This attack works because we have conditioned ourselves and our customers, clients, vendors and other third parties to trust e-mail as a medium of exchange. It would seem that this trust is not well founded and that the paradigm should be re-examined.

From the perspective of a historical parallel, Cholera epidemics in New York City in 1832, 1848-49 and 1854 killed thousands of people. It led to the founding of the Board of Health in 1866 and the adoption of improved standards for sanitations that eventually eradicated the disease.

Treating the individuals during each of the outbreaks had been ineffective and in some cases counterproductive as more people were exposed to the disease. Improving sanitation and overall social hygiene effectively eliminated the root cause of the disease.

The current state of polymorphic malware makes treating the affected systems similarly difficult. The number of malware variants, combined with polymorphic characteristics, makes detection and removal extremely challenging if not impossible. Therefore, the most effective approach may be to eliminate the root cause; in this case, e-mail attachments.

Many organizations have already implemented some form of Document Management System (DMS) or in the broader sense Enterprise Content Management (ECM). A DMS provides a centralized repository that supports several common functions; Check In/Out, Version Management, Search & Navigation and Document Organization. Products such as Documentum, eDocs, NetDocuments and Sharepoint are representative of this class.

Implementing a DMS is a relatively trivial exercise in terms of technology. The products are proven and the underlying infrastructure is common in today's IT environment. It should also be noted that security controls around the DMS are critical, but easier to achieve than the traditional model where this same information is scattered throughout the organization. However, changing the habits of the workforce will be the most challenging aspect of the project.

There are other advantages in creating a DMS-centric operation for your organization:

1. The DMS provides a central, single version of documents and will help prevent “version-it is” in the creation-review-edit process;
2. Distribution of sensitive, private or otherwise controlled information can be restricted more easily;
3. Backup and recovery is simplified by eliminating the end points from the problem;
4. A centralized DMS repository may facilitate the notification process in response to a data breach;
5. The organization of the DMS facilitates compliance with eDiscovery requirements, (e.g., litigation hold), in a litigation scenario; and
6. Creation of a portal for access by known/trusted third parties supports the secure transmission of sensitive information without exposing it to the internet.

Eliminating e-mail attachments may seem to be a formidable task. However it may be the most realistic means of reducing the threat of malware to the enterprise. So what is stopping you from “kicking the habit”?

John Rostern is managing director, Northeast, for Coalfire Systems.