Last month, I posted an article titled “What’s a good mailbox size?” where I discussed many of the considerations an architect must take into account when sizing storage for a new email system. In that post, I also set up a survey where I asked readers to answer six short questions about what they think makes a good size for a mailbox, as well as what future plans they might have for system growth. As promised in last month’s post, I am sharing the results of the survey now.

While the total number of respondents was somewhat less than I hoped for, the quality of those responses from survey participants is greatly appreciated. No one skipped any of the first four questions; the last two were “if” type and should have been skipped if not applicable. Thanks to all those who took the time to share their answers. I will share each question and the responses by percentage below.

1. What email system are you running now?

The vast majority of respondents are running Exchange, with a smattering of Notes, but nothing else apparently. While the dominance of Exchange was no surprise, that not a single Groupwise or Sendmail admin responded makes me wonder whether those products are dying out, or if their admins simply are too busy to deal with surveys.

2. What is the standard mailbox size (in MB) for regular users?

Almost half of those responding give standard users mailboxes less than half a gig. Those results shocked me on their own, but wait until you read question four!

3. What is the standard mailbox size (in MB) for special users (IT, executive, HR, or any other group that needs a larger mailbox)?

It looks like half of the admins who responded draw no distinction between regular users and special users. How egalitarian of you. We do see an uptick in the sizes though, with the other half of you giving special users 5 GB or more of storage space.

4. Is your current mailbox size adequate for the majority of users?

Okay, this is the answer that floored me. Over 90% of respondents feel their mailbox sizes are adequate. Considering how many provision regular users with less than half a Gigabyte, that is not at all what I would have expected. If you are one of those folks, please let us know in the comments how you do it. Do you have an aggressive deletion policy, an archiving solution, or do you just prohibit attachments? Inquiring minds want to know.

5. If you are considering a larger mailbox size for regular users, how big would you like that to be?

This is another response that did not come out like I expected. No one is looking for huge mailboxes (>25 Gigabytes) and most look like they would be happy with 10 GB or less. Storage vendors may weep to see this.

6. If you are considering a larger mailbox size for special users, how big would you like that to be?

Now we see an expected distinction, where special users will get much larger mailboxes. The designers of Exchange 2010 are smiling that so many of us share their vision.

So to summarise, the vast majority of regular users’ mailboxes are either in the 512MB range, or in the 1 to 5 GB range. In about half the cases, special users get a bump to 5 GB or larger. Most of us are happy with our mailbox sizes, but if we were going to increase them, it’s only the special users who’d really see a big change, and no one seems to want to go above 25 GB for mail.

Once again I’d like to thank those of you who participated in the survey for your time and the information you shared. I know it will be very useful to me, and I hope that other regular readers of TheEmailAdmin can also benefit from this.

Are there any other issues you’d like to see surveyed and discussed here? Any questions you’d love to see asked in such a large forum? If there are, leave a comment and if I get enough good ones, I will create another survey for the readers so we can see just how everyone else is doing it.

As it Turns Out, a Good Mailbox Size Is…

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

When looking at solutions on securing email, many people don’t take into consideration the type of business environment they work in. All too often, after spending a great amount of time and money, small to medium-sized enterprises find out that what works for a company the size of Bank of America doesn’t quite work for them.

To better help SMBs find solutions scaled to their needs when it comes to email security, I have compiled a list of 5 tips that address the risks and restraints that they face.

1. Get the right solution

Email security can come in any number of packages. Security solutions can be software based, deployed through an appliance or even in a hosted environment. Each type has a variety of advantages, but there may be some disadvantages based on your company size or industry so it is important that you weigh your options carefully.

It is also important to look to solutions that can provide the protection your company needs at a cost that works. Too many times people are under the impression that security appliances are seriously out of reach for most small to medium sized businesses. This isn’t the case. There are many solutions that organizations find affordable and feature rich.

Make content filtering a standard practice

Content filtering needs to be a two way street. Of course, you want to filter out inappropriate content from being received by employees and certain types of attachments need to be blocked to prevent the spread of malware and expose vulnerabilities. However how often do you consider filtering what leaves your business via email?

Many industries nowadays are highly regulated and sending sensitive, or even financial, information out through email can not only bring compliance issues to your business, but it may also give competitors an edge. Filtering what users send out can be just as important as filtering what they receive when it comes to securing your company’s email.

Practice recovery as well as backup and archiving

Do you brush just half of your teeth? Then why would you only test half of your backup and recovery solution? Many companies find out, only when it is too late, that their backup and recovery solution was not configured properly or that there is some sort of problem.

This can be alleviated by regularly testing the recovery portion of your backup. By simply setting up a server (or virtual server) on which you can replicate your email system you can frequently test the validity of your backups in a way that will not disrupt your current email process.

Create fair policies that management will enforce

One of the biggest mistakes that SMBs make when it comes to email security is to take an overly aggressive approach. Without the manpower and resources to fine tune security policies, it becomes easier to just restrict anything that could be a perceived threat. This becomes especially true in small IT departments because they are tasked with so many other responsibilities.

When creating policies, it is important to bring other departments to the table so that these policies do not restrict anyone from getting their work done efficiently and effectively. Involving others at the management level also helps them better understand the reasons behind email policies and the ramifications for not following them. Gaining this support will help when it comes time to enforce these policies and discipline those who violate them.

Educate your staff

When it comes to security, it is a common misconception that bigger, state of the art, expensive solutions provide the best protection. Even though this isn’t true, SMBs often feel that they are at a disadvantage when it comes to email security because they cannot afford to deploy such solutions.

What many SMBs don’t see is that they have a distinct advantage over their larger counterparts when it comes to educating end users. When you have a smaller number of employees to train you have the advantage of being able to spend more time with them to make sure they understand the material you are delivering. You also have the opportunity to be readily available to answer questions or address any concerns or issues that your users may have.

Developing a solid training series for email security can also help free up time for IT departments that find themselves tasked with too many responsibilities because users who are informed and educated require less oversight and less attention.

5 Essential Tips for SMB Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Advanced persistent threats make email security a necessity

Most email administrators consider security to be a large part of what they do. With so many laws and regulations governing the storage, discovery and retrieval of email messages, security has become a second job to many.

Unfortunately, many administrators either forget, or simply aren’t aware, that securing email requires much more effort than hardening the email servers against attack. In order to fully protect your organization’s email and their contents the mailbox also needs to be defended. Especially when you consider how popular Advanced Persistent Threats are becoming with large cyber crime syndicates who use email not only as a way to harvest sensitive information, but also as a method of attack through phishing and social engineering.

By implementing the following tips into your security plan you can help protect against these, and the many other threats that your organization may face:

Create email policies to regulate the communication of confidential information

Email communication has become second nature in the workplace. It is quick, easy and it gives us a record of our conversation so we can refer back to any information at a later date. However, if the conversation contains sensitive information like login credentials, financials, personal information, and the like, then it can be extremely valuable to anyone who may harvest those emails.

By simply setting up, and enforcing, policies that restrict certain information from being sent via email you can mitigate the damage done if emails are exposed. At the very least, your policy should state that user logins and passwords (and/or PINs) not be communicated via email.

Teach users to encrypt their messages

One of the best analogies I have seen to describe the need for encrypting emails is one that compares email to a postcard. Basically, anyone who comes across it can read the contents if they want. This can be stopped by encrypting emails to prevent eavesdropping.

Encryption is a hard thing for many people. It requires additional steps, training and, in some cases, third-party software (such as PGP) yet it is really the only way to keep your messages private in transit.

Encryption shouldn’t be limited to sending and receiving messages alone. Any email that is stored on a hard drive (think personal folders), a network drive, backup servers or archive systems should also be protected from any prying eyes.

Get rid of old email

A long time ago, storage space was a precious resource. Nowadays inboxes can be easily scaled to hold enormous amounts of data. Unfortunately that provides a greater possibility that an attacker will find something valuable.

Email should be moved, or deleted, when their life cycle is up. Make sure to check with any regulations regarding discovery and archiving before getting rid of the old stuff, but if you combine this with encryption you will be taking great strides to protect older emails.

Practice good network security habits

Make sure that desktops are continually scanned for malware that could possibly expose email login credentials, filter Internet content to protect against malicious websites, understand how to properly use a firewall and update server and client software as needed.

In addition to the employing technology to help secure your email systems you should also consider human factors as well. One of the ways that people first discover that their systems have been compromised is by noticing an anomaly. Be on the lookout for log-ins that just don’t seem right whether it be the IP address, the time of day or even the length of time.

This can be one of the most tedious tasks to undertake when it comes to security but it is by far the most important.

Put the right solutions in place

In many small and medium-sized enterprises, the email administrator alone cannot be as vigilant as he or she would like. Even in organizations where there is team of professionals dedicated to security use necessary security tools to help them do their jobs. Smaller companies need to understand this as well.

By employing technologies that help manage email, backup and recovery, archiving and security, you are plugging the little holes that provide that chink in the armor most attackers are looking for.

No one said that email security is going to be an easy task, but it is one that cannot be ignored just because it’s too hard or it costs too much.

Tips for Better Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

In just one week Google, the International Monetary Fund and Citigroup have all made headlines as a result of email associated with them being under attack. The reason we continue to see companies make the news as a result of email attacks is that email security is sometimes ignored when it comes to training users properly and making good decisions. In some cases, having the latest and greatest when it comes to security tools even creates a false sense of security that causes us, and our users, to overlook the little things. A multi-layered defense that has been properly configured with all the best technology can be rendered useless if the little things are forgotten.

This list displays some of the most common mistakes that are made when it comes to email security and a brief description of what you can do to prevent them.

Leaky emails

There are many times when sensitive information is passed along via email. If everything is encrypted properly you, and your users, often assume that it will only be seen by the appropriate people. Unfortunately this isn’t always the case. Too many times a recipient may answer an email with sensitive information and hit the reply all button without checking to see who will be receiving the email.

The fix: Put a policy in place that addresses sensitive emails and reply to emails. However a policy alone isn’t enough. Make users aware of the policy through training and keep a record that all users were trained/informed of the policy and repercussions of not adhering to it.

Trusting others

When we receive emails from family, friends and business colleagues we often blindly open them without much concern. Especially if they are contacts we communicate with on a regular basis. However malware can easily be spread through emails by attachment or embedded code and links.

The fix: HTML in emails should be blocked if this is a concern, as should the ability for your users to receive attachments that are scripts or executable files.

Passwords that are easy to guess

Remember when Sarah Palin’s personal email account was breached? It was because her password was easy to guess using information the attacker found on her Wikipedia page. Companies often list information on corporate sites that provide attackers enough information to guess passwords as well.

The fix: Enforce strong passwords or password phrases for all users. Also, make sure that people don’t give up information that may be used to guess their passwords when providing bios.

Ignoring malware protection on the desktop

While scanning all emails for malware needs to be done, the desktop should not be ignored. And all too often it is. Malware definitions are outdated, software is not configured to run properly or protection is completely left to the user.

Even if you have a policy that enforces strong passwords, a keystroke logger can easily give up even the most complex password combination.

The fix: Email administrators should work closely with IT security to make sure that the desktop and network security isn’t lax so passwords are tougher to expose.

Failing to check on backups

Some companies and industries are required, by law, to back up and archive emails for a set period of time. Others are not required to do so. Regardless of the laws, every person and company should be in the practice of backing up emails. Emails often provide important records and information that could be lost.

But what happens if you need to restore your emails and find that something went wrong? Maybe the backup was incorrectly configured or the backup location was insecure. In any event, the inability to restore emails from a backup can render the entire solution useless.

The fix: Frequently test the ability of your backup solution, and staff, to restore emails.

These five tips may seem basic and simple. But that is the point. Working in IT we often gravitate towards the more complex issues and ignore simple techniques and solutions until it is too late. By taking the time to do the little things when it comes to security, we build an even stronger foundation for all the bells, whistles and technologies that really impress us and our bosses.

5 Simple Mistakes When it Comes to Email Security

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Developments in cloud based computing have shown quite a bit of excitement and promise, especially when it comes to small to medium sized businesses. Those who evangelize the cloud will often cite the many benefits of moving to a cloud based email service. The litany of favorable reasons to examine moving email services off site that are oft quoted fall into line with the reasons used to move to any new technology:

• Ease of scalability
• Ease of software updates
• Email access anywhere
• Better disaster recovery
• Ease of implementation
• And of course, reduced costs

So when a vendor, or even someone in your own organization, throw these at management looking to save money and increase productivity then it seems like the question moves from why should we move to the cloud? to why has it taken us so long to move our email to the cloud?

Is it really that easy?

Cloud based email services make a whole lot of sense for many organizations. By doing a bit of research, you are certain to find at least one case study on how moving your email to the cloud helped someone in your specific industry. Yet even with good reasons and plenty of research to support this decision, nothing should be done without considering every angle because over the years if we have learned one thing, when it comes to IT nothing is risk-free.

So what does an interested SMB need to consider when all the arrows point to moving to the cloud? Let’s take a look.

1. Control

When your email resides on servers that are housed at your location, you are responsible for configuring the software, maintaining the hardware, updating and patching the server(s), cooling the room, etc. But you also have complete control over your email and backups. Moving to the cloud means you are giving up control and possibly ownership. This lack of control can lead to real world problems. For instance, if your organization has a one year deletion policy, is your cloud provider able to adhere to that? Conversely, if you have a no delete policy can this be achieved as well?

A rarer occurrence, but one that has much harsher repercussions is the event that an investigation needs to take place. Will emails be available for forensics when needed? If so, will there be any issues with the chain of custody and proving that the investigation was tamper proof?

2. Availability

Unless you have been living under a rock you are well aware of the attacks against Gmail over the recent months. The decision to move email services to a cloud provider should always be based on how well the provider can ensure that mail servers will deliver an acceptable percentage of uptime. Of course it’s one thing to say that you guarantee 99.9999 percent uptime and quite another to deliver so when a cloud provider makes a claim regarding availability, make sure your IT team speaks with the sales engineers, not just the salesperson, to see what exactly is in place to eliminate things like interruptions and denial of service attacks.

3. Security and Spam Protection

One of the biggest draws to the cloud for email is the fact that the provider will take care of security and anti-spam. Again, this is something that you are entrusting to the provider and giving up control over. If you are unhappy with the amount of spam that gets by the filters, or if the false positive rate is higher than an acceptable rate you can’t simply switch to a different solution.

This should be at the forefront of any discussions you have with potential email service providers. Find out what solutions they have in place and research them just as if you were buying the protection for your own servers.

4. Cost

Of course cost is always the number one reason SMBs look to the cloud. It is hard to find anyone who will say that a cloud based solution isn’t less expensive in the long run than running, securing and maintaining your own email servers. However the numbers may not always equal the level of service you expect. Costs may not always be transparent. A cloud provider may charge extra for business grade anti-spam protection. Perimeter security or virus scanning may also require additional costs. Finally, storage is never a one size fits all solution so this will always present itself as a variable.

The cloud is definitely a solution worth looking into for a number of reasons, however as a smart business move it would be equally prudent to look at all of the considerations as well prior to signing any type of contract.

4 Considerations for Cloud Based Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Despite the widespread use of instant messaging and the recent rise in the popularity of social networking tools, there is little doubt that the humble email remains the perennial form of digital communication for businesses today.  Its widespread use does imply the presence of the invariable blooper however, or of carelessly written messages that could come back to haunt you.  I call such situations the “Oops!” moment.

I’ve highlighted some of the most common ones below, and it is my hope that it can led to users exercising more caution before clicking on the “Send” button.  And yes, do feel free to chip in with a comment or two about similar mistakes that you may have witnessed, or have committed yourself.

1. Hacked email accounts

I wrote recently that it is never good news to have any server compromised by hackers or corporate espionage.  Yet few IT managers or administrators would spend time mulling over the repercussions of a hacked Exchange Server account.  As you can imagine, the most obvious consequence here would be the pilfering of critical information email correspondences, which could include trade secrets and other highly confidential data.

Moreover, even non-proprietary information could be a cause for embarrassment, as evidenced when hacker group Anonymous broke into HBGary Federal’s site and made away with 71,000 emails.  Borderline illegal suggestions made by the company’s then chief executive Aaron Barr suddenly became public knowledge when all his emails were posted online, culminating in his eventual resignation.

2. Subpoena or legal discovery

A court subpoena can be issued for anything ranging from criminal cases to civil lawsuits, and is typically used to compel the production of evidence from the accused.  Where it pertains to email messages, this could mean that all the correspondences ever received or sent across a specific time frame could be subjected to detailed analysis by lawyers combing for evidence to support their case.  It is hence important to understand that even simple nuances or voicing of intent could be construed as incriminating evidence or serve to significantly weaken one’s case.  Unlike a hacked account though, details in personally embarrassing emails can usually be counted on to stay under wraps.

3. Sending to the wrong person

I recently received an email from a PR folk that is different from the dozens of the press releases and pitches that I receive on a daily basis.  This came from someone whom I have exchanged correspondence with in the past, and was apparently sent in haste.  Thanks to the “autocomplete” feature in Microsoft Outlook, my name was added given its similarity to one of the recipients who was also named “Paul” – by mistake.  Ironically, when an email revolves around a person, I have found that there is actually an increased likelihood of unconsciously typing the person’s names in the “To:” fields. In addition, my guess is that most people have sent out the wrong file attachments at some point or other in their lives – in fact, I just did it last week.

4. Broadcasting instead of sending to a specific person

A relatively frequent occurrence in some larger corporations would be the presence of employees sending out email messages addressed to the entire company.  Due to the same “autocomplete” features mentioned in the previous section, I have seen my fair share of emails that were obviously intended for an individual, but inadvertently sent to the entire company instead.  Another common mistake would be hitting the “Reply all” button on a company-wide or department-wide email message and proceeding to either craft a private reply, or asking a question not intended for a larger audience.

5. Forgetting to redact before forwarding

Somewhat related to the previous scenario, I have also received emails containing information that were clearly not meant for my eyes.  A common practice in many enterprises, the idea behind forwarding an email chain is to help colleagues or partners to quickly get up to speed without having to revisit the rationale behind a particular decision.  As you can imagine, mistakes involving information that should have been redacted but were not is a scenario that has taken place before.  Further compounding the situation are certain email platforms such as the BlackBerry smartphone in which forwarded emails cannot be edited.

5 Most Common ‘Oops!’ Moments with Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The benefits associated with archiving Microsoft Exchange email and associated data, creates many cost effective solutions. Archiving facilitates government regulatory or civil litigation searches for ediscovery requests. It also allows for more complete archive journaling, and provides storage benefits for both mailbox growth and the various storage devices that can be utilized.

Although lowering storage reduction costs is a common denominator for email archiving, compliance requirements are moving more companies to implementing archiving strategies. Depending on the motivation factors, cost savings on storage are subject to interpretation by different people.  For some people, compressing email could reduce licensing, as well as storage hardware costs.  For others it may mean creating a mailbox for end users, which has virtually unlimited space.

The majority of Microsoft Exchange Server archiving solutions have some form of compression that reduces the size of overall archived emails.  For an Exchange email administrator, an unlimited space mailbox really just means eliminating the user responsibility of being concerned about having to archive their email. This allows mailboxes to grow as long as there is more than adequate disk space real estate available to allow seamless expansion.  The limitations of unlimited mailboxes are usually determined by the archiving options provided by the archiving solution. According to the Ferris Research blog, Microsoft recommends against using stubbing techniques.  Microsoft further recommends using 3rd party email archiving solutions that allow configurations to move email messages completely out of the mailbox without leaving stubbing foot prints  inside the mailbox.

6 different stubbing techniques are provided below only for informational purposes, but are not best practices recommended by Microsoft.

1. Substitute body and attachment with a plain text Stub
2. Substitute body attachment with HTML Stub
3. Maintain plain text body only with deleted attachment
4. Maintain HTML message body only, with deleted attachment
5. Maintain HTML body and image with deleted attachment
6. Message attachment residing in the archives

Will your current archiving procedures or planned archiving solution meet all future email storage requirements?

Archive Stubbing Techniques Not Recommended

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The Florida Legislature recently suffered some embarrassment as a result of its lack of an email retention policy – or, more accurately, the inadequacy of its retention policy. Background: former House Speaker accepted a $110,000 per year position with the Northwest Florida State College after, supposedly, being one of the driving forces behind the state funding directed to the College while Speaker. The press caught wind of a possible scandal and attempted to obtain copies of emails between Sansom and the College. And that’s when it emerged that the Legislature had no real form of email retention policy: sent items were routinely purged after 30 days and deleted items were routinely purged after 90 days.

It’s time for the Florida House and Senate to join the 21st century. If lawmakers are going to use 21st-century technologies to communicate with the public and one another, they should take steps to ensure these communications are preserved — and accessible to the public,  read the editorial in TCPalm.

So, why weren’t the Legislature hanging onto their emails for longer? Because of storage constraints, seemingly. Sorry, but that’s a really lame excuse. Storage is dirt cheap and the price point of archiving solutions puts them well within reach of even smaller businesses. According to the Panama City News Herald:

The average House member uses about 569 megabytes of server space each month, with the average senator using about 700 megabytes, the documents said. Both are less than the 1 gigabyte of space available on an iPod Shuffle, Apple Inc.’s smallest portable music player, which holds about 500 songs. A free e-mail account from Google Inc. gives each user about 7,300 megabytes of space.

The House spends about $124,000 yearly on maintaining the system, according to Legislature information.

For that much, the House could also archive e-mail for three years, said Forrester Research analyst Chris Voce, who studies IT infrastructure. Upkeep for the House’s 750 users that would retain e-mails for three years should cost about $108,000 annually, Voce said.

Exactly. Retaining your email is actually pretty cheap these days – and the cost of retaining it can certainly be less than the cost of losing it.

Of course, storage constraints are not the only reason that some organizations choose not to retain their email. Some think that they do not need to (reading the posts here should set them straight on that). Others realize that they should be retaining but delay implemeting a solution because they become bogged down with details. In a recent post, Carl E. Reid said:

“Before the email archiving software selection process starts or any implementation meetings begin, something more important must occur first.  Quite a few questions regarding email retention policy must be answered.  This is a difficult, but very necessary process.”

I don’t completely agree with Carl on that. If you’re not currently archiving your email, you need to be – and you need to be doing so as soon as possible. It’s as simple as that. And what this means is that you shouldn’t delay implementing a solution because you haven’t clearly and completely defined your retention policies. Yup, there’s certainly some basics that you need to sort out before choosing a solution (you need one that matches your needs), but you do not need to nail down every last detail.

Define your needs. Choose a solution that will meet those needs. Get it up and running as soon as possible. And then work on fine tuning it.

Here Today, Gone in 30 Days or The Need of Email Archiving

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The folks over at Techdirt have posted an interesting article about the UK’s new email law that requires ISPs to save every single email sent in the UK for a period of one year. There are several problems with that:

There’s been an ongoing push around the world by law enforcement to require ISPs to retain certain types of data, in case it comes in handy later for criminal investigations. Of course, these demands come from the wishful thinking department. The cost associated with such data retention is tremendous, and all it does is create a huge mass of data — often making it more difficult to find the useful information. In the UK, they’ve put in place new data retention laws that will require ISPs to retain records on every email sent or received in the UK for a year. It’s not the contents of the email — but just the data on that email. That, alone, though, seems like a pretty big violation of privacy, and people are starting to point that out.

It will be interesting to see how this plays out as it doesn’t look like the law can reasonably or even legally be enforced as it stands now.

New UK Email Law Spurs Privacy Concerns

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

What’s up with all these government people ignoring good email archiving protocol? It seems that several officials lately, who are presumably well educated and should know better, are coming out with their own brand of wisdom which says they should be allowed to delete emails after way too short a time.

ITWorld’s James Gaskin’s article, “E-mail archiving stupidity“, gets right to the point and pulls no punches. Gaskin reports that Dallas County officials want to delete email after 90 days, and asks, “have none of them heard of all the new regulations about e-mail archiving?” He also notes that the governor of Texas recently got the state’s Attorney General to issue a ruling that he could delete his own e-mails after one week. I think the governor needs to add a gallon or two to his ten-gallon hat, because the one he’s got on is obviously cutting off circulation to his brain. Delete e-mails after a week? Are you kidding me? Why on earth would anybody advocate such a thing, especially for a government official? This is sheer nonsense, and very probably against the law.

The email deletion policy has naturally got a lot of people down in the “Big D” concerned, and a recent article in the Dallas Morning News highlights some of the criticism. Presently, according to the article, Dallas County stores all of its email on computer tapes at an off-site warehouse, and complains that maintaining it is expensive and impractical, and the best way to save money is to automatically delete emails after 90 days. The Dallas officials are obviously a little behind the times. First of all, they are right to say that using computer tape storage is expensive and impractical. But here’s a news flash for these rocket scientists down there: There are alternatives to computer tape storage. Lots of them, which are cheaper and more efficient, and a whole lot easier to search and restore. Save your tape storage for use in migrating your oldest archives, but using it for recent storage is completely unnecessary, massively inefficient, and generally bad policy. 

The Dallas proposal also specifies that employees can save emails from the 90-day deletion by individually archiving them to meet state mandates for retention, but do you really want to put this much authority in the hands of thousands of individual employees? This needs to be governed by a uniform policy, and carried out on an automated basis, and not left to the discretion of individuals. The risk of the improper deletion of an email that should have been saved is just too great. Under such a policy, it’s only a matter of time before an email that is needed turns up missing, and then who is going to take the blame? Heads will roll, but it won’t be the mayor, the governor or the head of IT. It will be some poor, underpaid clerk in the records department, who was improperly trained to begin with, and had no idea that the email in question should have been retained.

Email Archiving Nonsense in the Big D

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

According to Christopher S. Rugaber of The Associated Press, companies that help businesses track and search their e-mails and other electronic data are experiencing a surge of interest in the wake of a 2006 federal rule changes that clarify requirements to produce such evidence in lawsuits.

Companies used to be focused on how they store information. Now they’re focusing on how to retrieve it.

The new rules require U.S. companies to keep better track of their employees’ emails, instant messages and other electronic documents in the event the companies are sued, legal experts say. They are part of amendments to federal rules governing civil litigation and were approved by the Supreme Court’s administrative arm in April after a five-year review.

Amendments to the Federal Rules of Civil Procedure (FRCP) PRIMER
The Federal Rules of Civil Procedure (FRCP) govern civil procedure in the United States district courts. New amendments to the Federal Rules of Civil Procedure address the discovery of electronically stored information. On April 12, 2006, the Supreme Court of the United States approved and forwarded these amendments to Congress. Certain revisions to the Federal Rules of Civil Procedure address the preservation and discovery of data in electronic media, also known as e-Discovery.

Electronic discovery (e-Discovery or ediscovery) refers to “any process in which electronic data is sought, located, secured and searched with the intent of using it as evidence in a civil or criminal legal case.”

In regards to ECM and ERM, the two rules to focus on are FRCP 26(b)(5) and FRCP 34(b). FCRP 26(b)5 deals with General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; and Claims of Privilege or Protection of Trial Preparation Materials. FRCP 34(b) focuses on the Production of Documents, Electronically Stored Information and Things. These amendments to FRCP address a common corporate problem: the volume of electronically stored information and its maintenance.

During an electronic discovery process, all types of data serve as evidence such as text, images, calendar files, databases, spreadsheets, audio files, animation, websites and computer programs. Because of lax corporate management, email is often the most valuable source of evidence in civil or criminal litigation.

“All organizations should proactively prepare for the amendments,” warns AIIM President John Mancini. “The new rules will require businesses to have continuous, ready access to, and control of, all electronically stored information that may be relevant to the discovery phase of the litigation process.”

U.S. Rules favour Email Storage and Retrieval

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

I like the new Google phone, which was made available by T-Mobile last week. Long-term, it’s going to be a mighty competitor to the Apple iPhone. The presence of smartphones in general, whether they are from Google, Apple, RIM, or anybody else, has made mobile email part of the enterprise. It has become commonplace for executives, sales reps, and other corporate road warriors to check and send company email while at lunch, on the road, or at a kid’s ballet recital–and there’s no doubt that this has been a tremendous boon for productivity. But what about email security and archiving? The folks in the back office handling email security and trying to stay compliant with archiving policies and regulations aren’t so happy about it.

Without a formal procedure in place, the path of least resistance is for road warriors to simply use their smartphones with free public email accounts, such as Hotmail or Gmail, but this is a corporate no-no (as we learned in the case of Ms. Palin) since it completely bypasses all corporate (or government agency, as the case may be) policies and precautions.

But the genie is out of the bottle, and nobody wants to give up the ability to check and send email while standing in line at Starbuck’s waiting for a cappuccino. Fortunately, they won’t have to. As far as the iPhone goes, I think it’s overpriced and has far too many consumer-oriented gee-gaws on it to be useful in a corporate setting, but it does have an advantage over the Google phone at present for corporate use. The iPhone has a good interface with Microsoft Exchange, which makes it much more usable for corporate email than the Google phone. This of course, allows the security guys in the back room to breathe a little easier, impose the usual security precautions and spam/virus protection, and properly archive emails even if they originate from a mobile device.

In the coming months however, the Google phone may well become more useful in the corporate setting, simply because of its open scheme. Unlike Apple, it is a lot easier for third-party developers to create and market applications for the device–and it will be a simple matter to create an application that can link with corporate email. It’s only a matter of time before these applications start to surface, and the Google phone becomes more useful for corporate email.

Google phone faces some limitations on corporate email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

As if Troopergate weren’t enough, vice presidential candidate Sarah Palin is facing a new scandal. She’s now being accused of using her Yahoo email account to conduct official government business, and of doing so to avoid email compliancy and archive requirements, as well to avoid subpoenas related to the Troopergate scandal. But wait, there’s more.

Time Magazine is reporting that her email account was compromised by hackers. The Wikileaks website has published several screenshots of messages and other data hackers claim they got from one of two Yahoo accounts. The hacker group Anonymous, which is associated with the infamous message board 4Chan (known for the DoS style “pranks” they play on numerous websites) has taken responsibility for the attack.

The Secret Service requested copies of the hacked emails from the Associated Press, which refused, and the FBI is reportedly also launching an investigation. Stay tuned as it appears this is only the beginning of “Emailgate”.
 

Sarah Palin Possibly Facing Emailgate?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The best server hardware configuration is in place for SMTP mail routing. Back up building generators are available in the office building.  Uninterruptible power supplies, with UPS monitoring software, are connected to the email servers.  So brown outs, electrical spikes and blackouts are in place to maintain server functionality.  Top of the line archiving and back up software has been implemented.

Then that one time comes along. The CEO’s office or a senior manager makes a request to access an archived email that has an important document attached. The email or or attached document cannot be accessed.

One would think with all these safe guards in place data integrity should never be an issue. It’s a funny thing.  When mr. disaster comes along, he usually brings his very close cousin, Murphy’s law.

The point is nothing should replace the performance of data integrity check “fire drills”. Assuming all is well, without manually checking, could very well impact your career.  Server memory caching issues could occur.  Data might be resting on bad pits on the hard drive. Similar to a car, anything that moves will eventually break or malfunction.

With all the best software and hardware in place, an administrator should still go the extra mile to take the following measures:

1. Develop a schedule (i.e. monthly, quarterly) to randomly pull back up tapes or retrieve archive data.

2. Select 10 to 12 instances from different email accounts for testing restores.

3. Select small, medium and very large mail boxes to restore.

4. Document the results.

5. Based on results, take any corrective action required.

6. Stick to this schedule and don’t allow other tasks to interrupt doing data integrity checks.

An ounce of prevention insures you are in a better position, should some unforeseen circumstance prevent data from being retrieved.  Data integrity checks are much more proactive to provide indications of necessary preventive steps to take.

This avoids or minimizes the spotlight being on you, as the administrator, should the scenario above come into play.  Within organizations most people do not give much credence to back up or archive data, until they need it.  Then the spotlight is placed very strongly on the administrator to deliver, on demand.  Many a person’s career has teetered on these singular types of requests for data restores.  So do your homework.

Email Administrator Career Risk Management

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

A human resources and recruiting associate sent me an email with questions regarding email archiving procedures in companies.  Although not meant to give legal advice, sharing this should provide food for thought in how the role of email administrators is expanding.  Updating or developing procedures regarding access to email accounts is becoming a very hot issue.  Now is good time for the IT team to initiate meetings with other key departments.

We end up playing traffic cop to various types of requests for access to current and archived email.  This should provide food for thought in developing or modifying IT department procedures for processing requests for access to email accounts.

General standard practice is each employee only has access to their mail box and the email administrator(s), for troubleshooting purposes. Sometimes a manager or director may request to have access to all or some of their staff mail boxes. This is a rare exception.

Legal department – do the legal teams have full access to all firm email or only access to subpoena’s email/data? Access to email accounts is usually done by exception request. When a subpoena is presented to the law department, they contact the manager of the specific employee in question.  The department manager makes a request to the IT department. The law department can and has contacted the IT department directly for mail box access.

Who generates the subpoena’s data, onsite technology department  or an outside firm? The internal IT department is the lead area for providing access to each particular mail box, when it comes to legal matters or an internal company employee related issue.

Human Resources – do the HR teams have full access to all firm email, or only to email/data approved by legal in the event of an employee issue? HR does not have full access to all company email accounts.  Like any other department, the HR director can ask for access to their departmental staff boxes. HR directors usually cannot request access to other employee mail boxes in other departments.  Although a rare request, HR will go through legal for access to a particular mail box in another department.

Business department heads – do they see their team’s email? Although no firm procedures are usually in place, Department heads can have access to employee mail boxes, if a written request is provided.

Technology – if there is a local system how is the access to the data for support purposes handled?  Do all support engineers have access to the data from the back end (database) for support purposes or is there an approval process if there is a production problem? Only Email administrators have full access to email accounts.  A network support engineer would only have full access to email accounts, if that person is also an email administrator. No approval is required to go into a mail box, other than an email user saying “I have an email issue”.

Email Policy: Who Gets Legal Access?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

A new study commissioned by GFI Software revealed that a lack of education is responsible for lack of email archiving found in most U.K. businesses. Of the 408 IT managers surveyed, a whopping 51% admitted they hadn’t yet implemented email archiving. 32% said they didn’t feel it was necessary or didn’t feel they had the expertise needed to make such a move, while 28% said it was simply too expensive.

“It is clear that there is a degree of education required in the market and that despite the clear benefits that many are seeing, the lack of appreciation of the utility of email archiving is concerning,” said David Vella, Director of Product Management at GFI.
“Resellers now have a unique opportunity to inform their target customer base of the benefits they are missing out on, and perhaps more importantly, the risks they are running by failing to implement these safeguards,” he added.

The risks indeed could be great. With the huge amount of data shared via email, much of it confidential or of critical importance, it’s always in a organization’s best interest to archive. Legally, it could literally save a company from disaster if they are ever called into court. It’s clear that in this day and age there really isn’t any good reason not to archive email.
 

Lack Of Education Primary Reason For Not Archiving Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

An updated bulletin on using email archiving solutions was recently published by the  U. S. National Archives and Record Management Administration (NARA).  This bulletin provides questions and guidance to U. S. Federal agencies on using e-mail archiving applications and similar technologies for managing e-mail records. Good until 2010, the bulletin advises agencies that:

• Although e-mail archiving applications may provide business benefits to an agency, e-mail archiving applications can be limited in their capabilities to keep and organize records according to records management laws, regulations, and policies.
• If an agency decides to use e-mail archiving applications to manage Federal records the agency is responsible for addressing those areas where the applications do not meet the requirements of the Federal Records Act and applicable NARA regulations.

Below are some more highlights of this very interesting bulletin, which provides standards for all U. S. government agencies.

What are the requirements for managing e-mail messages as Federal records?

Record keeping systems that include electronic mail messages must:

• Provide for the grouping of related records into classifications according to the nature of the business purposes the records serve;
• Permit easy and timely retrieval of both individual records and files or other groupings of related records.
• Retain the records in a usable format for their required retention period as specified by a NARA-approved records schedule;
• Be accessible by individuals who have a business need for information in the system;
• Preserve the transmission and receipt data specified in agency instructions; and
• Permit transfer of permanent records to the National Archives and Records Administration (see 36 CFR 1228.270 and 36 CFR 1234.32(a)).

What are the benefits of e-mail archiving applications?
Depending on the agency and its business purposes, e-mail archiving applications may provide the following benefits. Each application has different features and different strengths, so this list is not exhaustive:

• More efficient storage of e-mail because it is moved from a distributed network of servers, desktop applications, and other places to be managed in one place;
• Enhanced electronic search capability for content that may be germane to a subpoena, Freedom of Information Act request, e-discovery request, or similar purpose;
• Assists in back-up and disaster recovery.

What else is NARA doing in regards to e-mail archiving applications?
NARA is monitoring Federal agencies deploying or considering deploying e-mail archiving applications in order to evaluate what steps agencies may take to ameliorate recordkeeping issues posed by this emerging technology. We continue to study e-mail archiving and recognize that software developments may eventually bring these technologies in closer accordance with good recordkeeping practices.

U. S. National Archive Publishes Guidelines

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Microsoft published a white paper on the subject of “Planning for large mailboxes with Exchange 2007″ last month, and this has caused some discussion about email stubbing around the blogosphere. Admittedly an arcane topic that not many people know or care about, stubbing can actually have a big impact on your email performance–but as it turns out, it’s not as easy as all that. At its essence, stubbing is just an archiving mechanism taht strips an email of its attachments, replaces it with a stub file or link within the message, and then stores the actual attachment in an archive.

Whether or not to stub emails should be a part of the discussion when planning for email storage, simply because storage–especially for a large enterprise–can be a problem. Deleting older emails is not an option for many companies, because it might violate regulations–and that’s why you can still find a five-year-old email message about a co-worker’s retirement party still floating around somewhere. Similarly, moving emails to backup tapes or PST files can also sometimes make it difficult to find an email, or may even result in loss. Seriously, have you ever tried to get one of the IT guys to go back into that little room over by the coffee machines where they keep the backup tapes and try to find anything? Not going to happen!

The Microsoft paper takes the position that stubbing can cause some search and performance problems over time, and instead, recommends that users of Exchange use a third-party email archiving solution to move old emails out of the email boxes completely and into an archive. This seems logical: Over time, an email inbox can get quite large, with tens of thousands of emails. And if you’re not allowed to delete any of them, that many messages–even if they’re just stubs–can quickly become unmanageable. And of course, since a stub file has very little information in it-sometimes only a message header–trying to find an old message becomes almost impossible. And so the solution isn’t cut-and-dried, and the answer is, “it depends.” Smaller email systems may well benefit from taking a stubbing approach, although medium-sized and large enterprise systems would probably do better with a pure archiving solution.

Microsoft’s approach, besides applying third-party archiving, is to recommend larger email boxes for Exchange, which makes sense, because as the paper points out, the volume and size of email continues ot increase daily, and end-users who have to spend time every day trying to manage a mailbox with a low quota is not going to be productive.

Email stubbing not always a good idea

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

When it comes to being able to track historical emails, archiving has a distinct functionality.  Backup tapes won’t archive threaded email conversations.  Backup tapes only capture email that is available at that moment in time. A deleted email never gets captured by a back up tape.  On the other hand, archiving allows for retrieving even deleted emails.

The retrieval of information from back up tapes is usually very inconvenient.  Depending on how far back email messages require restoration, it could take an hour, to a day or longer to acquire the tapes.  If the tape is on site, the delay isn’t too long. Off site tape storage definitely create longer delays in the restoration process. After the time lag from request to email restoration, the email user then says “I can’t find the emails”. The tape pull process starts over again.  Many times it can be a guessing game, because people don’t remember what day, year or month they lost the emails.

Requesting a tape pull, receiving the tape, mounting the tape and then spinning it up are all variables of what can often be a very long time delay. Archiving eliminates the intermediary role a system administrator must play.  What if the email user could retrieve historical emails themselves?  Archiving software, such as GFI MailArchiver, empowers the email user community.  Imagine an email administrator has now set it up so staff can immediately retrieve missing or historical emails.  This allows the administrator to appear to be a super star.

Oh sure, people may still go through the guessing game.  The turn around time is minimal with an archiving system. People can guess about the date, location of missing email, but search time is less. People can also skip around quicker to find what they are looking for.

When it comes to file retention compliance issues, archiving systems are the best solution for preserving historical emails and documents.

Archiving and Back Ups are 2 Different Animals

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators