Usually  if  you  heard  about  dangerous e-mail content first thing you
imagine  is  virus  or  worm.  It  makes  many system administrators and
security  policy  designer  to  think  that  virii  is  the only or most
significant  risk  from  using  e-mail  and  implementing good antiviral
product  and  filtering  dangerous content will prevent any threats from
e-mail.  This  is  very  weak  approach and it may lead to huge security
problems  for  enterprise,  because e-mail is the most convenient way to
launch external attack against enterprise network.

Hacker  can  try  to  break  e-mail  or web web server, ftp server or to
launch  attack  against  SSH. You can continue this list :). But in case
of corporate network these attacks are not likely to succeed: the first,
these   servers  are  under  control  of  skilled  (I  hope  :))  system
administrators,  the  second fact is most attacks are known and attacker
may  be  detected  on very first, information gathering phase of attack,
and  the third in case of success hacker will only get access to DMZ. In
case of e-mail attack hacker may still anonymous, he deals with user and
gets  direct  access  to internal network. This make e-mail attacks more
likely  to be used in-the-wild. Remember Microsoft was hacked some times
ago? It wasn't site deface, but source codes were leaked. So it was real
damage  for  corporation.  As  you  can remember attack was launched via
e-mail trojan. They say that attacks was likely from inside because old
trojan was not catched by antiviral software, but I bet it's a mess, and
you will see why.

The  main  idea  of  this  presentation is to show possible threats from
e-mail  and  to  show  how security policy and system administration for
enterprise should be designed to prevent at least some of risks.

What will you know:
  Risks assotiated with using e-mail.
  How to fight malware on servers and why this protection may be
  ineffective.
  How to protect your workstations and how make Windows more secure.
  How to create security policy having in mind e-mail attacks.

Please  note,  that  this  presentation will not cover aspects of e-mail
servers  protection,  because  there is a lot of information you can get
about it. We will talk about client side security only.

During  this  presentation  I  hope  you  already  know basics of e-mail
operation  and  corporate  security.  

Very   small   part   of  presentation  dedicated  to  securing  windows
workstations.  If you feel no interest to Windows security you will have
a time to make a cup of coffee.