Security Column: Managing Outgoing Viruses
In this case, DERA has come up with a way to combat email borne viruses. Realizing that you will not always be able to intercept and stop a virus as it makes itss way into the network, you can try to prevent it from "germinating" and spreading to other systems. This is a good idea, having defense in depth. If you don't catch incoming viruses at least you will be less likely to propagate them to other systems. Unfortunately, the method suggested by DERA is extremely simplistic and will no doubt annoy users to no end.
DERA's idea is that when you send out an email you will receive a message asking you if you really want to send it. Thus, viruses that generate emails to spread themselves will be stopped because the user will realize they have not intended to send a message, and they will not click "OK."
This appeals to many people because of its apparent simplicity and potential effectiveness. Unfortunately, there are several severe problems with it. The first will be the annoyance that will slowly become unbearable, like Chinese water torture, of having to wait for a message and then click on "OK" whenever you send an email. Instead of quickly typing out an email and hitting send you will need to wait until the server sends a response so you can click the approval button. Depending on how heavily loaded the server is, this may take a while.
The second problem is that writing a virus with the ability to respond to this message will not be terribly difficult. As this software becomes more popular, virus writers will compensate for it by automatically replying to the messages. Of these two problems, I suspect the user interface will be the major downfall. Security measures almost never work if they are intrusive, because users will first try to circumvent them, and then they will loudly complain if they cannot. Also, these systems only work if the client uses the company mail servers. If someone has Outlook set up to use Hotmail as well, for example, the virus may successfully spread through that account.
There are also much better ways to deal with this solution that will not be as "in your face." For example, you could have the mail server either hold all email for several seconds or minutes before sending it and apply either rate limits on the amount of mail a user can send out, or if the user sends too many messages that are identical or nearly identical, have it flag them and raise an alarm. This is made easier by the fact that most viruses send themselves out as attachments, making them easier to spot. Hooking into your authentication system is another option. If a user is not logged in, but their machine is trying to send out email, this is an obviously suspicious activity. More intelligent approaches such as these, while harder to implement, are probably going to be more effective as they will not annoy users to the same degree.
Of course, this all ignores many of the simple steps you can take to block the spread of these viruses. Simply blocking .vbs extensions at the mail server (both incoming and outgoing) will very quickly reduce your risk exposure by a significant degree. Firewalling outgoing connections to port 25 (SMTP, the mail transfer protocol) and forcing users to use the company's mail servers will at least ensure that their outgoing messages must pass through your filters, and you will have a log of them. For most UNIX systems, there are a number of free log monitoring utilities you can use to alert you if a user suddenly starts to send out a lot of email.
Remember, security doesn't have to reduce usability.