Today, the biggest threat to any environment is client-side attacks, specifically attacks being launched against normal end-users via e-mail and through the browser. Attackers rarely beat up on Internet-facing hardened super servers. Instead, just send a little spam to less-protected workers and let the social engineering aspects do the rest. All it takes is one weak end-user to ruin the whole network.

What does this mean? Network administrators need to concentrate significantly more effort on preventing client-side attacks than building the next battle-hardened server. We almost have the latter issue won, yet our end-users keep opening ever-worsening spam and phish attacks.

Trying to prevent malicious e-mail attacks by blocking a small number of file types isn't going to work, either. Most corporate e-mail file block lists I encounter cover 10 to 20 file types, including files with the following extensions: .exe, .zip, .com, .bat, and .pif. The truth is I've counted more than 150 file types that have been used maliciously -- you can download my list of potentially malicious file types from my blog (http://weblog.infoworld.com/securityadviser/archives/2006/05/100_potentially.html).

A better security defense tool is to block all file types by default and only allow a few legitimate types. If your defense tool only supports deny-by-exception, however, you can use my table to populate your defense tool with a more inclusive list.

The single best thing you can do to prevent malicious e-mail attacks is to force all incoming e-mail to be converted to plain text, removing all HTML code, embedded links, and active content. Pulling out the HTML coding easily reveals the phishing links, removes many automated attacks, and renders most malicious e-mail harmless. If the user wants to view a legitimate e-mail in its original form, many e-mail clients, including the newer versions of Outlook, allow the HTML to be added back in with a click of the mouse.