As a business we have a good spam filter which protects against 99% of externally originated spam emails and quarantines them. Recently however we have been receiving lots of spam from internal email addresses. The root cause of this is being investigated by the infrastructure team but we can't block emails from internal addresses for obvious reasons.


I have been asked to provide a 'guideline' document on how to deal with internal spam emails, most of which relies on common sense. For example:

  • If you receive an email from 'scanner@ourdomain.com' and you haven't scanned anything, don't open the attachment and delete the email. Especially if it's an Excel document as our scanners don't produce Excel files...
  • If you receive spam email from an external address forward it to spam@ourdomain.com so it can be blocked.
  • If you receive an email which is clearly spam (such as from 'Irinka' who wants a good spanking) then don't click the links in the email...
  • If you receive a blank email with an attachment you're not expecting then don't open it and either delete it or ask IT for advice.
  • etc.

We're not a massive business so showing people how to scan emails for viruses (using ESET Endpoint Antivirus) is easy, as is how to scan documents that have been saved. But to save time doing this we would like to send round some easy guidelines.

My question is can anyone think of anything that might not be completely obvious that would be good to add to this list. Appreciating that organisations have different structures, processes and procedures. I would like to put together a 'definitive' list (or as much as possible) to cater for the majority of circumstances. Being that we as a business have limited experience of any spam emails actually making it through the filters/firewalls I was hoping to draw on any collective experience.

The guide will be sent to everyone from MD level downwards.


  • 3
    Help in writing a company security policy is really not on-topic on this site. – Lilienthal Nov 12 '15 at 11:11
  • @Lilienthal Understood but I'm not writing a policy, just a brief 'common sense' guide (the official policy will be written by someone else later on) – Lyall Nov 12 '15 at 11:16
  • @Lyall Still not what this site is for though. If you're after general common-sense guidelines you really should be asking on the Security SE. – Lilienthal Nov 12 '15 at 11:39
  • @Lilienthal I understand - I'll bare this in mind if I have any similar questions in the future. I previously answered a question on here regarding locking workstations which is why I thought this was the place, apologies if this is incorrect. Thanks :) – Lyall Nov 12 '15 at 11:51
  • @Lyall It's fine, there's always going to be some overlap. The locking question is borderline but focused on ways to adjust workplace behaviour rather than listing security guidelines. Since you're asking about security the people best placed to answer it will be over at the Security SE, not here. – Lilienthal Nov 12 '15 at 12:00

Since you're dealing with a not-massive company of people who probably know each other somewhat well, I would apply different rules than from normal spam filtering.

First, make sure everybody is aware that there's a leak and spam is sent internally. Most probably know, but if they don't and they suddenly get a message setting all sorts of rules they'll probably be annoyed and not follow them.

Then, add the following rules to reading mail:

  • If this is a person who has never mailed you before, and you get a message out of the blue, call them before you open it.
  • If this is a person who mails you often, but the usage of language is suddenly different, the topic is unexpected, or otherwise feels fishy, again, call them before you open it.
  • If anything about a mail seems weird, out of place, or suspicious, call the sender before you open it.

The best way to find out if someone really mailed you or you're getting spam is to simply ask them directly.

This is for obvious reasons not possibly in many normal email related situations, but these are all people who know each other and you have a direct connection to. And it's a temporary issue anyway. (Make sure to inform people when the leak is plugged).

| improve this answer | |

When you have spam originating from inside your network, then something is really, really wrong with your IT security. A malware which sends spam could just as well be a trojan sending all your business secrets abroad.

Instead of fighting the symptom (the spam mails) you should rather fight the source (malware infections) and establish proper security.

  • Have all users work under strongly limited user accounts
  • Centralize your patch management for all applications running on the clients
  • Get a properly configured firewall
  • Do regular virus scanns on all clients and servers

When you have question about details, consult https://security.stackexchange.com

| improve this answer | |
  • 3
    This is a very technically effective answer to the underlying problem but assumes the asker has or can get the authority to change the solution. What if they just have to write a document to guide user behaviour? – Hazel Nov 11 '15 at 12:26

Set up antivirus to automatically scan emails

If in doubt check headers

Preview messages

Don't forward mails you're unsure about especially to a list of people

Edit after your comment:- you're using an exchange server, in that case your IT guys can block it fairly easily because exchange server from at least 2007 up have the capability, however they would have to have things like scanners etc,. send to a separate receive connector if they don't already.

I only have personal experience with exchange 2007 doing this, but a quick lookup shows it can be done with 2010, here is the link click me

Although it's not your question, this would be the ideal solution from my viewpoint since it proactively deals with the problem without any need for normal staff to worry about it and anything that can be automated in those terms should be.

| improve this answer | |
  • Thank you - I have passed the link you have provided to the infrastructure guys (the ones trying to resolve the issue) incase they haven't seen it already :) – Lyall Nov 11 '15 at 14:12

The fundamental point about email security is that an email is easy to fake in it's entirety. Company structures are available online, linkedin can show relationships between workers, and casual inquiries can give examples of email formats.

If an email is not expected, has an attachment, or is asking for information which is not explicitly public, then treat it with suspicion. Check with the person that's sending it through known channels (use the known phone number, don't use the one in the email), make sure that it was sent as it says.

To give a few examples of things that can happen which seem innocuous:

  1. Company secretary receives an email from the MD asking what information would be needed for a rapid CHAPS transfer. In this case, they work across the hall from each other and a quick discussion revealed that the email hadn't been sent as stated. I was called in, and checked the logs and headers. While the "sender" fields showed the MD's name and email, the "reply-to" field was a different, presumably compromised domain. Email was attempting to gain information for a further attack.

  2. An external worker sends an excel sheet containing some confidential figures. When the document is opened, a macro starts and requests the users username and password. At this point, the user smells something fishy and alerts IT, however the macro has already opened a channel back to a hacker, and had already infiltrated the system.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged .