IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.72 Misuse of e-mail services
Misuse of e-mail systems can take place at a variety of stages: at the sending
workstation, within an Intranet, on a mail server or at a receiving workstation.
If access to a user's e-mail program or an organisation's e-mail system is not
adequately protected, unauthorised persons might be able to manipulate these
IT systems. The resulting, unnecessary transmission expenses might also be
accompanied by damage caused through the impersonation of an authorised
user.
Similarly, unauthorised persons must be prevented from reading e-mail.
Confidential information could thus be disclosed, lose its value or be exploited
to the detriment of the recipient.
Examples:
- A department head briefly left his office with the IT system unlocked, the
mail software on it still active, and user authentication already having been
performed. A colleague who happened to pass by the office then played
what he considered to be a great practical joke by using the department
head's ID to send other colleagues "letters of notice" or work orders.
- An employee uses his own business e-mail account to disseminate private
opinions which could damage the reputation of his employer.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000