First off, if you did not request it, don’t open it. In the last two months, we’ve worked with three Vice President and higher executives who said exactly this: “I received an attachment from someone I didn’t know, and I wanted to see what it was.” Curiosity killed the cat… and the VP’s computer. The red flags should have been flying at “from someone I didn’t know.” If you weren’t expecting it, don’t open it!
Consider having your IT staff filter out email attachments – not just EXE files, but Microsoft Office documents and PDFs as well. If a job doesn’t require receipt of email attachments, don’t allow them! If you are required to receive attachments to do your job, such as the case for HR professionals, make sure that your default application for handling them is a lesser-functioning viewer, such as the Microsoft Word Viewer. This is a greatly stripped-down program that lacks the features that viruses use to take over your system.
Side note: If you think you are immune because you are a Macintosh shop, I’m sorry to say, you’re not; Macs are just as susceptible to virus-laden email attachments as Windows machines – we just don’t see them as often because there are more Windows machines than Macs.
Peter Nikolaidis is an information security professional based in Cambridge, MA. He holds several information security certifications, including the CISSP. In his spare time, he enjoys practicing martial arts and yoga, mountain biking, and thinking about ways to protect the innocent… often from themselves. Connect with Peter on LinkedIn.