system into an existing Windows infrastructure. In addition, the system plays nicely with management suites like HP SIM and Microsoft System Center.
• Agile. The system is built to accommodate the requirements for a variety of architectures and to adjust to changing business requirements. “We knew that a one size fits all approach wouldn’t work for Exchange,” Steadman said. That’s why the system is designed to work in a single site or standalone deployment, as well as in organizations with multiple data centers or branch offices. To boost the availability of a deployment or address a growing need for mailboxes, up to eight E5000′s can be clustered together. Moreover, adding storage to the hardware is as simple as plugging in an additional disk-shelf.

Steadman acknowledged that HP’s announcement was a little light on hardware specifics. “That’s because the E5000 Messaging System will be available in March and we’re keeping some of the cool geeky details to ourselves for just a bit longer,” he explained.

When HP and Microsoft announced their collaborative agreement a year ago, the companies pledged to jointly spend $250 million to produce appliances that combined technologies from both companies. The goal of the combine was to deliver hardware that was pre-installed and pre-configured to optimize it for maximum performance and smooth deployment.

“Customers are looking to significantly reduce implementation and decision times,” Mark Potter, HP senior vice president and general manager for industry standard servers and software said in a statement. “With our converged application appliances, HP and Microsoft enable customers to shorten the time required to deliver information, which helps to reduce risk and cost.”

New Exchange hardware released by HP-Microsoft

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators