Fred sed: > > No usable security is 100%. It is a red herring to point out ways around a > a security mechanism as a reason to not implement. > But it's irresponsible not to point out that a road block that stops only car bombers in Toyota pickups is going to get you done in by the guys in the Mercedes sedans.... It's not necessarily the wrong thing to do, but it's not nearly enough. Without screening on other characteristics (sizes, attachment types, etc.), a text-content-filtering solution is so easily bypassed by an intentional wrong-doer that it's not really a solution. Unless it can, for instance, do reliable OCR on gif files. > > There are products (Mimesweeper comes to mind, and WorldTalk has something) > that look for key words. The idea is not to look for "sensitive > information" but to look for email that might contain sensitive information > based on certai key words (project names are the most common). The use of > such products is to stop the accidental disclosure of sensitive > information, often done when people forget about local nicknames (aliases) > in their mail user agent. > Different requirement: the original poster seemed mostly concerned about intentional disclosure. But the key is definitely to look for stuff that might contain sensitive information, rather than trying to definitively spot it (been waiting to use a split infinitive since they were legalized). -- W.C. Epperson "I have great faith in fools. Chief of Systems Engineering Self-confidence, my friends call it." Security Officer Emeritus --Edgar Allen Poe-- Curmudgeon-for-Life Virginia Dept. of Education [EMAIL PROTECTED] - [To unsubscribe, send mail to [EMAIL PROTECTED] with "unsubscribe firewalls" in the body of the message.]
