Response to risk

Abstract

This article describes how electronic mail (email) has developed from being a simple, efficient and cost-effective means of communicating short messages across computer networks into a broad platform on which are based a wide range of applications for which email was not intended. A study is reported which considers the main sources of email security risk and the creation and deployment of email security policies. It sets out the key email security elements needing to be addressed in terms of the supporting literature, where these issues were analyzed to assess user perceptions of email security risk. Two data sets were collected during 2003, involving: interview data from discussions with six email security experts from several companies; and survey data from a single case study company where the 285 highly-educated employees were regular users of email, and were supposed to practise their handling of email with reference to the company’s email security policy. The survey results indicated strong support for the view that email security was a major concern for companies, but low opinions were held concerning end-user knowledge of email security issues in the organisations with which they had contact. A major priority in reducing email security risk was seen to be the education of end-users in appropriate email handling practices. All participants were concerned about the occurrence of viruses and spam but tended to be undecided regarding whether or not interception was a real threat and it was generally felt that the low perceived threat of interception did not justify the cost and disruption involved in the introduction of encryption software. Considerable interest was expressed regarding the question of employee and employer rights when drafting email policies and these comments reflected the level of ambiguity in the existing legislation, where none of the people interviewed was aware of any guidelines to help a company protect its interests while upholding the privacy rights of its employees.