I just read the following article…

Computer Virus ‘Time Bomb’ Could Go Off April 1
(http://www.foxnews.com/story/0,2933,510296,00.html)

My thoughts…

The Internet is a dangerous place. It seems highly likely that “Conficker” is going to do something, and it should be of great concern to everyone, but particularly IT people, that we know about this worm, but still have no idea what it is designed to do. Talk about a weakness of the “filtering” mentality. Don’t forget… It is nearly impossible to filter for something that is not yet known.

With history as our guide, it is highly likely this worm will include an e-mail based component. The bad news for people who are protected by current anti-spam filtering technologies is that they will be left virtually naked until the worm actually starts working. Only then will the developers of the filters be able to design rule sets to deal with the worm. This is the definition of being reactive. In addition, once the rule sets are defined, they do no good until they are pushed out (deployed).

It would not surprise me if we saw an exponential increase in threat-laden email when this worm comes to life. However, I do not think the people that design these sorts of worms are targeting the email infrastructure. I believe email is used as a virtual “smoke screen” these days. This virtual “smoke screen” is used to mask the real targets of the worm or virus.

For e-mail to continue as the Internet’s “killer app” there is no question the issue of security, or with e-mail, the lack of security, needs to be addressed. The key to solving the security problem lies in the recognition that human interaction is a key component of the email process. I realize this seems obvious, but for some reason we have “missed the forest because of the trees” when it comes to e-mail security.

In the final analysis, no one is better to determine what email you want to receive than you. In addition, the concepts of privacy and security, though completely missing from email, have been incorporated into all modern communications tools. The best examples are Instant Messaging (IM) and social networks (Facebook, MySpace, LinkedIn, etc.). Simply put, if I want to add someone to my Facebook network, I need to ask for their specific permission. If I want to send someone an instant message using Gtalk, I need to ask for their specific permission before I am permitted to send even a single message; the exact same process applies to Yahoo, MSN, AOL, etc. Not to over simplify, but it would not be wrong to summarize that Sendio has succeeded at bringing email up to a level of security commensurate with other modern communications tools. Our “radical” improvement comes from our realization that human interaction is the lost key to safer, more secure and efficient email.

Does this “radical” thinking represent a paradigm shift?

The Sendio approach to email security is more a paradigm extension than a shift. We have all become very comfortable with caller-id on our cell phones and have embraced the verification steps required to participate in social networks. As demonstrated by the rapid adoption of Instant Messaging and SMS “texting,” it is clear that people have no problem with the concept of sender’s authenticating themselves; no one complains or worries about sender authentication for chat rooms or on-line forums. Therefore, we see little or no pushback when this level of security is added to email. I believe the challenge before us today is not shifting people’s paradigms, but helping them connect the dots. Because of email’s importance within the fabric of business it is no wonder that people are very “touchy” about the process. What we need to do is help people see that we have done nothing more, or less, than bringing email “up-to-speed” with current technologies.