A new business email compromise (BEC) campaign has been targeting Microsoft 365 organizations in a bid to hack corporate executives’ accounts and maliciously divert business payments.

Researchers from cyber security firm Mitiga found that the hackers are leveraging inherent weaknesses in 365’s multi-factor authentication (MFA), Microsoft Authenticator, as well as Microsoft 365 Identity Protection.

The attacks combine spear-phishing tactics with man-in-the-middle methods to compromise email accounts. The attackers essentially hijack business transactions by sending an email from the account to its intended recipient with a request to change the receiving bank account, according to Mitiga research.

These emails trick the recipient into believing that the usual payment account has been frozen and convincing them to use alternative accounts belonging the threat actor.

The attacker will also hijack email chains with forged 'typosquatting' domains that appear genuine at first glance due to stealthy character changes.

Mitiga’s researchers discovered the campaign when investigating a failed attack, which indicated that the attacker had access to sensitive information only obtainable by compromising a user’s account.

Spoofed DocuSign login page

As part of its investigation, the firm discovered unauthorized access to an executive’s 365 account from multiple locations, including Singapore, Dubai, and San Jose, California.

The compromise leveraged a man-in-the-middle phishing technique for initial access to the account and mailbox. The initial email was created to mimic a request from DocuSign, accurately imitating the layout of the popular electronic business agreements management platform with a spoofed address.

Although that does not pass DMARC checks, a misconfiguration in the client environment used to minimise spam alerts from DocuSign meant the email was not blocked and appeared as legitimate in the executive’s email inbox, the firm said.

Upon clicking the “Review Document”, the victim would then have been prompted to enter their Microsoft Azure login details into a malicious domain. As part of these tactics, the threat actor uses a phishing framework such as evilginx2 proxy that acts as a middle agent between the spoofed login page and the real one.

As the victim enters their details, the session cookie is snatched by the attacker and used to assume the user’s session, without needing to re-enter a password or approve an MFA request. The victim is then directed to a generic DocuSign error page.

Nullifying multi-factor authentication

Compounding the breach further, however, was the fact that the attacker was then free to set up a second authenticator app for the user without their knowledge, which essentially enables persistent access to the account after the session expires or is revoked.

“This gave the attackers full persistency of the breached account and effectively nullified the value of MFA,” Mitiga said.

In the incident investigated, the security firm said attackers accessed Exchange and SharePoint, but had not yet picked their moment to take action from the inbox.

Concluding its findings, Mitiga said that, although preventing these types of attacks is difficult, containing and limiting them should be relatively straightforward by requiring an MFA challenge for security related activities. However, Microsoft currently does not offer this.

“Given the accelerated growth of [these] attacks (even without the persistency allowed by an attacker adding a new, compromised, authentication method), it is clear that we can no longer rely on multi-factor authentication as our main line of defense against identity attacks,” it said.

“We strongly recommend setting up another layer of defense, in the form of a third factor, tied to a physical device or to the employee’s authorized laptop and phone.”

The firm added: “Microsoft 365 offers this as part of Conditional Access by adding a requirement to authenticate via an enrolled and compliant device only, which would completely prevent [these] attacks.”

The National Cyber Security Centre (NCSC) has released a brand-new tool for businesses to check the strength of their email security in a bid to reduce the number of cyber attacks they suffer.

Announcing the new service at the organisation’s annual CYBERUK conference, Email Security Check will assess if a business is vulnerable to attacks by checking two aspects of cyber security using publicly available online domain information.

The online service will check to see if anti-spoofing protocols such as domain-based message authentication, reporting and conformance (DMARC) have been configured correctly which can help prevent cyber criminals from sending emails purporting to be from a business.

DMARC helps businesses verify their email headers which will ensure emails sent from inside the organisation are trusted by the receiver, while those sent by cyber criminals attempting to spoof the company through email scams are seen as untrusted and less likely to be opened.

The second aspect of cyber security assessed by Email Security Check is email privacy. It does this by checking for privacy protocols such as transport layer security (TLS) are implemented in an organisation’s email client.

TLS is an industry-standard method of encrypting data between senders and can be found in most modern email providers. Building on the work from secure sockets layer (SSL), TLS ensures email communications cannot be hijacked and tampered with while in transit.

The NCSC said Email Security Check is a developing service and it will be adding more features “in the near future”.

The cyber organisation also said the service should not be confused with one that checks domains or individual emails for malicious activity. All suspicious emails should be reported to internal IT teams and the NCSC at report@phishing.gov.uk.

“Email plays a central role in how organisations communicate every day so it’s vital that technical teams have measures in place to protect email systems from abuse,” said Paul Maddinson, NCSC director for national resilience and strategy.

“Our new Email Security Check tool helps users identify where they can do more to prevent spoofing and protect privacy and offers practical advice on how to stay secure.

“By following the recommended actions, organisations can help bolster their defences, demonstrate they have taken security seriously, and make life harder for cyber criminals.”

The tool is a stripped-back version of the existing Mail Check service offered by the NCSC, which is another free initiative that checks for DMARC and TLS compliance but is only available to public sector entities.

According to NCSC figures, organisations’ adoption of recommended controls varies wildly with some having just 7% of the bare minimum security measures in place.

The Email Security Check website was made available today and requires no details, personal or otherwise, from the user to access the service.

Blockchain smart document specialist ShelterZoom has announced the launch of its new Document GPS solution in the Google Chrome Store.

The first Gmail document tokenization tool on the market, the offering has been designed to monitor and control email attachments so users can manage their entire journey – gaining visibility over who downloaded the file, who opened it, and who forwarded it.

Document GPS also allows senders to revoke a recipient’s ability to download or share the attachments at any time – even after the email has been sent.

“ShelterZoom was built on the premise of upgrading the safety and security of how people exchange information online by making it easy and effortless to integrate with blockchain,” explained ShelterZoom CEO and Co-Founder Chao Cheng-Shorland.

“What we have already created for documents and contracts we have now brought to email attachments so the full lifecycle of a document’s journey is secure. Document GPS also complements our virtual negotiating platform so users can carry out a complete workflow in the same secure ecosystem.”

With the growth of Web3, ShelterZoom says that digital security will take on an even more crucial role than it already does. To help tackle this, Document GPS provides email senders with a timestamped log in their interactive Attachment Library built into their email interface – allowing complete visibility into how each recipient has interacted with the file.

The company has built the solution on the same blockchain technology that powers their entire platform to give Gmail and Google Workspace users an extra layer of security integrated into the system.

ShelterZoom says it plans to release a similar tool for Microsoft Outlook users later this year. For now, current use cases include crypto banking professionals, small business owners, as well as personal Google users.

“With the click of a button, our clients and collaborators are now empowered with total control over important documents, giving us peace of mind of their origin, authenticity and access, greatly reducing risk of fraud, document loss or mishandling,” commented Michel Garibaldi of Arab Bank. “For the finance industry, this is a game-changer.”

Gregg Farrauto, Founder and CEO of US-based Farrauto Wealth Management said: “By using Document GPS for high-stakes attachments, I can rest easier knowing I can track the documents I send and my clients' private information is protected even if their email system gets hacked."

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Why is email still a thing?’. To listen to the full episode, click here. We apologise for any errors.

Keumars Afifi-Sabet

Hi, I'm Keumars Afifi-Sabet.

Sabina Weston

I'm Sabina Weston.

Adam Shepherd

And I'm Adam Shepherd.

Keumars

And you're listening to the IT Pro Podcast.

Adam

Now, we've spoken about a lot of business tools on this show. But there's one that reigns supreme above all others, the unquestionable king of business productivity tools and the glue that holds the modern enterprise together. I am, of course, referring to the humble email client. The venerable technology has been around for half a century but despite its advanced years, it's still an absolutely essential tool for every commercial business on the face of the planet. Without internet access, many businesses would simply grind to a halt. But with so much progress in the field of cloud based collaboration and communication services over the past few years, why is this decades old technology still such an utterly dominant force? So to kick off this discussion, then, let's talk about our inboxes. How many emails would you say you send in the average week? Because I know, for me, I, I don't think I can even count but it's got to be in the hundreds at this point. Sabina, what about you?

Sabina

Um, for me, it really varies, you know, I've only sent let me see this week. I think I only must have sent like, around, like, 10 of them, just by maybe a bit more.

Keumars

It's not bad going.

Sabina

I mean, it's, it's, I mean, yeah, I guess when you do like news and stuff, you always want to like comment and stuff. So I try to sort of like, you know, contact as many people as possible and, but, you know, there are days where like, I send that amount, like, you know, per day. So it's probably like, gonna be like, 10 emails per day sometimes, or something like that. So. So yeah, I'm looking through this, I think the 19th of January, just looking at my at my sent emails from the 19th of January, was a very, was a very busy day for me. I don't know why, but it was just like, I have no idea why I sent all these emails. I think it was about like, 5G at US airports, that we wanted a comment on and yeah, so this is why I was like talking to a lot of analysts. But But yeah, it varies greatly, like sometimes where it's like, you know, I receive a lot of emails, but like, don't reply to them. And other days I'm like more, yeah, I like to engage more on other days. So yeah, what about you?

Adam

Yeah, for me, it's, it's, most of them go unreplied to. But even so, the amount of emails that I send on a weekly basis - I'm sure a lot of our listeners will be able to relate to this - it sometimes feels that a good chunk of my job is just sending and replying to emails. Keumars, what about you?

Keumars

I think I'm maybe somewhere in between the two of you in terms of how many I send a week. Even then I look back on the week and think, who have I been talking to? Who am I communicating with? But the real question, I think, for me is, how many emails do you receive in a week? I think it's very, very easy to get absolutely overblown, with people trying to communicate with you.

Sabina

Yeah, I mean, it's it really is, you know, it does have like, a big potential to like impact the way you work and just like Adam said, like, I think he said something about like your job being mostly replying to emails, that's actually proven to be an issue with with a lot of companies especially, I think there was was research which I covered last year about how UK based employees spend nearly one working day each week just managing their inboxes so when you work five days a week, and like one day out of these five is just spent on emails, I mean, obviously it's like stretched out throughout the week right? But like, that's, you know, that's a fifth of people's jobs is just emails.

Keumars

Yeah, I can totally relate with that. It got to a point last year for me where I had to set like a development objective for myself to manage my inbox because it was overwhelming me in you know, other respects of my of my work too, because you know, let's say you have a very messy desk sometimes, you're not gonna probably be as productive as you might be with a very nice and clean desk. In the same way my inbox was a, you know, a garbage fire and I needed to find ways of managing this in order to manage the rest of my workload.

Adam

Okay, so call out time. How many unread emails do you have in your inbox right now?

Sabina

Oh my god, this is probably gonna get me fired.

Adam

I guarantee that I've got you beat.

Sabina

No, 12,589.

Adam

Go on, Keumars.

Keumars

So in terms of the actual emails from from real people, I'd imagine, let me have a look. Okay, slightly better than I thought; it's 29 unread messages.

Adam

29?!

Keumars

29. The, the the development objective worked, I am now really pretty much on top of my inbox. Overall, however, if you include newsletters, different kinds of promotions, and so on: 3,832.

Adam

You are both like tiny babies. I currently have 60,981 unread emails in my inbox.

Sabina

How many years have you been at IT Pro?

Adam

Um, well, that's so I've been, I've been here coming up for six years now.

Sabina

I still, I think if you compare it, I'm still doing, I'm still like on a bigger increase than you are.

Keumars

You're on your way.

Adam

That's still with like, intermittent, you know, select all, mark as read every couple of years or so. Cause yeah, beyond a certain point, it's, it's just like, Okay, I don't need this email from, you know, like two and a half years ago, with, you know, this two email chain about a press release. But it's, I think it's indicative of how reliant we are collectively, not even just as an industry, but the business community at large, that the kind of struggle to maintain kind of Inbox Zero, quote unquote, is, you know, such a such a goal for many people, you know, just keeping on top of email traffic is something that actually has to be worked at. And you know, people have to have strategies and plans for; which, when you think about it, is kind of crazy, considering how many alternative communication systems we have. So like, do you think that email is more or less convenient for you guys than something like WhatsApp, or Slack or video chats?

Keumars

That's a, that's a very good question. Because I actually think it's more and less convenient, in different ways. I think the, what it comes down to for me is - and I've been thinking about this, because I hate email, and I want it to die - but I think it serves a very important purpose in a sense that it's a space where you know, it's a medium where a lot of people who are going to try to communicate with me only live there, they're not bleeding into places like WhatsApp or you know, whatever platform you might choose to use, you know, where you might you know, actually choose to speak to people, your contacts and so on. It's a very useful way of keeping people at arm's length to some extent.

Sabina

Yeah, I think I agree. Yeah, I think email, I use email for work, mostly. Slack I dedicate mostly to sort of like within company messaging, like with you guys, while WhatsApp I don't have any, I don't want to use WhatsApp for work. WhatsApp is for me for receiving dog pictures from my mum. That's like, WhatsApp is like you know, personal time and yeah, that's that's for my friends and family. So I tried to keep people off WhatsApp, definitely. Email for me, I treat it some as a sort of like, I kind of treat it like an instant messaging platform as well a bit, especially since I have it on my phone. I you know, I answer a lot of emails like from my phone. Yeah. Especially if I'm if I'm out somewhere. And if you if you have time off, for example, if you're going on annual leave, you mute your email app, right. Yeah, and that's for one that you set out of office for and yeah, so this is like for me email is, is definitely a good way to sort of like to to establish the sort of like healthy boundary between work and personal life.

Adam

Hmm. Well, here's an interesting question then. Do you think your opinion would be different if you had have a dedicated work phone with like a separate WhatsApp account. And you know, separate instances of, you know, things like text messaging and WhatsApp and other kind of - or like a dedicated business Twitter account or Instagram account or whatever that was just for kind of work messaging.

Sabina

Yeah, I think I think so. I mean, my, my flatmate has a work phone. And so I see the way she sort of like, struggles with two devices at times and like, tries to make sure she has both. I think it's an added stress, because like, you're not only like trying to not lose your own phone, but also your company phone. So I think it's just like a bit of an added burden. But then at the end of the day, like, I see her just, like, switch her phone off, like, her work phone off and to me that's, you know, that's, that's pretty cool. I mean, that's, you know, she's like, she switches off at 6pm. And that's it for the day, I only like, switches it back on in the morning. And, for me, that's great. Like, for me, I still see emails, like every every part of the day. So yeah, there's like, coming coming into my phone, even if I shut my work laptop, so yeah, yeah.

Adam

And I think in terms of the convenience of basically anything that isn't email, I do find it much, much easier to kind of get, get things done quickly, in terms of speaking to people and getting information and having those very kind of quick interactions where you don't necessarily need to dump a load of information. It's just, you know, Hi, do you have X, or, you know, are you free at X time, done. And there are, there are a few kind of professional contacts that I know well enough to, you know, to have their their numbers and to talk to them on, you know, WhatsApp, or Facebook Messenger or whatever, whatever it might be. And I find those interactions are much, much more convenient than people that I have to email. And it's the same thing with Slack, there are a few people, kind of within any organisation that will default to email, even when platforms like Slack or Google Chat or whatever, are, are available. And having to kind of fall back on email feels really clunky and slow, when you're used to things like Slack, which have not just the kind of the sort of instant response quality, but also the flexibility in terms of things like sharing links, or videos or, you know, working collaboratively and all all the kind of stuff that that goes along with instant messaging. So I do I do find the idea of doing more of my professional communication over WhatsApp and instant messengers to be quite an attractive proposition.

Keumars

I mean, the user interface is certainly loads better on platforms like Slack, and the overall experience is just so much cleaner and more pleasant. And, you know, it's like a godsend that we don't need to use email to talk with each other. We don't need you know, hundred message long email chains, sharing GIFs and so on.

Adam

But there are plenty of organisations where that's still the case. Yeah,

Keumars

Absolutely true. And I can't, I can't believe that, for me, it used to be that way; places I've worked in the past and just moving on from that, it's, it's so much better. But I guess, in that sense, there's still a place and a role for email. When you're, I guess more communicating externally, then amongst yourselves or with personal contacts.

Adam

But Slack has been rolling out kind of more and more tools to try and make that kind of cross company collaboration easier. You know, they've got things like shared channels, they've got things like shared workspaces, single channel guests, for bringing in people from partner organisations, all of which is kind of designed to make it easier to hook two kind of Slack instances together. And Microsoft Teams is doing similar things. And this idea, I'm surprised that it hasn't gotten more traction, because it does, you know, let organisations move away from that whole long, winding email thread thing, and there is nothing worse then trying to find one specific piece of information that is buried in an email thread with like, 80 responses in it.

Keumars

Yeah, absolutely. I suppose the the question would be, how would that work in practice? Because it helps me to kind of look at Slack or alternative platforms as a way of, you know, this is your organisation, these are the people within, you know, these are the different departments and you know, who to contact for what, and it's all very, you know, there's a space, it's quite clean. Now, if you try and bring in other organisations and other Slack instances, I think it could potentially get very messy if it's not managed carefully.

Adam

Well, I have had some experience with this. And it is surprisingly easy to kind of to bring those external individuals and external organisations into Slack environments, you know, it's very straightforward to bring bring them in and give them access to a specific subset of channels, whether that's channels for, you know, particular projects, or for ongoing kind of areas of concern. For example, if you have a, an MSP who's providing IT services, you can bring them in and give them kind of full DM access to anyone in the organisation, but restrict their access to kind of channels within Slack environments, to specific kind of IT focused ones. And the kind of permissions and access controls around that are actually really quite robust for that kind of thing. And it's so much more convenient than having to raise kind of email tickets.

Keumars

I, I'm not going to argue with that. I absolutely don't think there's much about email that is convenient.

Adam

So one of the features that Slack tried to roll out to try and kind of help enable this kind of cross company connection was Slack DMs, which was part of the kind of overall Slack Connect kind of feature set, which was essentially a way for anyone on Slack to DM anyone else on Slack, regardless of whether or not they were part of the same kind of company or organisation. They could just send them a message from their Slack instance, to the other person's Slack instance. But that was very swiftly dropped.

Keumars

There were lots of harassment concerns, if I remember correctly, I think it was 24 hours, 48 hours, something like that before they rolled it back.

Adam

It was a very quick turnaround, yeah.

Sabina

I mean, they did try to save it by introducing these security features. In late 2020, I think they announced that they were planning to roll out sort of verification for users, as well as this firewall protected app builder, apparently, but yeah, then ultimately, it became, I think we abandoned the external message invites, like, completely in early 2021. In March.

Keumars

You've essentially just described how email works anyway, though. I mean, anyone could set up an email account and message anyone's publicly available email address with anything they want. And often, there's no verification at all. You'll get abuse, harassment, and all sorts of unwanted messages. I'm, to some extent, I'm playing devil's advocate here, because I don't think that's great, either. But it's, it's curious to me how thinking back, Slack faced such heavy backlash over this, when essentially, they were trying to replicate a feature that's been around since email was invented. And I'm wondering, I guess why that happened, why people didn't kind of connect the dots in a way, but also what that says about email.

Adam

Well, one of the big problems with that Slack feature in particular is because the, so how it would work is you would get an email, essentially, in your inbox saying, oh, you know, so and so wants to invite you to collaborate on Slack and you could add a little, a little note to that request. And there was no filtering on the the notes. So the note to kind of connect on Slack, could say whatever, regardless of how kind of, you know, violent or abusive or whatever it it was and because these invites were landing in people's inboxes from a generic Slack email address, you know, the whole kind of like, no reply, you know, automated email sender type things, there's no way to, to block it, really. Whereas if it's someone just, you know, emailing you from their email account, even if it's a disposable burner account, you can block that sender. And then, you know, they, you know, at the very least they had to set up a new account to keep emailing you. So that was one of the kind of the big issues, but I do sort of see what you mean Keumars, in terms of it does make you kind of reassess some of the kind of inherent issues of email that we've all just kind of, I guess, learn to live with, you know, because it's been normal thing.

Keumars

We've priced it in.

Adam

Yeah. We're just sort of used to it.

Sabina

I mean, it's interesting that this got such a, such sort of like massive backlash. And yet, you know, it wasn't even - I mean, maybe I'm just like, comparing apples to oranges - but this isn't even like a fraction of how bad the zoom-bombing issues were.

Adam

Oh, yeah.

Sabina

So that was, that was really bad. I think it took like months to fix. So you know, that was like, dominated sort of like headlines, like, during the first months of the pandemic, of like, how people were getting, they were getting bombarded by porn, and some really, you know, awful stuff. And yeah, and that took, like, ages to fix.

Adam

And that kind of stuff was still happening, even as recently as, you know, this year, there was something I think in January, with the Italian Senate. And it does kind of, it does illustrate that there are still... for want of a better word, there's still kinks to be worked out with the with the setup.

Sabina

Yeah, I think it was even, I think there was some, you know, pretty significant court proceedings, which were also, you know, subject to some Zoom-bombing.

Keumars

I remember that.

Adam

So given how heavily companies have invested in platforms like Zoom, and Slack, both in terms of the kind of financial investment, but also just the time it takes to set up and kind of roll these out. They're great for internal collaboration. They're fabulous for letting employees talk to each other, more efficient collaboration between teams. You know, we've talked about that, at length, both on this show and on the site in general. But what is kind of stopping them from crossing that gap into letting companies communicate with other, other organisations and other partners?

Keumars

I suppose for me, the thing is all about interoperability, right? So you might have 10 different businesses with 12 different platforms, and some might be compatible. Some might not be, whereas email is pretty universal, isn't it? I mean, doesn't matter which provider you're using, you can get in touch with anyone you want.

Sabina

Yeah, you're totally right. I think, I think especially the pandemic and has, has, like, caused this sort of, like pressure that, you know, obviously, sort of, like, it's great that there are like, so many new platforms to, to conduct business on whether it's, you know, video conferencing or emails or you know, or instant messaging. But then also, we also have, we face this, face this pressure to be available on all of these platforms, and to check these platforms and, you know, okay, maybe not Zoom, but like, you know, there's email, there's like WhatsApp, there's, like, you know, all of these different different platforms to be, you know, that we are expected to be constantly available on and, and, you know, in case we miss a significant business opportunity, for example, and, you know, I just, it's, it's not great. I think that's basically we're just, teah, we're just hopping through apps throughout our whole life. Like it's, it's, you know, there's nothing it's, it's really exhausting, honestly, and, and, and yeah, and I wish there was just like, one app, where everything was done.

Adam

Well, that's, that's the thing. I think, the key difference for me, between email and these kind of newer collaboration platforms, is that email was developed, you know, really back in the back in the 70s and 80s. And it was developed by researchers and academics. And it was developed as an open standard, that people then built kind of proprietary clients on top of, it wasn't built as a kind of walled garden enclosure where you had to be, you had to be on one specific platform in order to use it. And I think that's why it's persisted so much; that openness means that it is, you know, it doesn't matter what email client you're using, you know. If, if email was developed today, if I, you know, if I was on Gmail, I probably wouldn't be able to email someone that was using Outlook.

Sabina

Yes, that is a very good point. Yeah, I think, I never thought of this. I think it's, you know, I think we're very lucky to have this. And I just hope that in the next 10 years, this won't be rolled back. You know, because I can see this, this being a potential to gatekeep like, by tech giants, but yeah, I really, I really hope that's not the case.

Keumars

It's the way of the world, isn't it? You were mentioning to me, Adam, the the way the metaverse is developing now, which is, if you if you like, the next frontier of all this nonsense. In a sense, it's totally, you know, to borrow your phrase, wall-gardened, everything is inaccessible. If you want to hop from from one Metaverse to another, I mean, it's, they're not highly developed yet, but you can't imagine anything like that with regards to email.

Adam

Yeah, I mean, to be honest, I think we should just bring back IRC. I think that would solve a lot of these problems.

Sabina

What is that?

Adam

Just I mean... Oh, there's, I would imagine a good 40%, at least, of our audience has just winced. IRC is a technology from from the olden times; it was essentially the the first kind of, the first real instant messaging service. And it was based on this, this kind of open principle, the the IRC kind of protocols were, you know, the underlying fabric that people then built clients on top of, it was essentially, if you're familiar with kind of MSN Messenger, or AOL or anything like that, it was that kind of thing. But it was, it was very kind of widespread. And, you know, I think there's, there's a lot to, there's a lot to say, for IRC as a kind of as a protocol. And I think, moving things like Slack and Teams, and all the rest of it, to have IRC kind of underneath them, and linking them together - I think that would just be a better, a better way to do things for everyone. So, on that subject, then, do you ever think that we'll see email going away? Do you think we could conceivably see it replaced by a newer or more convenient technology?

Sabina

I hope not. I think it will be ultimately. And I think we'll, I don't know, maybe in 20 years, we'll be forced to conduct you know, any sort of like, inter-company communication through like the metaverse.

Adam

Oh god. Horrifying thought.

Sabina

Yeah. It's, it's scary. And I don't know, I really hope it doesn't. I feel like especially, you know, I think I spend most of my week, if not life, writing, and for me, email is most natural. You know, it's, it's, it's written communication. And, and I hope we don't have to, you know, completely abandon that in favour of some kind of new... Like, I don't know, like, can you imagine if, if email was completely replaced by video conferencing? Can you like record a message by bit? Yeah. Or even like, yeah, it's just, it's insane. It's...

Keumars

Yeah, shut it down.

Adam

Yeah, yeah. Imagine if it was all voice notes. If like written messages just went away.

Sabina

I do see that trend. Definitely. I think I think I would just retire. I think, no, absolutely not.

Keumars

I strive to keep communication as limited as possible in my life, at all points. So I would, I would find that horrifying. Absolutely horrifying.

Adam

Yeah. I mean, it does solve the problem of it being very hard to read tone over text. But yeah, I'm inclined to agree if, if it was all voice notes, I would just roll out the window, I think.

Sabina

Yeah, no, absolutely not.

Keumars

I have flashbacks to redoing a voice message on an answering machine about 10 times before I was happy with the way I sounded. I mean, talk about productivity. I think I might spend a day doing voice notes.

Adam

Yeah. Like, no have to have to redo it,

Sabina

I think you should be very happy that you're in a relationship, because a lot of dating apps are rolling out voice messages right now.

Keumars

I was not aware of this.

Sabina

Yep. Hinge makes you, it like almost forces you to add a voice note to your profile so that people can hear your voice. And then people also send you voice notes as well. Like, if they want to say something to you, it's absolutely horrendous.

Adam

We we should go back to doing all of our communication with long form emails.

Keumars

I'd go one further, I think we should all just write letters to each other. I think it would slow things down quite nicely, I think, you know, give each other more time to think and more time to process information. And, you know, if we really, really want to talk to someone, then we'll have to write a letter.

Sabina

Yeah, I would really like to receive any PR, like message or sort of like business offer by sitting on my front porch with some iced tea and someone rolling up on a horse and giving me, yeah, and handing me a handwritten letter from pitching, you know, whatever interview they want. So, this is how I imagine how it would be in a perfect world.

Adam

Yeah, I want all my press releases to arrive on a scroll with a wax seal. Yeah. Preferably delivered by a bugler.

Keumars

Well, you see, you say this, someone's going to hear it. And you know, two weeks down the line, you never know, you might be surprised.

Adam

Well, unfortunately, I'm afraid that's all we've got time for on this week's episode, but you can find links to everything we've spoken about today in the show notes, and even more on our website, itpro.co.uk.

Keumars

Don't forget to subscribe to our social media and YouTube channel for more great content and leave the podcast a rating and a review.

Sabina

We'll be back next week with more analysis from the world of IT. But until then, goodbye.

Adam

Bye.

Keumars

Bye.

It seems that in the world of modern IT, you can’t swing a cat-6 cable without hitting four or five cloud-based platforms that are trying to revolutionise business communication. Despite the rise of platforms like Slack, Teams, Zoom and more, however, emails remain by far the most widely-used method of professional communication.

In this week’s episode, we take a look at why this comparatively ancient technology still persists so widely, as well as the advantages that it offers over newer platforms, and what inspiration they can take from it.

Highlights

“What it comes down to for me is - and I've been thinking about this, because I hate email, and I want it to die - but I think it serves a very important purpose in the sense that it's a medium where a lot of people who are going to try to communicate with me only live there; they're not bleeding into places like WhatsApp or whatever platform you might choose to speak to your contacts and so on. It's a very useful way of keeping people at arm's length, to some extent.”

“I think the key difference between email and these newer collaboration platforms for me, is that email was developed back in the 70s and 80s. And it was developed by researchers and academics as an open standard, that people then built proprietary clients on top of. It wasn't built as a walled garden enclosure where you had to be on one specific platform in order to use it. And I think that's why it's persisted so much; that openness means that it doesn't matter what email client you're using. If email was developed today, if I was on Gmail, I probably wouldn't be able to email someone that was using Outlook.”

“I would really like to receive any PR message or business offer by sitting on my front porch with some iced tea and someone rolling up on a horse and handing me a handwritten letter pitching whatever interview they want. This is how I imagine it would be in a perfect world.”

Read the full transcript here.

Footnotes

• In the end, email might actually kill off Slack
• Managing the oversaturation of workplace platforms
• Microsoft declares Slack isn't secure enough for its workers
• Slack plots 'enterprise-grade' security updates for Slack Connect
• Email is killing productivity, new research finds
• Zoom settles $85 million lawsuit over 'zoombombing', privacy policies
• The dangers of nighttime Slacking
• Working from home has created an "overtime epidemic"
• The IT Pro Podcast: Everyone needs Kubernetes certs
• The metaverse is a waste of time, effort and processing power
• How to give your business a voice
• Four ways the cloud facilitates workplace collaboration
• A new age of collaboration tools
• The social impact of remote collaboration
• Google and Microsoft's hybrid work battle shows the narrative is just as important as the technology
• IT Pro Panel: Why collaboration platforms are so hard to deploy
• How CIOs can build effective cross-business collaboration

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Cisco has fixed a bug that could allow attackers to lock up its email security appliance with a single malicious email.

The bug, which has the ID CVE-2022-20653, affects Cisco's Email Security Appliance (ESA), an email security gateway product that detects and blocks email-borne malware, spam, and phishing attempts.

The problem lies in the ASyncOS operating system that the ESA uses, according to an advisory issued by the company this week.

The problem lies in the appliance's use of DNS-based Authentication of Named Entities (DANE) for security. DANE uses the more secure DNSSEC protocol to provide extra verification that a DNS record is legitimate. This makes it harder for malicious actors to spoof digital certificates or use man-in-the-middle attacks to misdirect DNS requests.

However, Cisco found that ASyncOS was unable to properly handle DNS name resolution, opening it up to exploit through malicious inputs.

In this case, the malicious input would be an email and, if crafted correctly, could freeze the appliance's management interface and stop it processing further emails until it had recovered.

Cisco has classified the vulnerability, which has a CVSS score of 7.5, as a denial of service (DoS) bug.

"Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition," Cisco warned.

The DANE feature is not enabled by default, meaning that only those who have activated it will be affected. Those customers can install Cisco's software updates to fix the problem.

In the meantime, customers can also configure bounce messages from the ESA instead of from downstream dependent email servers to stop attackers exploiting the bug, the company said.

The ASyncOS software saw two other reported vulnerabilities last year. CVE-2021-1566 was a bug in its Cisco Advanced Malware protection for Endpoints integration, allowing the interception of remote traffic. The other, CVE-2021-1359, allowed attackers to gain root privileges.

A quarter (24.77%) of all spam emails sent in 2021 originated from Russia, with more than half (56%) of all emails being spam messages.

That's according to Kaspersky’s latest Annual Spam and Phishing Report, which analysed close to 150 million malicious email attachments blocked by the cyber security provider’s antivirus over the course of last year.

Kaspersky identified 10 countries that were responsible for sending out more than three quarters of the world’s spam emails, with Russia and Germany (14.12%) being the most prolific senders.

The US and China came in third and fourth place, at 10.46% and 8.73% respectively. The Netherlands (4.75%) came in fifth place, followed by France (3.57%), Spain (3%) and Brazil (2.41%), Japan (2.36%), and Poland (1.66%).

When compared to 2020, Russia and China had the most significant rise in sent spam – a 3.5% and 2.5% increase, respectively.

Brazil-based users were most often targeted by phishing attacks, with 12.4% of 2021’s victims being based in the South American country, followed by French, Portuguese, and Mongolian users.

When it came to content, 2021’s spam emails mostly centred around popular topics including money and investment, Bond and Spider-Man movie premieres, and the pandemic, which Tatyana Shcherbakova, security expert at Kaspersky, described as “bread and butter for scammers”.

The most notable COVID-related scams included fictitious financial support schemes and fake COVID vaccination passes and QR codes, Kaspersky found.

“These scams prove to be very efficient as people continue to trust too much of what they see in their inboxes and browsers. We believe it is important to be aware that there are a lot of offers out there that seem “too good to be true”,” she said, calling on people “to be cautious when it comes to trusting what’s in their email”.

“This approach may help them save their private data and money,” Shcherbakova added.

Kaspersky’s findings come weeks after Microsoft issued a warning about hackers targeting Microsoft 365 users with a fake app capable of stealing OAuth authentication tokens, providing them full access to the victim's email, calendar, and contacts.

Microsoft has released an emergency patch for a flaw in Microsoft Exchange that prevented emails from sending at the turn of the new year.

Businesses running on-premise Microsoft Exchange environments reported encountering issues whereby emails were stuck in a queue instead of sending after the yearly date changed to 2022.

The issue has been attributed to Exchange's malware scanning engine which manages dates in the form of 32-bit variables. The variable's maximum integer value is 2,147,483,647 but a variable of 2,201,010,001 is required to display the date as 1 January 2022 - a value that exceeds the maximum and caused the engine to crash.

Microsoft said the situation is not caused by a fault in either Exchange or its malware-scanning engine that affects the effective running of the products, but rather the engine's date-checking process. Microsoft also said this is not a cyber security issue.

Customers can check if the issue is affecting their on-premise solutions by checking the Application event log on the Exchange Server for the following errors, specifically event 5300 and 1106 (FIPFS).

Microsoft Exchange customers will need to intervene and apply the patch themselves in order to restore smooth email functionality. Microsoft detailed the step-by-step process customers can follow if they wish to patch manually, and also supplied a downloadable script for customers who want to take the automated solution.

The script "will take some time to make the necessary changes, download the updated files, and clear the transport queues," Microsoft said. Whether customers choose the automated or manual steps towards remediation, they must be carried out on every on-premises Exchange 2016 and Exchange 2019 server. The automated script can run on multiple servers in parallel.

Members of the IT community have dubbed the issue the 'Y2K22' bug for its similarity between it and the issue that threatened to break all computers at the turn of the millennium.

Both issues are based on the way computers handle dates and it required millions in investment and lots of work to combat the original Y2K bug.

Organizations in the education sector and local and state government are most at risk from email threats, according to a new report.

The report, published by IT security firm Cyren, also found that phishing remains the dominant form of attack against all industries.

Based on data gathered from nearly 45,000 incidents, researchers found that the education sector received over five threats per thousand emails received. State and local government bodies received just over two threats per thousand emails received, nearly double the amount received by the next most targeted industry, software.

The report also looked at the number of attacks per 100 users across a wide range of industries. It found that there were nearly 400 per 100 users in education compared to just over 150 in the construction industry.

Researchers said there was a surprisingly low rate for manufacturing, especially when compared to the construction industry, which is closely related.

“We observed 20 confirmed threats per 100 users in the manufacturing vertical. Without solid detection and automated incident response, a manufacturer with 100 Office 365 users would spend at least 16 hours manually investigating and remediating emails,” they added.

In a blog post, security researchers found that the data supported a widely held theory that phishing is a precursor to more damaging attacks such as business email compromise (BEC) and ransomware.

The report looked at phishing compared with malware and BEC attacks across four industries. Phishing remained the dominant threat in healthcare (76%), finance and insurance (76%), manufacturing (85%), and real estate (93%).

In healthcare, BEC attacks made up the remaining 24%. Researchers said that robust malware detection capabilities in the healthcare industry explains the high rate of BEC attempts.

“Attackers understand that they can’t easily slip malware past automated defenses, so they have shifted to social engineering tactics,” said researchers.

Researchers said that when it comes to solving the email threat problem, user education is an important component, but several organizations have “over-rotated” on the idea that users are responsible for keeping sophisticated email threats at bay.

“The predominant trend is to use an email hygiene technology such as Microsoft Defender for Office 365 to catch 80% of threats, deploy a specialized add-on to catch and contain zero-day phishing and most BEC attempts, enable employees to perform initial analysis on the small percentage of emails that are classified as suspicious (rather than malicious or clean), and automate incident response workflows to save time and reduce exposure,” added researchers.

Hackers are using ProxyShell and ProxyLogon exploits to break into Microsoft Exchange servers in a new campaign to infect systems with malware, bypassing security measures by replying to pre-existing email chains.

Security researchers at Trend Micro said investigations into several intrusions related to Squirrelwaffle led to a deeper examination into the initial access of these attacks, according to a blog post.

Researchers said that Squirrelwaffle first emerged as a new loader spreading through spam campaigns in September. The malware is known for sending its malicious emails as replies to pre-existing email chains.

The intrusions observed by researchers originated from on-premise Microsoft Exchange Servers that appeared to be vulnerable to ProxyLogon and ProxyShell. According to researchers, there was evidence of the exploits on the vulnerabilities CVE-2021-26855, CVE-2021-34473, and CVE-2021-34523 in the IIS Logs on three of the Exchange servers that were compromised in different intrusions.

“The same CVEs were used in ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473 and CVE-2021-34523) intrusions. Microsoft released a patch for ProxyLogon in March; those who have applied the May or July updates are protected from ProxyShell vulnerabilities,” said researchers.

In one case, all the internal users in the affected network received spam emails sent as legitimate replies to existing email threads.

“All of the observed emails were written in English for this spam campaign in the Middle East. While other languages were used in different regions, most were written in English. More notably, true account names from the victim’s domain were used as sender and recipient, which raises the chance that a recipient will click the link and open the malicious Microsoft Excel spreadsheets,” they said.

In the same intrusion, researchers analyzed the email headers for the received malicious emails and found that the mail path was internal, indicating that the emails did not originate from an external sender, open mail relay, or any message transfer agent (MTA).

“Delivering the malicious spam using this technique to reach all the internal domain users will decrease the possibility of detecting or stopping the attack, as the mail getaways will not be able to filter or quarantine any of these internal emails,” they added.

Researchers said that the hackers also did not drop or use tools for lateral movement after gaining access to the vulnerable Exchange servers in order to avoid detection. Additionally, no malware was executed on the Exchange servers to avoid triggering alerts before the malicious email could be spread across the environment.

According to researchers, the recent Squirrelwaffle campaigns should make users wary of the different tactics used to mask malicious emails and files.

“Emails that come from trusted contacts may not be enough of an indicator that whatever link or file included in the email is safe,” they warned.

Email forms a critical part of modern business operations, with this technology so prevalent that some individuals have multiple email accounts. Its ubiquitous nature, however, also makes it dangerous, with accidental reply-all messages potentially damaging business productivity and grinding IT systems to a halt. These email storms can even inadvertently replicate the effects of distributed denial of service (DDoS) attacks.

One of the reasons reply all storms pose such a risk is they’re so easy to execute, and a simple reply-all message to a multi-recipient email can accidentally disrupt an entire organisation. Reply all also places a significant load on servers, with demand for resources rising substantially depending on the number of recipients, as well as the number, and size, of attachments. “Data storage can be filled with surprising rapidity when a user sends a large document, especially one containing video media or similar, to multiple recipients locally,” explains Gary Smith, a customer services engineer for Capita.

Lina Siegl, a PhD researcher with the University of Manchester, also notes that reply all can disrupt productivity. “Even if it only takes you five minutes to pick up your thought where you left off, if this happens six times a day, you’ve lost 30 minutes a day,” Siegl says. “That means you probably spend over a day each month wasting time just looking at unnecessary email traffic.”

The perfect storm

A classic example of reply all causing an email storm was when a test email was sent to 840,000 NHS accounts in November 2016. This resulted in 186 million emails being sent as various recipients responded – also using reply all. The subsequent statement by the NHS had to be issued over the phone, as their email system had ground to a halt, according to BBC News.

Not only are the largest organisations at risk, however, but relatively smaller businesses too. For example, IT consultant Chris Clemson recalls an incident in which somebody sent a Christmas card to everyone in a company with several thousand mailboxes. “The email itself had an 8MB bitmap image file in it,” he says. “Then, people started replying saying “please don't send this”, while still including the 8MB picture, which exacerbated the problem. The only real damage it caused was poor performance for a day, some admin, and more helpdesk calls, but it showed how easy it is to make the problem worse.”

Another danger is inadvertently leaking data through a reply-all message to multiple recipients. Not only can this violate GDPR, but confidential and sensitive information may be shared. “Even the most honest business deal can be irreparably damaged if internal discussions and opinions are accidentally leaked to a business partner as if they were company policy,” Smith explains.

Such an incident occurred when a mother and child were moved to new accommodation to escape domestic abuse. Because the accused was representing himself in court, he was exchanging emails with solicitors and the court. He received, through a reply-all chain, an unredacted statement that included the mother’s new address. This isn’t the only example, however, with the Independent similarly reporting that family courts were putting domestic abuse victims at risk by sharing their addresses with abusive ex-partners.

Technological solutions for a human problem

One obvious mitigation is for organisations to block reply-all functionality entirely using information rights management (IRM) tools, which have been available for years. IRM, however, requires administrative efforts to properly manage. “Active Directory (AD) allows the creation of permission groups, which become the basis for email policies,” explains freelance network administrator, Peter Gatehouse. “It isn’t a lot of extra work unless there’s a mass reorganisation; it's more creating a policy and allocating the respective groups.”

Alternatively, should organisations wish to retain the option of using reply all when required, there are various add-ons for your app of choice that allow the original sender to decide whether recipients can use reply-all messages. There’s also Microsoft’s Reply All Storm Protection tool, launched in May, which is intended for larger organisations using Office 365 or Exchange Online. This tool blocks all subsequent replies to an email thread for four hours once it detects ten reply-all emails to more than 5,000 recipients within the space of an hour. It still allows for some strain to be placed on the server, but far less than if it weren’t there.

One of the key challenges is developing a solution compatible with multiple email clients. While all applications essentially operate in the same way, they don’t fully integrate with one other. Although an organisation may have strict email policies in place, too, external parties may not, unless it’s been pre-agreed in a contract.

Embedded attachments within reply-all messages, meanwhile, produce additional strain. They can be mitigated by blocking attachments and requiring internal staff to use collaborative platforms, or smart email systems. “Smart email systems recognise that the same file is going to everyone, and they cache a single copy on the server,” explains Gatehouse. “This can, however, still cause a flood of network traffic, if many people attempt to access a large attachment within a short timeframe.”

Life after email

Some people go so far as to shut down their email applications to avoid being distracted, but this means they could miss urgent information. Some recipients also use filters or rules to prioritise emails in which they’re addressed in the To field rather than CC or BCC fields. Senders of reply-all emails, therefore, need to be aware that any important information in their reply may be missed.

Reply all is, ultimately, a human problem and whilst technological solutions exist to mitigate the problem, only a cultural shift in how we approach online communications will resolve it. One solution is training staff in the best ways of using email, such as encouraging staff to use mailing lists, as well as using appropriate communications platforms and collaborative tools for sharing information.

“If you want to send a message, where everybody can collaboratively speak about an issue, there’s a better format than reply all on an email chain,” Siegl says, adding you could create a group on communications platforms such as Teams and Slack, among a host of others.

Ultimately, reply all is a global problem, and little can be done to stop receiving reply-all emails from external parties. Nonetheless, with the appropriate safeguards and training in place, the worst effects of an email storm can be mitigated.

Cloudflare has announced its foray into the email security industry with two new offerings.

New email capabilities, available for free, will help customers create custom email addresses, manage incoming email routing, and prevent phishing attacks on outgoing emails.

Designed to enhance email management, Cloudflare Email Routing lets businesses set up custom domain email addresses that automatically forward mail to users’ preferred mailboxes (Gmail or Outlook).

The professional addressing capability is of particular importance for small businesses seeking custom domains for their email addresses while retaining the familiar Gmail interface.

Cloudflare’s second offering, Email Security DNS Wizard, protects businesses from phishing and spoofing attacks. Besides assisting website owners with creating DNS records, Cloudflare’s DNS Wizard displays warnings and recommendations that alert users to security threats.

Customers can configure Sender Policy Framework (SPF) or DomainKeys Identified Mail (DKIM) with a single click to prevent bad actors from forging emails from unsuspecting users.

Cloudflare also announced the launch of its Advanced Email Security Suite. Fully integrated with Cloudflare’s Zero Trust solutions, the new suite enables comprehensive email scanning for security risks and complements spam protection capabilities of any email hosting provider.

“Customers have asked us to address email security for years. Today we’re announcing new tools that will help close the biggest remaining network security risk that Cloudflare hasn’t already covered, until now,” said Matthew Prince, co-founder and CEO of Cloudflare.

“We want to be the network that businesses of any size can plug into for all of their needs. While today marks our first step into this space, we ultimately hope to become the leader in email security.”

Brand Indicators for Message Identification (BIMI), a standard for visually proving an email’s legitimacy, got a boost today with the launch of a new automation tool from email security company Valimail and official support from Google.

Launched as a formal specification in 2019, BIMI is a standard that lets companies define what marketing image is displayed next to emails sent from their servers. This image, which the BIMI working group calls a “brand assertation,” serves as visual proof that the message is authentic.

BIMI uses DNS records to define the image, and it also relies on the Domain-based Message Authentication, Reporting, and Performance (DMARC) standard, which helps protect against phishing. This, in turn, relies on two other technologies: Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM).

DMARC and its underlying technologies help to prevent email spoofing, in which phishing attackers fake a sender’s domain in an email’s “From:” field. DMARC enables administrators to publish their policy for authenticating and rejecting emails.

When a DMARC-supporting email server receives an email, it uses DNS to look up the DMARC record for the alleged sender's domain. It then checks the mail's DKIM digital certificate to ensure it matches the alleged sender's DKIM certificate. It also verifies the message came from IP addresses listed in the SPF record.

While not a security solution, BIMI uses these technologies to verify the image attached to an email is really from the sender.

An incoming email server uses DMARC to authenticate the message. If the email passes the DMARC authentication, the email server uses DNS to retrieve the sender's BIMI image. The BIMI image then shows up next to the company's name in emails.

Boosting its legitimacy, BIMI also got official support from Google following a year-long pilot project. The company will now officially support BIMI in Gmail, according to the AuthIndicators Working Group, which manages the BIMI effort.

This official acceptance by Google means for an organization's logo to be eligible for display in Gmail, a brand must obtain a BIMI certificate confirming its right to use the image. These certificates are tied to registered trademarks from select jurisdictions.

Several other companies also support BIMI in pilot mode, including Yahoo!, AOL, Netscape, and Fastmail. Comcast was also planning BIMI support as of last October. Microsoft, however, still has not signed on to the program.

To help streamline this process, email security company Valimail, which claims to have “founded, named, and resourced the BIMI standard,” announced Amplify, a tool that automates BIMI support. With Amplify’s release, Valimain looks to make BIMI the baseline for all email security.

Along with the new product, Valimail debuted partnerships with certificate providers DigiCert and Entrust to develop BIMI further and create a straightforward process for companies to enforce DMARC and Verified Mark Certificate (VMC).

The threat landscape is constantly evolving, with hackers finding new and ingenious ways to attack businesses. One constant, however, is the prevalence of email as an attack vector, ever since its rise in popularity in the 1990s.

The wide usage of email has made it a ripe target for hackers, and today, 95% of all hacking attacks and data breaches involve email. Domain spoofing, in which an attacker pretends to send an email from a legitimate domain, is a tactic often used in phishing - which accounts for 80% of cyber attacks.

With email a vital form of communication not only between and within organisations, but with consumers in our digital age, we explain how you can defend your organisation against domain spoofing and the benefits you'll see from doing so.

What is DMARC?

DMARC – which stands for domain-based message authentication, reporting, and conformance – is an email authentication protocol that helps protect against spoofing activity.

Through DMARC, domain owners can monitor what emails are sent using their domain and receivers have a clear way of reporting illegitimate emails.

The domain owners confirm their messages are protected by two existing authentication techniques, SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). On the receiving end, emails that don't use SPF and DKIM are rejected or put in the junk or spam folders.

An organisation's DMARC record is published alongside its DNS records. These records help the organisation see who is sending emails through their domain and make it easier for internet service providers to perform a DMARC check and stop malicious messages.

Growth of DMARC

The DMARC guidelines were first published by PayPal, Google, Microsoft, and Yahoo! In 2012.

Security experts in the financial industry were the first to adopt DMARC more widely, and since then it has grown in popularity. A report from Valimail showed that the number of domains using DMARC rose from 125,000 in January 2017 to almost a million in January 2020.

Currently, the protocol is awaiting approval by the Internet Engineering Task Force to become an open standard in the US, and is included in the UK government's official guidance for secure email setup.

Pros and cons of DMARC

DMARC is a powerful tool that improves the deliverability of a business' emails. Without it, your domain is 4.75 times more likely to be a spoofing target.

SPF and DKIM are more siloed methods of domain authentication, which DMARC is meant to address, combining the use of these methods and adding a reporting function.

DMARC is beneficial at a small scale, improving your reputation and increasing your visibility into your email programme, but it also benefits the wider email community by setting a consistent standard that increases the overall trustworthiness of email communications.

However, DMARC is slightly limited in what it can do. It only protects against direct domain spoofing, in which someone is saying they are sending from a legitimate domain, rather than 'cousin' domain attacks that originate from domains that are, say, only one letter off from a legitimate domain.

In addition, DMARC only really offers protection against impersonation when it's combined with an enforcement policy. When purely used for visibility, it gives an organisation great insights but doesn't do anything to stop impersonators. Through enforcement, you can set policies to deal with unauthorised emails that stop them before they are even sent out.

With three billion messages per day still including a spoof of the sender's identity, DMARC is by no means a conclusive solution to email attacks, but it is still an important tool that all organisations can easily enact to protect themselves, their customers and partners, and their reputation as a trustworthy, safe business.

Three billion emails last year showed signs of spoofing activity, according to a report released today.

The Email Fraud Landscape Spring 2021 report from email security company Valimail found that intruders are still targeting email domains that don't use a common protocol called Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a tool to help organizations protect themselves against email spoofing.

DMARC is an email authentication protocol that lets a domain owner confirm that their email is legitimate with a recipient. That prevents domain spoofing, in which an attacker pretends to send an email from someone's domain. Domain spoofing is a common technique in phishing campaigns, where an attacker will impersonate a victim by sending emails in their name.

Domains without DMARC protection are 4.75 times more likely to be spoofing targets than domains with DMARC enabled, the report added.

Valimail analyzed data from DMARC aggregate reports that it collected on behalf of its customers last year. The analysis showed that at least 1% of global email traffic contains suspicious sender activity that’s probably fraudulent. That amounts to three billion messages, the company estimated.

On the plus side, the number of emails likely to be spoofed is falling. In 2017, around 5% of all emails showed suspicious activity, although that was due to an unusually high-volume campaign that hit media organizations that year, the company said. Suspicious activity fell to just over 2% in 2019.

This decrease is due in part to the number of domains using DMARC, Valimail said. In January 2017, around 125,000 domains used the protocol. By January 2020, that had risen to almost 1 million, and it continues to increase. The figure currently stands at 1.28 million domains.

Simply enabling DMARC is only a partial solution, warns the report, pointing out that only 14.8% of domains with DMARC are protected from spoofing by an enforcement policy. An enforcement policy dictates what a recipient should do with an incoming email purportedly from a domain but doesn't pass the necessary DMARC authentication checks. Larger for-profit and government organizations are more likely to take advantage of this, with 43.4% of them using policy-based enforcement.

The US federal government is the best performer when it comes to DMARC usage, with three-quarters of its domains using it and 78% using an associated policy. That's due to a 2017 directive from the Department of Homeland security mandating enforcement for all executive-branch domains other than those connected to intelligence and defense. Conversely, global media companies and US health care firms have the lowest protection rates.

While it’s a powerful anti-phishing tool, DMARC doesn't protect against all types of domain fraud. The use of “cousin” domain spoofing, when attackers create domains that look like legitimate ones, is still rife and targets organizations, including the FBI.

High-risk email threats climbed by 32% compared to 2019, according to Trend Micro’s 2020 Cloud App Security Report.

The report found that detections of malware, credential theft, and phishing emails all recorded double-digit year-on-year increases in 2020, while business email compromise volumes dropped slightly.

The report gathered data from over 16.7 million high-risk email threats that Trend Micro’s Cloud App Security detected and blocked. The company said this was a 32% increase from the previous year. The report highlighted one example of an organization of 10,000 users where its system detected 755,000 high-risk email threats, which came out to 75 high-risk emails per user after scanning by the native Microsoft 365 security.

Trend Micro also thwarted 10,000 malware files and over 4,300 BEC attempts for the same organization in 2020.

Trend Micro detected over 6.9 million phishing emails in 2020, a 19% increase from the previous year. Outside of credential phishing, the number of threats in this category increased 41% over the period. COVID-19 was a common enticement, as were well-known brands, such as Netflix, that have become increasingly popular during the pandemic. Attackers were typically looking for personal and financial information to monetize, according to the report.

Concerning credential phishing, Trend Micros detected nearly 5.5 million attempts to steal users’ credentials that existing cloud-native security filters allowed through. This was a 14% increase compared to 2019 and accounted for the vast majority of detected phishing emails.

The report said hackers were increasingly complementing these with phone-based vishing attacks, which is when hackers call users via VoIP to trick them into logging into fake phishing sites to harvest their usernames and passwords. The hackers then use these credentials to look for administrator accounts within the network and cause substantial financial problems for the organization.

The FBI warned the public to be wary of such attacks, as the shift to remote work might have made organizations more vulnerable to vishing attacks, according to the report.

One bright spot in the report was the 18% year-on-year decline in business email compromise (BEC) detections. However, average losses continue to rise — increasing 48% from the first to the second quarter of 2020. From $54,000 (the average cost of a fraudulent wire transfer in the first quarter of 2020), the amount has jumped to US$80,183 in the second quarter of the year, the report said.

Bharat Mistry, Technical Director UK at Trend Micro, told ITPro it should come as no surprise that email remains the number one threat vector for all organizations, no matter the size or vertical.

"In 2020 we intercepted over 16 million high-risk emails containing malicious payloads that had been missed by native messaging providers. The problem is growing exponentially yet organizations still struggle to get a handle on it," Mistry said.

CloudHQ has released an upgraded version of its Chrome-based web application that enables users to export important Gmail conversations to Google Sheets.

Dubbed “Export Email to Google Sheets,” the app is fully integrated with Gmail and G-suite, eliminating the need for physical storage devices to save data.

"Copying the information in emails from Gmail to Sheets gives small businesses the power to sort, analyze, and prepare email data in ways that simply wasn't possible before," said Naomi Assaraf, co-founder and chief marketing officer, cloudHQ.

Using the email parser feature in Export Email to Google Sheets, businesses can dissect invoices, signup or interest emails, order notifications, email campaign reports, and more for rapid integration with data analytics and customer relationship management (CRM) platforms.

Users can also create custom parsing rules to extract target keywords or leverage spreadsheets to filter and organize exported data by standard Gmail nomenclature, including Cc and Bcc. When used to extract and save all text from an email into a single PDF document, Export Email to Google Sheets makes for easy and error-free translation and sharing via a PDF attachment or Google Drive instead of forwarding an email dozens of times.

You can also track bounced and bad emails imported to spreadsheets using a Gmail label for re-examining. You can also link order and delivery tracking emails to supply chain management tools for greater visibility and improved operational efficiency.

"If your business receives a specific type of email all the time, and you use Gmail as your email provider, Export Gmail to Google Sheets is a powerful tool you can use to automate and improve how you respond to those emails," Assaraf said.

Export Gmail to Google Sheets comes with basic and premium plans. The basic plan offers support for 50 parsed emails per month, while the Premium Plan is unlimited.

Many security strategies rely on pattern recognition - setting a benchmark for what normal operations look like, and then tracking any anomalies which could represent potential threats. But what do you do when ‘normal’ is suddenly very abnormal? Coronavirus has introduced huge disruptions to standard operating procedures, and security teams must quickly adapt to cope with them. In this Q&A, we talk to Darktrace director Mariana Pereira about the changing situation, and how business can make sure they’re not caught out.

Carly Page

News editor, IT Pro

Carly Page is an experienced journalist with more than a decade of experience covering the technology industry. Previously editor of UK tech tabloid The INQUIRER, Carly went freelance in 2020 and has written for a number of publications including Computer Shopper, Forbes, IT Pro, the Metro and Tes.

Mariana Pereira

Director of email security products, Darktrace

Mariana is the Director of Email Security Products at Darktrace, with a primary focus on the capabilities of AI cyber defenses against email-borne attacks. Mariana works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience within the email domain, and how to implement AI technology as a means of defense. She speaks regularly at international events, with a specialism in presenting on sophisticated, AI-powered email attacks. She holds an MBA from the University of Chicago, and speaks several languages including French, Italian, and Portuguese.

How many times have you sat down and crafted a fantastic email only to find yourself staring at a blinking cursor trying to decide the best way to sign off? Those moments between deciding how to sign off an email and actually hitting “Send” can be treacherous. Do you go all-in with the formalities or take a decidedly friendlier tone?

Before diving into the specifics, let’s start with the basics.

What is an email signoff?

An email signoff is a small bit of text people add at the end of the email before they type their name. These last few words not only set expectations moving forward, but they also define the relationship between the sender and recipient.

The most common ways to sign off an email include:

• “All the best”
• “My regards”
• “Respectfully”
• “Many thanks”

What makes your email signoff important?

An email closing is the last thing your recipient reads. It can elicit a quick response when done correctly or result in no response at all if done incorrectly.

Imagine meeting a new business contact at a networking event and spending a few minutes getting to know them. Once your conversation ends, you wouldn’t just turn around and walk away without saying goodbye, would you?

Of course you wouldn’t. Not only would that be incredibly rude, but it would also leave a bad impression and likely prevent future discussions with that individual. Instead, you would probably say something along the lines of, “It was great meeting you. Please take my business card. I hope to hear from you soon.”

When you sign off an email, think of it as the end of a conversation. By using friendly, polite and professional language and ending your message with a clear call to action, you have a better chance of getting a positive response and continuing conversations.

What should you include when you sign off an email?

There are multiple parts to an email closing. The signoff itself is important, but there are additional pieces of information you should also include before hitting “Send.”

Always remember to include the following in your email signoff:

• Full name: Be sure to include your first and last name to avoid any confusion and give the recipient an understanding of who they are corresponding with.
• Title and company: Include your current job title and company, particularly if you find yourself emailing with someone outside the company you work for.
• Contact information: Sure, the recipient has your email address, but are there other ways they can contact you? It can be useful to include your phone number and even your LinkedIn profile URL.

How to sign off an email with class

There are many tried-and-true email signoffs you can use the next time you sit down to send an email to a coworker or friend. These signoffs can range from your typical “Best” to the classic “Sincerely.” Those aren’t the only ways to sign off an email, though.

Formal email signoffs

In a formal business situation, you want to use an email signoff that'll show your professionalism without sounding too stuffy. Some examples of great professional email signoffs include:

• Regards: It might come off as a bit cold, but it works in professional emails because there’s nothing unexpected about sending your regards to professional contacts.
• Sincerely: While it would sound stuffy in a more casual business email, “Sincerely” is the ideal email signoff for corresponding with a new connection.
• Best wishes: This signoff strikes the perfect balance between friendliness and formalness, making it a safe bet for any correspondence.

Informal email signoffs

If you're emailing a coworker or client you're friendly with, a more casual email signoff may be appropriate. Some examples of casual business email signoffs include:

• Cheers: It’s 5 o’clock somewhere! While this signoff works well if your email is a conversational one, it can come off as unprofessional in certain settings.
• Best: You can use “Best” to share your best wishes in a more cheerful way. If you get a lot of emails, you’ve likely seen this one a lot.
• Talk soon: If the recipient is someone that you know and anticipate talking to in the near future, consider something as simple as ‘Talk soon.’ Not only is it as friendly as it is polite, but it also signifies that the conversation is likely to continue.

Call to action email signoff

If your email includes asking the recipient to perform a task or help you with something now or in the future, one of these email signoffs will do the trick:

• Thanks in advance: Emails that include “Thanks in advance” are more likely to get a response than those without it. Maybe it’s because this signoff expresses gratitude but also sets an expectation.
• Thank you: This one is such a classic your mother would be proud you used it. Not to mention, a simple “thank you” is always a solid choice when you want to express gratitude.
• I appreciate your [help, input, feedback, etc.]: There’s no better time than the present to express appreciation when someone has helped you.

Improper business email signoffs

There are some signoffs you may use in an email to your mom or significant other, but they simply aren't appropriate in a business email. Here are a few examples:

• Love: Does this one even need an explanation? If you find yourself emailing with a coworker or professional connection, dropping the L-word probably won’t be received well. Try “Best wishes,” instead.
• Thx: In this day and age, shortening words and using acronyms in place of full phrases can feel like second nature. Our advice? Spell things out.
• [Nothing at all.]: Ah, the good old Irish goodbye. Acceptable at parties but not at the end of an email. A simple “Best,” will do.

Things to keep in mind

Regardless of who you find yourself communicating with via email, always remember to include your first and last name in your signoff. Also, be sure to use context clues when choosing the appropriate email signoff tone.

If you’re emailing someone you’ve never met, take the tried-and-true approach of keeping things professional. If you’ve communicated before and feel a more laid-back closing is appropriate, adjust your email signoff appropriately. If you’re unsure, it’s always a good idea to err on the side of caution and sign off with a professional farewell.

The average person receives around 120 emails each day, and that amount will add up over the years, so it's important to know how to sign-off an email. Many of us will sometimes fall short on email etiquette, no matter how many hours we dedicate to crafting and sending these electronic messages. You might be wondering what the best way to sign off an email is, and this can be a tricky question to answer. Modern life is becoming increasingly hard to navigate in the digital world, with your goal of an email sign-off tending to instigate the reader to send a fast response, without the writer coming off as too formal.

The problem is that when it comes to what makes a good email sign-off, different people will have various ideas on this topic. One person’s favourite email sign-off, for example, could be unsettling for a number of recipients.

There’s no need to worry, however. In this article we’ll go over 10 email sign-offs that you can add to your writing arsenal which are sure to award you with the response you seek. Additionally, we’ll also go through the 10 email sign-offs that might be a good idea to avoid.

The 10 best ways to sign-off an email

As ever

This is known among the etiquette experts as a classic sign-off, largely acquiring its legendary status thanks partly to a Sadie Stein essay in The Paris Review. In the essay, she describes how she received a message from her university professor and felt enchanted by “as ever”. "Immediately, it seemed to me that rare thing, an all-purpose valediction: versatile, graceful, elliptical," she explained. "If I was writing to a loved one, the sign-off implied my affection was going strong. If I hated someone, well, it didn’t rule that out, either. It could be cool or warm, friendly or formal. Or it could be literal: I was still Sadie Stein, and there was very little arguing with that."

Thank you and thanks

46% of email writers replying to a PerkBox survey of 2,000 people said that a simple “thank you” was a good way to sign-off an email. A basic “thank you” or “thanks” could be a great way to make your digital exit, although it is preferable if you have something in particular to thank the person you’re writing to for.

It’s been known for a while that being thankful could help boost your response rate too. All the way back in 2017 a study from Boomerang, of over 350,000 email threads discovered that “thank you,” “thanks in advance,” and “thanks” all received response rates of around 65%. On the other hand, 46% of emails that lacked these kinds of sign-offs also got a response. It’s worth bearing in mind that some etiquette experts warn against using “thanks in advance” though, which we’ve noted further below.

Best wishes and all the best

Sign-offs like “all the best,” “best,” or “best wishes,” are preferred by Victoria Turk, the author of Digital Etiquette. Despite this, “best” and “best regards” didn’t garner as many responses in the Boomerang study compared to emails ending with “thanks”, although it’s worth pointing out they experienced an 11% and 7% rise when compared to the average of all emails sent.

Kind regards

The etiquette experts consider this to be one of the top sign-offs, just like “best”. Not only formal and polite, it’s also considered to be warm. In the PerkBox survey it also appeared to be extremely popular, approved by 69% of those who took part. If you’re looking for a safe and secure option for an email sign-off, then “Kind regards” is the one for you.

Learn mimicry

If you're replying to an email, an easy way to know how to reply is by mimicking the sender's style — if they thought "best regards" worked for them, they won't be offended to hear it in return. It's a safe way to avoid any offence or confusion, but don't use it if the sender has a unique sign-off, as it may seem mocking.

Be consistent

Starting with a formal sign-off and switching to a more casual one is perfectly fine, but be wary of suddenly lurching back to "sincerely" or another colder exit, according to William Schwalbe, author of Send: Why People Email So Badly and How To Do It Better. “Change is important," he told Huffington Post. "If you’ve been ‘best,’ ‘best,’ ‘best’ back and forth, and all of a sudden I sent you a ‘sincerely,’ actually that means you’ve probably done something that irritates me, and I want to establish that we are not actually close."

Use context

Keep in mind the wider context, too. Tina Hayes, of the School of Etiquette and Decorum, shared sign-off ideas from colleagues at the American Association of Etiquette Professionals with the San Francisco Chronicle, revealing a nod to the strange times we currently live in could be welcome. "Take care and be safe," suggested one, while another said "stay sane and healthy".

Be yourself

The perfect sign-off depends on the style of your business. A professional sign-off is necessary for most of us in office situations, but your sign-off could help solidify your brand, according to business etiquette expert Jacqueline Whitmore. "A friend of mine writes vegan books, and she signs her emails 'love and blessings'," Whitmore says in a blog post. "And that’s who she is." Most of us can't get away with that much character at work, but if it works for your role or business, go for it.

The 10 worst ways to sign off an email

Don't be too formal

Emails are for the electronic age so make sure your writing isn’t stuck in the past. It’s seen as too formal to use something like “Yours sincerely.” If you read your writing and come across as something out of a Dickens or Jane Austen novel, it might be a good idea to rewrite your email. “Yours truly,” “yours faithfully,” and “sincerely” were ranked as the worst email sign-off options by the PerkBox survey.

This isn't the pub, don't say cheers

You might have a good relationship with someone and are able to customise your sign-off to highlight how close you are to them. However, Turk warns that it’s best to avoid being too casual if you don’t happen to know the person you’re writing to very well. “Cheers” is an email sign-off that should be used with close colleagues or friends, but no-one else, says Turk according to Ted.com. Additionally, only individuals from Australia or the UK will be accustomed to this phrase, as other people might not be familiar with how it’s used.

Don't get emotional

If you’re chatting with a friend or your mother you might sign the email off with a “love” or even a “xoxo”. It’s not surprising that this was seen as the worst way to sign off an email in the PerkBox survey. It’s a simple rule, but if you don’t love the person you’re writing to, it’s a good idea not to sign the email off in that manner. Following “love” as the next worst-rated sign-off was “warmly”, so it’s useful not to share your emotions with that word too.

Abbreviations

It doesn’t really matter if you’re on your keyboard or using your mobile phone, it is just as easy to write “thanks” or “thx”. If you can’t find the effort or energy to write a couple of extra letters, why should the readers of your email bother to reply, or even read, what you sent them?

Don't pre-empt

“Thanks in advance” is the worst sign-off possible to type out, says Turk. She describes it as “incredibly presumptive.” She told Ted.com: “You can’t thank someone for doing something before they’ve agreed to do it.”

Don't be passive aggressive

There are some sign-offs that come across as an implied demand for future action, like “looking forward to hearing from you” or “thanks in advance.” It can be a little dangerous to include this in your sign-off armoury as they can come across as passive aggressive, according to Grammarly experts. It can also complicate things by relegating you to a waiting position, where you’re unable to reach out to them until they’ve sent a reply.

"The problem with 'I look forward to hearing from you' is that it removes you from the active role and puts you in a subservient one,” states Grammarly. "Now, you’re just waiting passively for a response rather than moving the email thread forward, and your recipient may not even know what you want from them."

Drop the GIFs and pics

Using an amusing GIF or image could make your email stick out in their memory, but this is a double-edged sword. Additionally, humour is subjective so the person you’re communicating with might not find it as funny. Images can also affect security software, triggering an antivirus response. It will also affect your email load time, which is made even worse if a user views it on their mobile device.

Say something

The PerkBox survey showed that 44% of people thought the worst sign-off was none at all. That may work for a colleague you exchange dozens of messages with each day, but if you don't know the recipient very well, it's best to make a polite exit rather than none at all. If the best you can do is "best", that's better than nothing at all.

Despite the rise of business messaging and collaboration apps such as Slack and Microsoft Teams, email is not ready to be killed off just yet. In fact, you might want to hold off on deleting your Gmail account, regardless of how much it annoys you. Email is still considered to be the most popular way of communicating about work-related matters, with some people being capable of spending an entire day just going through their inbox. A recent survey by Mail Manager found that 90% of respondents indicated that they use email to communicate with their clients, while Skype and WhatsApp, by comparison, were used by 55% of those surveyed. Just 15% of those surveyed said that Slack was their go-to communication platform.

Although it definitely has its faults, email is here to stay as a form of formal correspondence. Jacob Wardrop, commercial director at Mail Manager, went as far as to describe the Gen-X staple as the "letter of today".

"While tools like Slack and WhatsApp are great for informal correspondence and chat, email remains the core correspondence method for formal communication. Before the digital era, companies would send formal correspondence as letters, which would be physically stored. Now, email is the tool for formal correspondence, but the need for filing and securely storing this communication remains, even though it's digital," he said.

There are many reasons as to why emails continue to be popular among users. One of the central reasons could be the Simple Mail Transfer Protocol, also known as SMTP. This is one of the main mechanisms underpinning the technology behind email communications. SMTP has been a crucial aspect to the long reign of the email, and has been a main component of electronic messaging for over 40 years.

It’s easier to think about SMTP as some kind of structure or rules which clarify how information can be moved between different email servers. You probably don’t know this but it’s also used as a foundation for data transmissions by most of the main email providers, like Microsoft’s Outlook or Gmail. This ensures that emails are able to be sent away from their own sites, a key aspect of this electronic form of communication.

As for the history of SMTP, it can be traced all the way back to the computer scientist John Postel in the year 1980. It was initially known as RFC 821 and RFC 2821. Ever since its inception, SMTP has been changed a number of times but its main idea remains more or less the same. It contains four main components which are called “agents”, which make up this framework. These are mail transfer agent (MTA), mail user agent (MUA), mail delivery agent (MDA), and mail submission agent (MSA). SMTP functions by simply transferring an email from one device’s MTA to a different machine’s agent. Emails are reliant on all parts of the process, especially since the other agents all have similar jobs within the framework.

It depends on how users configure their email systems, but the Internet Message Access Protocol (IMAP) or Post Office Protocol 3 (POP3) can also be utilised to help collect and send emails to their final destinations.

As you might have guessed, these protocols have their advantages and disadvantages. However, most businesses usually decide to choose the IMAP protocol since their emails have the ability to be stored on a server instead of individual user hardware. Be aware that if you do decide to utilise IMAP, ensure you configure it to choose which server should save the messages. This will prevent your emails being received with a delay or mistakes by all the devices that need to have access to them.

What is the SMTP server?

An SMTP server is just a computer running SMTP. Once messages are picked up they are sent to this server for passing onto recipients.

Six steps to (email) heaven

An email is sent from sender to recipient using six steps.

1) The email is submitted by an MUA to a mail server's MSA.

2) This email is transferred to the server's MTA via port 25 (the MTA and MSA are typically hosted on the same SMTP server).

3) The MTA confirms the MX record of the recipient domain and transfers the message to another MTA (this can happen many times until the message is received by the destination server).

4) The email is given over to the MDA, which saves the message in the correct format for retrieval by the receiving MUA.

5) The receiving MUA requests the message from the MDA via POP3 or IMAP.

6) Lastly, the email is delivered to the receiving MUAs inbox.

How to use MIME to send attachments

SMTP is a very reliable protocol, but it is constrained to sending text only. This would make email very limited as we wouldn't be able to send any attachments. This is where MIME comes in.

MIME stands for Multipurpose Internet Mail Extensions. This is an extension to SMTP that allows users to send different kinds of files over the internet, such as audio, video, images, application programs, etc. It also allows for non-Latin characters and emails that contain multiple parts (such as an email with a plain text element and an HTML element).

What is SMTP Authentication?

Another extension to SMTP is SMTP Authentication. This enables email clients to authenticate when connecting to an SMTP server using a username and a password. This prevents unauthorised users from sending email through an SMTP server.

Despite being the most popular email service in the world, many are not sold on Google's Gmail service. Whether it's about privacy or just a matter of taste, there are many valid reasons to delete a Gmail account.

Since its launch in 2004, the free-to-use app has built up a user base of almost 2 billion, largely due to the fact it is also bundled in with the Workspace productivity suite (formally known as G Suite). However, in that time there have been a number of issues and updates that have annoyed some users. These include security mishaps, outages, and the ever-increasing use of targeted advertising.

Whatever the reason, it's relatively easy to delete a Gmail account. And even if you're not sure, or happy with the service, it's important to know the option exists and how it's done.

Deleting a Gmail account

Before you delete any email account, the first thing you want to do is make sure all your contact details have been exported. It’s probably worth checking whether there are any emails you want to download or forward to your new email account, before everything is deleted.

You will need to access a desktop or laptop computer with an internet connection, as Gmail apps can't be used to delete accounts. Also, mobile browsers are too difficult to use in these circumstances.

1. In a web browser, go to Google account page: https://myaccount.google.com.

2. Click on the sign-in button in the top right corner and enter the details for the Gmail account you wish to delete.

3. Once you have logged in, look for "Account Preferences" – this will be in the topic boxes in the centre of the web page.

4. Then click on "Delete your account or services".

5. On the next page, click on "Delete Products". You will be asked to enter your password again.

Note: Before you delete your account, it's a good idea to download a backup copy of your data.

6. Follow the "Download Data" link to download a full copy of your Gmail messages via Google Takeout.

7. When that's backed up, click on the trash icon next to Gmail.

At this point, if you use other Google services, you will have to provide an alternative email address to continue using them.

Note: that Gmail may already have a secondary address you used when setting up this Gmail account.

To continue using these services, you will have to send a verification email to this alternative email address. Once that email has been received, click on the verification link to verify the new sign-in address.

Once you have signed in with this alternative email address, the deletion of your Gmail email account will be finalised.

If you have used IMAP to access Gmail, only messages copied to a local folder will be kept. Any other emails will be deleted, and folders synchronised with the closed Gmail account will also be removed.

How to delete Gmail account from phone

As simple and straightforward as it is to delete a Gmail account on a computer, it's also very easily done via a smartphone. Given the way in which the majority of us browse the web and check our emails, it is quite likely that many would have a preference for using their handsets.

How to delete Gmail account from iPhone

1. From the home screen tap 'Settings'
2. Scroll down to 'Passwords and Accounts'
3. Select 'Gmail' and hit the button to 'Delete Account'.
4. After that, it's just a case of confirming the choice by selecting 'Delete from my iPhone'.

How to delete Gmail account from an Android phone

For Android users:

1. Open the Settings menu
2. Navigate to either 'Accounts' or 'Users and Accounts' – it may be different depending on the manufacturer of your device, as Samsung, OnePlus, and Google all have their own UIs.
3. From here tap the Gmail account you wish to remove.

Knowing how to recover deleted emails in Gmail can be a handy skill to avoid overlooking important correspondence and ensure your communications are up-to-date. 

Deleting emails accidentally or in the heat of the moment is common, and we’ve all been there. When dealing with a wave of emails each day, accidentally hitting the wrong button and deleting something is easily done. But don’t worry, it’s possible to recover these deleted emails. 

Gmail has built-in mechanisms to prevent you from losing data, and these tools can also help you to recover emails that you've deleted on purpose but then need to retrieve at a later date.

However, It should be noted that these safety mechanisms aren't foolproof, and you won't be able to retrieve every email in Gmail. It's good practice to ensure that you make a note of any important information outside of your email inbox, just in case anything happens to it. 

That said, understanding how to recover deleted emails in Gmail is an essential tool for any worker.

This guide outlines how you can recover any deleted correspondence, but specifically in Gmail. We also have a guide on how to recover deleted emails in Outlook if you are experiencing a similar situation on that service. 

How to recover deleted emails in Gmail

It can be fairly easy to accidentally delete an email, or delete something you later realise is important, and Google understands this. Gmail, like many other email platforms, is designed in a way that when the delete button is used, the message is moved to another folder, rather than being removed outright. 

This folder, known as Trash or Bin depending on your region, allows you to review and recover deleted emails as necessary. However, by default, Gmail will only hold these deleted messages for 30 days, after which time the content is lost forever.

There are some exceptions to this rule. Those organizations using Google Vault can implement policies that allow users to recover deleted emails in Gmail that are older than 25 days, provided it meets specific retention rules. 

It's also possible for Admins to recover permanently deleted data - i.e. emails that have been deleted from the Trash or Bin folder - up to 25 days after the date of deletion. This should be seen as a last resort, as once the data becomes older than 25 days, it is truly lost forever.

Note: If you happen to have permanently deleted your email from the Trash, or 30 days have elapsed since you deleted it then you'll have to dig a little deeper. This is because Gmail automatically clears emails from the Trash 30 days after they were placed there. 

Learning how to restore Outlook emails is a handy skill that could help avoid disaster for you or your organization. 

If email is a large part of your daily work, accidentally deleting an email could leave you scrambling to locate vital business correspondence. 

Luckily, Outlook provides a fairly straightforward method for you to restore deleted emails, albeit with slightly different menus and processes depending on the specific version of the email application you currently use. 

One of many email services available on the market, Outlook is one of the most widely-used by professionals and businesses, mostly because it forms part of the Microsoft 365 ecosystem. 

This ecosystem includes a number of useful productivity and communications apps such as Microsoft Teams. 

So, if you’ve haphazardly deleted some correspondence, this guide will run you through all the steps that will help you rectify that mistake. 

How to restore Outlook emails: Getting started

Given there are a variety of Outlook versions, and that the steps for recovering deleted emails differ slightly. 

We've detailed each of the main versions and platforms below. We will be covering:

• Outlook.com
• Outlook on the Web App (OWA)
• Outlook 2016 and 2013
• Outlook 2010

If you've haven't yet given up email for a convoluted combination of Slack, WhatsApp, and passive-aggressive Trello updates, you should know this: no-one likes it when you ask "not sure if you saw my last email."

That, along with "per my last email" and "per our conversation" are the most annoying phrases to receive by email, according to a survey of American email users by Adobe.

One in ten respondents were also irritated by queries whether there were "any updates on this", faux-apologising that they're "sorry for the double email", and asking for the recipient to "please advise". Other reminder phrases that made the top ten list were "as previously stated", "as discussed," and "reattaching for convenience".

Such falsely polite business speak isn't actually helpful. "Emotion and intent are sometimes hard to convey via email, so [some phrases] can negatively impact productivity and culture," Kristin Naragon, Adobe's director of email solutions, told CNBC.

While your intent may be to irritate your colleagues into taking action after all, the irritating email language is mostly centred on reminders you may want to delete your passive aggressive missive. "Your colleagues could choose not to respond out of frustration," Naragon told CNBC. "This can damage relationships and ultimately, morale."

The research also noted that most people, seven in ten, don't think they check email too much, with 62% spending less than two hours on work email a day. Almost three in ten say they've never checked work email on vacation, though more than a third do occasionally or more.

Google is reportedly preparing a security update to protect against against cyber attacks and political hacking.

The update, dubbed the Advanced Protection Program, is expected to be rolled out next month and will offer new features for protecting its various software suites, according to Bloomberg, quoting two people familiar with Google's internal workings.

It's thought the new tool would effectively replace the need for two-factor authentication, and instead replace it with two physical keys. The update is reportedly aimed at senior company executives and political figures, those most at risk of being targeted by hackers.

Google's USB Security Key has been providing two-factor authentication since 2014, allowing users to plug a dongle into a machine to create tougher security measures across GSuite tools and websites.

According to the sources, the new security tools will continue to make use of the USB Security Key, but will also include a second physical key for added protection.

It's unclear what specific functions the new update will bring, though the sources confirmed that the service will block third-party applications from accessing email and Google Drive accounts by default, and will receive regular updates to expand its capabilities.

During last year's US presidential election campaign, a high-profile hack on the Democratic National Committee led to the leak of email accounts belonging to senior Democratic party officials, including those belonging to Hillary Clinton's and Bernie Sanders' campaigns.

Google has been working to address vulnerabilities in its own platform. In May users were hit by a widespread Google Docs phishing scam which tricked users into clicking a link, granting a malicious third-party application access to address books and Gmail accounts.

Since then, Google has introduced AI-driven early warning mechanisms for phishing scams, click-time alerts for links contained inside emails, and new warning messages that notify users if an email recipient is outside their business network.

Google's latest tool is expected to arrive next month, however the company has yet to make any public announcement.

Picture: Bigstock

A number of TalkTalk services suffered an outage yesterday, with the telco blaming flash flooding for the problems.

Pages on the company's website displayed a holding message saying: "We'd like to apologise for any inconvenience during this time and suggest you try again later. Also due to severe weather conditions some of our systems are currently unavailable which means we may not be able to assist you when calling and suggest you don't call us right now unless it's urgent."

The services and webpages affected wereTalktalk.co.uk, Talktalk webmail, Help2.talkTalk.co.uk and talktalk.co.uk/contactus, making it tricky for users to report problems or get an update from the company.

Downdetector yesterday listed 521 reports of services not working.

Because the company did not tell customers it was planning to perform maintenance on its website, many users had speculated it could be another hack, after the company was breached last year.

Phat Monkey wrote on Twitter: "Anyone else not receiving#talktalkemail? Their site is down with a so called upgrade, hacked again? Why not warn customers 24hr before?"

However, TalkTalk has ruled out that possibility, blaming the outage on flash flooding in the Midlands, adding that its services are back online.

A spokeswoman toldIT Pro: "After the flash floods in the Midlands that led to some service disruption yesterday afternoon, we were able to bring the affected systems back online overnight. This means that all areas on our website are now accessible and email service should also be back up and running, although it might take a few hours for the backlog to clear."

Microsoft has apparently now fixed an issue with its Hotmail and Outlook spam filters that meant its users were being flooded with spam emails.

The company admitted on its support page that it had uncovered a problem, saying, "Some users may be receiving excessive spam mail," although it would not reveal exactly what went wrong.

Shortly after releasing the update on its service page, Microsoft rolled out updates to Hotmail and Outlook that fixed the filters and its own infrastructure to prevent it happening again.

"One will provide short term relief preventing spam reaching your inbox," reveals Microsoft. "The second will be a longer term fix which should stop spam reaching our infrastructure," the company explained.

The problems went on for around 17 hours according to users, which certainly left a bad taste in thier mouths. As expected, annoyed users posted messages of frustration on social media, ensuring Microsoft and their friends and followers knew of the problems.

Erica Jean wrote on Twitter: "HEY @Outlook @hotmail WHAT IS GOING ON WITH THE SPAM EMAILS TODAY? I've had almost 60 overnight and they're NOT GOING AWAY," while other users seemed to be in competition to announce how many spam emails they had received.

However, some users saw the lighter side of being spammed by spam.

"Look at all of these great deals I've been missing out on for years," Peck Ed wrote on Reddit. "Now if you chaps will excuse me, I'm off to become a... millionaire getting a great deal on my car insurance with my new Russian bride at the Casino with my free bets."

Jonathan Lakeman joked on Twitter: "Thanks to @hotmail the only genuine e-mail I got all day was from my desolate Nigerian Uncle (I didn't know I had). #slamdunkthejunk #spam."

Google has been forced to backtrack on an April Fools' Day prank that went drastically wrong.

To mark the day, the tech giant added a feature to Gmail allowing users to send messages with a gif of a Minion dropping a mic, with any replies to that message never reaching the user's inbox.

The 'Send + Mic Drop' button replaced the usual 'Send and Archive' option, which caused many users to unwittingly click the button and send messages featuring the 'MicDrop' gif.

In a blog post announcing the feature, Google said: "Today, Gmail is making it easier to have the last word on any email with Mic Drop. Simply reply to any email using the new 'Send + Mic Drop' button. Everyone will get your message, but that's the last you'll ever hear about it. Yes, even if folks try to respond, you won't see it."

Many Gmail users subsequently took to Google's support forums to express their anger over the feature, with one user complaining they had lost their job due to accidentally sending the gif to their boss, while others complained that they had accidentally sent it to important business contacts.

It does appear, however, that Google had thought about the issue posed to businesses prior to the release of the prank, as the button was not enabled on the accounts of enterprise business users.

"Due to a bug, the Mic Drop feature inadvertently caused more headaches than laughs. We're truly sorry," Google said in a statement earlier today that was added to the original blog post. "The feature has been turned off. If you are still seeing it, please reload your Gmail page."

Google did not immediately outline the cause of the bug, but added: "It looks like we pranked ourselves this year."

Yahoo is intensifying its mission to "kill the password" with the release of a new account login process for Yahoo apps.

The web services provider stated its intentions to ditch the password a year ago, when it announced its plans to introduce "on-demand passwords" that would be texted to a user's mobile devices.

Now those plans have been polished and rolled into a new login method, Yahoo Account Key.

The service works by sending Yahoo users a push notification on their mobile phone for them to approve whenever they attempt to sign into their Yahoo account from a new desktop browser.

Once the user receives the notification and taps the approval button, they will immediately be signed in.

"Passwords can be a hassle they're easy to lose track of and forget, or they are weak passwords that are vulnerable to hacking. At Yahoo, we are moving fast in our mission to kill the password' and make it easier for users to sign in without sacrificing security," said Yahoo product manager Lovlesh Chhabra in a blog post.

This new login method will appear for Yahoo Finance, Fantasy, Mail, Messenger, and Sports for iOS and Android.

Yahoo claimed this method of account verification is more secure than passwords. However, the company also said users must not sign out of their Yahoo app or turn off notifications "as this will prevent you from receiving your Account Key push notification".

Yahoo is not alone in its decision to explore new methods of user verification. Other web service providers have also been taking steps to move away from account passwords.

Bad passwords are one of the biggest reasons people's accounts are hacked, with the most commonly used password in 2015 being '123456'.

Music identification app Shazam does not use passwords at all, instead sending a verification email to the users when they attempt to sign to the app for the first time on a new device.

Google offers its Google Authentication app, which is used as an additional layer of verification, via randomised passcodes on the user's mobile device, for selected web services.

And the latest Apple devices, such as the iPhone SE and iPad Pro, include fingerprint sensors which enable user to confirm their identify simply by holding their finger to the devices home button.

Instant messaging (IM) services like WhatsApp and Facebook Messenger are set to overtake email, according to new research.

Last year, email made up the majority of internet messaging traffic, with around 35 trillion messages sent globally.

Data compiled by Juniper analysts now shows that over the next year, IM services will surpass this figure, accumulating almost 43 trillion messages.

The research cited the low cost of most messaging services as well as the spread of inexpensive mobile internet as one of the trend's key contributing factors.

WhatsApp alone hosts more than 30 billion messages per day, according to the company, and services like WeChat and Snapchat have had similar success.

Also noted is the fact that 80 per cent of emails sent can be dismissed as spam, possibly indicating that by some benchmarks, email has already been surpassed as the dominant messaging form.

However, SMS remains a hugely successful messaging format, particularly for enterprise users. Network provider EE uses SMS to communicate with its customers, and states that 99 per cent of all text messages are read by the recipient, with 90 per cent being read within three minutes.

Further highlighted is the comparatively slow adoption of Over-The-Top internet messaging services in the developing world.

"While there may be a trend towards OTT messaging, SMS is always there in times when Internet access may be impossible, or 3G/4G coverage poor. Its reliability means that messages have a very low non-delivery rate.

"SMS also maintains dominance in regions where featurephone use exceeds smartphone penetration, ensuring it is still a viable means of communication, at least in the medium term."

This research may suggest that IM will quickly replace most other forms of communication, but Juniper's findings indicate that despite the considerable growth, "IM's equivalent per-message revenue return is forecast to be less than 1% of that generated through SMS and MMS in 2019."

BT has apologised to customers following an incident that left some subscribers without email for several days.

According to the telco, only a "minority of customers" were affected by the outage, caused by a technical error, that left them unable to access BT Mail for a number of days.

A spokesman for the company told IT Pro that it was advised by their email partner Openwave Messaging that there was a problem with migration on Saturday night, "which meant that a minority of BT's customers would have seen an error when trying to log in and were unable to access their email".

"These customers were also unable to receive any emails into their mailbox during the period. Openwave Messaging has advised that some emails may have not have been received or been lost during the period of affected service," he added.

The spokesman said that access now been restored for all customers and "if any customers are still be experiencing issues it may be because they haven't cleared their cache".

It gave a web link to instructions on how to clear the cache in order to get the service back up and running for punters. Should customers still have problems, BT asked them to contact it via its online form.

BT has been trying to move its email from Yahoo Mail to BT Mail since last year. The migration of millions of accounts has not gone smoothly.

The firm has also had to deal with a major outage that prevented millions of users from visiting certain websites, including BT's own customer service hub, thanks to a DNS error. The telco was once again forced to make an apology to customers.

Microsoft has updated Outlook.com - its browser-based web email service.

According to Mike Schackwitz, principal director of program management of Outlook.com on the official Microsoft blog, the average person has 184 emails in their inbox, and receives 28 emails each day, making it quite a job to keep those emails managed.

Microsoft has introduced a number of new tools to make it easier to keep your inbox in check and build on its commitment "to give your inbox new and better ways to do the heavy lifting and help you save time."

Advanced Rules help you organise individual emails using multi-condition and multi-action rules and combine them together to make them personal to you. For example, you can create a rule to file an email older than a week old from a specific contact into an archive, or if you haven't opened an email from one of your Outlook contacts after three days, you can choose to flag it.

Microsoft has also implemented an undo shortcut, so if you accidentally delete an email or lose it among your folders, you can just click on undo or tap the Ctrl+Z buttons on your keyboard to take a step back and undo your last action.

Microsoft is bringing Outlook.com up to date with Gmail by adding inline reply. Instead of clicking on reply (apparently, eight million people hit the reply button a day in Outlook.com), you can just click in the box above the original email and start typing your reply. It also allows you to keep track of your conversations easily, with each thread in one place.

Finally, Microsoft has made it easier to chat with your contacts in real time, using any of the supported chatting platforms, including Skype, Facebook or Messenger. You can switch between conversations using the different services in the bottom left of the screen and switch between chat sessions.

This new addition also allows you to filter your contacts by chat service and see who's online.

Microsoft says the new features will be rolling out to customers in the next few weeks.

Thousands of email users have been sent a hoax message telling them they have cancer, the National Institute for Health and Care Excellence (NICE) has warned. The email marks a new low in spammers' tactics.

The email with the header "important blood analysis result", tells people that NICE has been sent a sample of their blood for further research.

The health watchdog said the contents of the email are likely to be distressing and have reported the incident to the police. Since the outbreak of the email hoax, NICE has been deluged by calls from worried individuals over the email.

The scam email, with the subject line "Important blood analysis result" tells recipients that NICE has been sent a sample of the recipient's blood for analysis.

"During the complete blood count (CBC) we have revealed that white blood cells is very low, and unfortunately we have a suspicion of a cancer," the sick message reads.

The message then asks the user to open an attachment claiming to be the test results. However, asking users to download and open attachments is a common way for for cybercriminals to plant viruses and malware on a victim's computer.

Sir Andrew Dillon, NICE Chief Executive: "A spam email purporting to come from NICE is being sent to members of the public regarding cancer test results.

"This email is likely to cause distress to recipients since it advises that test results' indicate they may have cancer. This malicious email is not from NICE and we are currently investigating its origin. We take this matter very seriously and have reported it to the police."

NICE advised people who receive the email to immediately delete it without opening in and not to click on any links within the email either.

UPDATE: Email verified as containing Zeus malware

An IT security firm had confirmed that the scam email purporting to be from Nice actually harbours the Zeus malware.

Fred Touchette, senior security analyst for AppRiver said that the attachment is a malicious zip file.

"If the attachment is unzipped and executed the user may see a quick error window pop up and then disappear on their screen," said Touchette.

"What they won't see is the downloader then taking control of their PC. It immediately begins checking to see if it is being analysed, by making long sleep calls, and checking to see if it is running virtually or in a debugger."

Touchette said that the malware also makes several duplicate instances of itself just in case someone was attempting to shut down the original process.

"Next it begins to steal browser cookies and MS Outlook passwords from the system registry. The malware in turn posts this data to a server at 69.76.179.74 with the command /ppp/ta.php, and punches a hole in the firewall to listen for further commands on UDP ports 7263 and 4400."

He added that this is all very common behaviour for the Zeus family of malware which is still very common in today's attacks.

Hotmail users will officially start being upgraded to Microsoft's Outlook.com email service, which has been officially launched today.

The firm claims that 60 million users have signed up to Outlook.com since it was made available for preview six months ago.

David Law, director of Outlook.com product management said that Microsoft has taken feedback on board to improve the service before launching it worldwide and moving users off of Hotmail.

"Through the preview, we've heard and learned a great deal about your favourite features and how well Outlook.com is delivering on our vision for modern email," he said in the Official Microsoft blog.

"For example, millions of people are connecting Outlook.com to Facebook, Twitter and LinkedIn to keep up-to-date on their friends' contact info, updates, photos, and Tweets. And a number of people have expressed appreciation that Outlook.com replaces advertising with the latest updates from Facebook or Twitter when they're reading email from one of their contacts."

Law claimed on average users see 60 per cent fewer ads when using Outlook.com. Microsoft plans to kick-off a major marketing campaign to promote the service and claims that it is ready to scale to a billion users.

However, not everything has gone smoothly with the planned migration. When the Outlook.com service was originally debuted in August 2012, Hotmail users vented their frustration as they were automatically upgraded without being consulted.

There appeared no way to switch back to the Hotmail service and some users were left without access to email.

Microsoft tried to remedy the situation by providing a step-by-step guide to upgrading, but it remained adament that the Hotmail brand would be phased out.

It remains to be seen if the upgrade goes smoothly. This is the second mass migration which Microsoft is working on con-currently.

The firm is also retiring its long-serving Windows Live Messenger service on 8 April and moving everyone over to the Skype platform, which it purchased in 2010 for $8.5bn.

HP is to partner with F5 Networks to cut down the time involved in configuring and deploying virtualised server applications on enterprise infrastructure.

The new initiative sees F5's application management tools combining with HP Virtual Application Network (VAN) fabric. The platform offers a set of plugins and configuration tools which let administrators create policies and profiles for configuring virtual machines and integrating them into an organisation's infrastructure.

Using the two technologies should see application deployment times cut from months to minutes, according to estimates by HP.

"We have separated the control plane from the devices themselves," said Bethany Meyer, general manager of HP Networking at the Interop conference in Las Vegas. "It makes networks programmable."

Layering automatic network configuration on top of HP's managed network products should increase the performance of popular application servers, such as Microsoft Exchange 2010, VMware-based backup and disaster recovery, and application acceleration, according to HP.

According to HP Networking's director of marketing Kash Shaikh such a platform would remove the need for systems administrators to configure settings manually in virtual machine deployments. He added that using command line interfaces to set up network configurations can require up to quarter of a million entries per server and it was easy for human input to create errors.

"You can still have one error in a thousand and end up with over a thousand errors," he said. Shaikh added that this would be the "beginning of the end for the command line interface."

The integrated technology means that networks can automatically sense the application running on the network and adapt. Meyer said that video could be displayed properly by analysing network traffic, seeing video was being passed through and adjusting the network to optimise performance.

Such adjustments could decrease spam on networks running Exchange 2010 by up to 70 per cent and decrease the time needed to move a virtual machine from datacentre to datacentre from 20 minutes to around 38 seconds, according to Meyer.

The release of HP's Virtual Application Networks is earmarked for around June. HP would not disclose pricing for the new platform.

HP said it will release further information about the platform over the next few months. It also plans to use F5 technology to accelerate other enterprise applications other than Exchange and VMware.

Larger and larger email inboxes are forcing companies to upgrade their messaging infrastructure, a research report has found.

The growth of rich media applications, and so-called "big data", will force 77 per cent of UK companies to modernise their email systems, according to a survey carried out for Mimecast. Around two-thirds of IT managers say they will move from their current email platforms to an on-premise installation of Microsoft's Exchange 2010.

A smaller number, 21 per cent, will move to a hosted version of Exchange, with the remainder considering other options, such as a business version of Google's Gmail. The main driver, said Alan Kenny, Mimecast's UK general manager, was the "exponential increases in the volume of data being produced" by email users.

But the scale of the task facing IT departments is significant. As many as 58 per cent of IT managers told Mimecast they faced problems with email data storage limits. However, moving larger volumes of data to a new system, either on premise or hosted, gives rise to its own difficulties. The risk of data loss and downtime were cited as two of the main barriers to upgrading email infrastructure. None the less, more than half told Mimecast they would migrate over the next year.

According to Chris Simmons, IT director at Birketts, a law firm, pressure on storage was one of the main reasons his company moved to Exchange 2010. The business has reduced "terabytes" of email data storage to some 350MB, saving storage costs and reducing loads on mail servers.

Birketts recently moved from Exchange 2003 to Exchange 2010, keeping its mail servers in house but moving email archiving to a hosted system run by Mimecast. Users can keep a year's email on the internal server, with older messages accessed via a button within the email client.

This, Simmons says, allows the firm to control the data storage growth prompted by the need to share large files, such as CAD-CAM data for buildings, without the need to impose fixed mailbox limits on users. "It means users don't have to worry about mailbox size. Most people can live within their local mailbox and don't need to go outside," he says.

Gartner, the industry analysts, recently found that 86 per cent of corporate email users with Exchange mailboxes are currently on Exchange 2007, or even older versions of the software.

Fujitsu is currently celebrating the 10th anniversary of its ScanSnap document scanner range and the N1800 network scanner is the top of the range model. It's a compact device, slightly smaller than an entry-level personal laser printer, with just two buttons and a huge colour touchscreen almost as large as an iPad's. The comparison is apt: Fujitsu says that the 'intuitive' screen helps to make the N1800 easy to set up and operate.

The N1800 can integrate with your network's existing SMTP, fax and print servers, allowing users to email, fax or print material directly from the scanner.

It needs to be, as this is a complex device with lots of features. Scans can be saved directly to a network share, or you could set several up for various projects or departments and allow users to choose which to target. The N1800 can integrate with your network's existing SMTP, fax and print servers, allowing users to email, fax or print material directly from the scanner. There's also direct integration with SharePoint, and the ability to authenticate users with LDAP, but oddly not Active Directory.

Fujitsu makes much of the N1800's security features. Access is controlled by password-protected accounts that can restrict the features available to users. Scans are encrypted while being processed internally and are deleted as soon as they're saved or transmitted all this should make it impossible to analyse and intercept them. To this end, there's also no USB port or any other such interface. As an additional precaution, unused memory is overwritten each time the scanner is initialised.

While this is no production scanner, it's designed for reasonably active duty of 400-2,000 pages per day. The 50-sheet input and output trays should be enough for most everyday jobs, but the output tray in particular feels less robust than we'd like on this class of device. We're also unimpressed by the 127gsm maximum recommended paper weight, which rules out cardstock and even some heavy-duty inkjet papers.

As a stand-alone device the N1800 doesn't need a host PC. Instead it's set up by following a wizard on the resistive touchscreen, which in use turns out to be accurate and quick to respond. The setup wizard is fairly self-explanatory, but the complexity of the scanner means that if you intend to implement all of its features you could spend some time working them all out. The full operators' guide, supplied as a PDF, has more than 500 pages.

Administrators are catered for with a network scanner admin tool... it's possible to connect to any N1800 in the network and access all of its administrative functions.

Administrators are catered for with a network scanner admin tool, which is downloaded directly from the N1800 via a web interface that doesn't work properly in Chrome we had to switch to Internet Explorer. Using the tool, it's possible to connect to any N1800 in the network and access all of its administrative functions, during which time would-be users are locked out it's important to remember to logout when finished.

From a user's perspective, the N1800 is far more straightforward. Once authenticated, staff simply load up a document and use the touchscreen to select a scan destination from those that you've configured. Once a document has been captured, they can if they wish use the screen to review each page before accepting the result and sending it to the destination. Scans are acceptably fast, with a 10-page simplex job taking 47 seconds at 200dpi. A 20-side duplex scan combining a mix of colour and black and white originals took just under one and a half minutes to complete.

We were much more impressed by another feature which detects text that's been marked out with a highlighter pen and can add it as keywords in a searchable PDF.

While we like the touchscreen interface, it's likely that it contributes to slightly higher power consumption than we've measured in other scanners. While a peak consumption of 48 watts isn't anything to worry about, this only dropped to 37 watts when idle, and 15 watts when sleeping with the screen off. Those looking to minimise power use may want to configure a short sleep timeout and encourage their users to use the power button, which reduces consumption to a more palatable 3 watts.

Although limited to A4 originals, Fujitsu supplies a carrier sheet for scanning A3. Originals must be folded, but with the relevant options selected the N1800 will scan both sides and stitch them together into a single document. This failed on our first attempt, but worked after we rotated the original by 180 degrees and tried again. Even then, our stitched document had a grey band separating its two halves. We were much more impressed by another feature which detects text that's been marked out with a highlighter pen and can add it as keywords in a searchable PDF. Predictably this added a few seconds' processing time, but the results were accurate.

While the N1800's scans are good enough for general office use, we've seen better. Colours appeared a little undersaturated, while the distinction between dark shades had been lost in the darker regions of our test documents. Unusually, duplex scans suffered from bleed through of content from the opposite side of the page. We've not seen this before, although for fairness we should point out that the originals we tested had been printed onto comparatively thin 75gsm paper.

So what's our verdict?

Verdict

While the N1800 is full of useful features, administrators might initially find it tricky to master. Most users will find it easy to use, however, and in practice it's likely to cost less to buy and support than a document scanner attached to a host PC – particularly given that everything except paper jams and maintenance can be dealt with remotely. Deploying the N1800 can provide a low-fuss way to distribute scanning throughout the enterprise, but it's not perfect, and we wish it felt a little more robust.

A4 duplex network scanner Optical resolution: 600x600dpi 24-bit colour Scan speed: 20ppm/40ipm scan speed Power consumption Sleep 15W Standby 37W Scanning 48W Part code PA03609-B001

Californian network and application performance company Riverbed Technology has paid 87 million in cash to acquire Zeus Technology, a UK-based software company which specialises in technologies that help to deliver applications over the network.

Riverbed also announced it had acquired Aptimize, a New Zealand company that develops web content optimisation software.

Riverbed said that the two companies would form the cornerstone of its asymmetric optimisation strategy. It was already a market leader in symmetric optimisation, where its Steelhead boxes are installed at both ends of a WAN connection and speed up traffic on the line.

Before the acquisitions, Riverbed had much less to offer companies who needed to speed up the delivery of applications over the internet.

Zeus's expertise is in software-based application delivery controllers (ADCs) which it typically sells as virtual appliances, running on a broad range of hypervisors.

Its products include a load balancer that automatically routes users to the most appropriate data centre or cloud, a web application firewall, and a traffic manager which optimises and accelerates protocols such as SSL, XSLT and HTTP.

"Our goal is to have the broadest and best portfolio of performance optimisation products to solve a range of customer performance problems," said Jerry Kennelly, Riverbed's president and chief executive (CEO).

"The acquisition of Zeus is a perfect fit with that strategy. The Zeus solutions are designed for how people want to architect their applications now high-performance software for cloud environments."

Kennelly added that Zeus's software-based approach made it a better fit than traditional hardware for virtualised and cloud environments, because its virtual ADCs deploy and scale more readily, and can be integrated into an application stack.

"According to industry analysts, the virtual ADC market is expected to grow about four times faster than the traditional ADC market over the next four years," he said.

Cambridge-based Zeus - which has around 1,500 customers worldwide, compared to its new parent's 13,000 - will become a new business unit within Riverbed, and will continue to be led by Zeus CEO Jim Darragh.

The Ministry of Justice (MoJ) has been made responsible for delivering the Government cloud strategy, IT Pro understands.

The department's chief information officer (CIO) Andy Nelson has been placed in charge of overseeing the Government's transition to the cloud, said Keith Roberts, ministerial business advisor at the Cabinet Office.

Last month, HP managing director in the UK Nick Wilson told IT Pro the the Government had ditched its G-Cloud project.

The Government responded by saying it still had cloud computing plans, but it did not refer to the G-Cloud by name.

The Government ICT Strategy published in March committed the Government to publishing a cloud strategy by September 2011.

"The Government is currently developing a cloud strategy and it would be inappropriate to disclose the details of our plans until we have carried out internal consultation and received pan-Government clearance on our approach," Roberts told IT Pro.

For the past six months, Government cloud development has been under the guiding hands of interim chief for digital services in the Cabinet Office, Chris Chant.

Nelson, an Oxford University graduate, was once a management consultant at Accenture and a group director at Royal Sun Alliance.

Now he will have to guide Government over to the cloud, not just act as CIO for the MoJ. What role overall Government CIO Joe Harley will have in the development of the cloud strategy remains to be seen, although many CIOs will be involved.

The Government CIO Delivery Board, consisting of CIOs from the larger central Government delivery departments, has responsibility for "leading on the delivery of specific areas of the ICT strategy," Roberts added.

The majority of application delivery controllers (DLCs), or server load balancers, are priced way beyond the means of SMBs but Kemp Technologies is one of a growing number of vendors that aim to make this technology far more affordable. In this exclusive review we look at its latest LoadMaster 3600 which represents the higher end of a family of four general purpose appliances and with a price tag of 7,250, looks particularly good value.

The 3600 provides server load balancing, Layer 4/7 content switching, SSL acceleration for up to 5,000 transactions per second (TPS) and supports 1,000 physical and 1,000 virtual servers out of the box. It supports a number of deployment methods where a single-arm mode uses one network port with all physical and virtual servers on the same network subnet.

We opted for the two-arm mode which keeps physical and virtual servers separated on different subnets. The appliance has eight Gigabit Ethernet ports and for high availability you can use two appliances for failover purposes.

Initial installation is simple as you have three methods of access. The CLI (command line interface) can be accessed with a serial port connection, you can plug in a local monitor and keyboard or simply point a browser at the appliance's default IP address.

The 3600 adheres to the standard concepts for server load balancing as you create farms using multiple physical servers and assign these to virtual servers. For testing we used a VMware ESX Server 4 system to present multiple real' servers running web, FTP and mail services. Creating virtual servers was simple as we provided an IP address, port number and protocol and then assigned physical servers to them using their real IP addresses.

Kemp has seven load balancing schemes with the default round robin mode intercepting incoming requests and distributing them to each server in strict rotation. Weighted round robin mode allows priorities to be assigned to each server in the farm thus ensuring the better specified servers are kept the busiest.

Traffic distribution can be based on real servers with the least number of connections. Weightings can also be applied to further control which servers in the farm are used most. Weighted response time is a new scheduling method where the weights for each server are automatically adjusted based on their response times.

An agent can also be used to allow load balancing to adapt to server performance. The agent presents a numerical value between 1 and 100, which defines how busy the server is, to a LoadMaster query. The only drawback is that each real server must be running IIS, rather than an alternative such as Apache or even if it's not being used as a web server, as the LoadMaster expects a web page containing the value.

Kemp should look at adding load balancing features for VM-based server farms. In our sister title PC Pro we exclusively reviewed Coyote Point's Equalizer E250GX and were impressed with its VLB (virtualisation load balancing) feature which uses parameters such as VM availability and utilisation data to load balance.

For connection persistence the 3600 can use Layer 4 inspection which uses source and destination addresses to ensure traffic from a particular client is always sent to the same physical server. Kemp offers a good range of L7 connection persistence methods which includes cookies, session IDs and URLs along with rules for inspecting HTTP content.

Kemp provides a good range of L4 and L7 persistence controls to ensure users are handled by the same real server during their session.

For SSL acceleration the 3600 uses a Cavium Nitrox hardware accelerator card. Normally, the appliance decrypts SSL traffic and sends it to the internal servers in the clear to improve performance but another new feature allows traffic to be re-encrypted by the appliance before passing it on.

To test the appliance we created a virtual web server with three real servers assigned to it with round robin weighting applied. Using a client system on the external side we pointed a web browser at the virtual IP address and were rewarded with the standard web site we had configured on the real servers.

Paessler's Webserver Stress Tool and configured it to simulate 2,000 users each clicking on a web page every five seconds. With the load ramped up we could see from the LoadMaster's statistics page that all requests were being evenly distributed across the real servers and during this test Paessler detected no errors.

We also created a virtual FTP server using our three real servers each with an identical download folder containing 6GB of test data. We logged on to the virtual server from three different clients using the FileZilla utility and while downloading the test folder saw that each had been sent to a different real server.

Using the Kerio Connect mail software we also created a virtual server for web mail. Our clients were able to connect normally to the virtual server where they were presented with the standard secure login page and were none the wiser that they were being load balanced.

Other useful features include the option to cache static web content in RAM for faster responses and the ability to apply GZIP compression to HTTP objects. Basic intrusion prevention is also available as the appliance uses SNORT rules to check incoming web traffic and block anything malicious from reaching the real servers.

The 3600 can cache and compress web content and uses SNORT rules to provide intrusion prevention measures.

For the price, the LoadMaster 3600 is a well specified application delivery controller that beats Barracuda's Load Balancer 640 hands down on value. It's easy enough to deploy and offers an impressive selection of features for controlling load balancing and connection persistence.

So what's our verdict?

Verdict

The LoadMaster 3600 beats most of the competition at the value end of the server load balancing market as it offers an excellent range of features. A traffic throughput of 3.4Gbit/s and 5,000 TPS SSL acceleration rates are also exceptionally good at this price point. Our only gripe is the need for Kemp to address the use of VMs as physical servers and bring in some load balancing features specifically for these environments.

Chassis: 1U rack CPU: 2.67GHz Intel Core 2 Quad Q9400 Memory: 4GB DDR3 Storage: Transcend 512MB DOM Network: 8 x Gigabit Ethernet Other Ports: VGA, serial, 2 x USB2 SSL Acceleration: Cavium Nitrox PX CN1610 PCI Express card Power: 200W fixed supply Management: Web browser

IT has to be usable, so that everyone from salespeople to data analysts can work effectively, without technology becoming a hindrance. With this in mind, CTOs look for very specific advantages from their IT investments: increased productivity, reduced costs of doing business, and competitive advantage; all delivered with the minimum of increased overhead in the IT department.

The emphasis for IT managers in midsize and enterprise organisations is therefore changing to meet an ever-more diverse range of business needs equipping desktop machines towards delivering a stable and economical platform. Members of IT departments must no longer see themselves solely as technicians, but as providers of business services.

Thinking of IT as a service provision has led to the development of exciting new models to deliver business functions to employees. Thanks to near-universal Internet connectivity, one alternative to the traditional purchase of hardware and licensing of software is the hosted solution. By buying in IT from third-party suppliers, large organisations can outsource IT management functions in the same way as they might, for example, outsource a call centre enjoying the reduced costs that such economies of scale present.

Instead of buying software licenses and hardware, and then employing IT staff to manage the infrastructure, the entire management function is bundled up into one manageable third-party arrangement. "The downsides are few and far between, as a result of the increases inInternet bandwidth. The capacity for business broadband is just enormous. Bandwidth is not a question; it's there now", says Mike Williams, Head of Application Strategy at hosting providers 7Global.

Analysts IDC predict a 32% annual growth in Online delivery of business applications (known as "Software as a Service") between now and 2011, and Microsoft is at the forefront. Infosys Consulting report that $2.4bn of Microsoft software will be delivered via hosted solutions in the next three years.

Click the link below to read the full report.

Amazon Web Services (AWS) has launched a new bulk and transactional email service aimed at businesses and developers.

Through the offering, named the Amazon Simple Email Service (Amazon SES), users will be able to send a significant number of messages without having to worry about ISP compliance issues and so ending up in spam folders.

"Amazon SES takes proactive steps to prevent questionable content from being sent, so that ISPs receive consistently high-quality email and therefore view the service as a trusted email origin," the company said.

"This maximises deliverability and dependability for all of our senders."

Amazon said its new service would help firms get around time consuming licensing and installing a third-party service, or maintaining an internally hosted email solution.

"Sending email through Amazon SES is as simple as calling a single API, and Amazon SES makes it easy for you to monitor your sending activity and deliverability statistics," the retail and services firm said.

Amazon EC2 users can send 2,000 messages for free every day, but outside of that mail messages have been priced at $0.10 per thousand.

Also included in the service is a built-in feedback loop, which will notify customers of bounce backs and spam complaints, as well as failed and successful delivery attempts.

Earlier this month, AWS revamped its cloud support offerings with some revised pricing and the new Bronze and Platinum packages.

A new generation of technology is transforming the world of computing. Advances in Internet-based data storage, processing, and servicescollectively known as "cloud computing"have emerged to complement the traditional model of running software and storing data on personal devices or on-premises networks. Many familiar software programs, from email and word processing to spreadsheets, are now available as cloud services. Many of these applications have been offered over the Internet for years, so cloud computing might not feel particularly new to some users.

Still, several aspects of cloud computing differ markedly from previous computing paradigms and offer distinct benefits. Today's cloud services are highly scalable, which enables customers to pay only for the computing storage and power they need, when they need it. Datacenters in diverse geographies allow cloud providers to store and back up information in multiple locations, which enhances reliability and increases processing speed. And significant economies of scale generated by "server farms" that can simultaneously support scores of users mean major cost savings for customers. (For more information, please see the Microsoft whitepaper, The Economics of the Cloud.)

These advantages are leading governments, universities, and businesses of all sizes to move mission-critical services such as customer relationship management, enterprise resource planning, and financial data management into the cloud. At the same time, the unique attributes of cloud computing are raising important business and policy considerations regarding how individuals and organizations handle information and interact with their cloud provider.

In the traditional information technology (IT) model, an organization is accountable for all aspects of its data protection regime, from how it uses sensitive personal information to how it stores and protects such data stored on its own computers. Cloud computing changes the paradigm because information flows offsite to datacenters owned and managed by cloud providers.

Cloud customers remain ultimately responsible for controlling the use of the data and protecting the legal rights of individuals whose information they have gathered. But defining the allocation of responsibilities and obligations for security and privacy between cloud customers and cloud providersand creating sufficient transparency about the allocationis a new challenge. It is important for customers and their cloud providers to clearly understand their role and be able to communicate about compliance requirements and controls across the spectrum of cloud services.

Microsoft understands that strong privacy protections are essential to build the trust needed for cloud computing to reach its full potential. We invest in building secure and privacy-sensitive systems and datacenters that help protect individuals' privacy, and we adhere to clear, responsible policies in our business practicesfrom software development through service delivery, operations, and support.

Click the link below to read the full White Paper.

A new service from BT has received a barrage of criticism and has led to the company being accused of threatening net neutrality.

Content Connect enables the internet service provider (ISP) to charge those producing content online for higher quality access to their websites. Many believe this process could lead to a "two-tier internet" as content will be prioritised by its pricetag rather than substance.

Jim Killock, executive director of the Open Rights Group, said: "We are talking about ISPs competing with the internet for content delivery the idea is that ISPs will deliver this stuff better and more reliably than the internet."

"The result could be a fundamental shift away from buying services from the internet to bundled services from ISPs, which would reduce competition and take investment away from internet companies. That would be bad for everyone."

However, BT has claimed the service would actually improve internet delivery for everyone by freeing up an otherwise clogged network.

A statement sent to IT PRO from BT said: "BT believes that service providers should be free to strike commercial deals should content owners want a higher quality or assured service delivery."

"BT's Content Connect service will not create a two tier internet, but will simply offer service providers the option of differentiating their broadband offering through enhanced content delivery."

The statement added: "To improve the quality of video content consumed by customers, service providers can either opt for BT's new content distribution network, or can choose to improve the quality of the viewing experience by offering faster download speeds."

"Because Content Connect stores content closer to the end customers, it is likely to improve the overall broadband experience for all customers."

This argument has failed to convince the service's critics though and Labour MP Tom Watson told IT PRO he would address the issue in the House of Commons.

"This is a worrying development," he said. "Turning a broadband connection into the internet equivalent of Sky TV is not good for small businesses or consumers. I will be raising this in Parliament at the earliest opportunity."

Controversy around net neutrality kicked off again back in November when Ed Vaizey, Conservative MP and communications minister, backed the idea of charging for superior delivery of websites if content providers coughed up the fee.

His comments were seized on by a number of opponents but one of the biggest came in the form of the BBC, which said it would warn users if any ISPs downgraded the quality of access to its websites and the iPlayer.

The Government "should do all they can" to avoid regulation of the internet, according to one of its senior ministers, but still allow ISPs to charge for speedier delivery of sites.

Ed Vaizey, Conservative MP and communications minister, claimed the Coalition should help the internet remain open and transparent and all legal content should be viewable by the general public.

However, he still believed ISPs should be allowed to manage their networks and charge content providers and users for faster access.

In a speech at the FT World Telecoms Conference, Vaizey said the current internet model had allowed for an "unprecedented level of innovation," allowing for huge companies to emerge and make millions of dollars.

"This is a model that the British government wishes to protect," he added. "A lightly regulated internet is good for business, good for the economy, and good for people."

However, campaigners for "net neutrality" have hit back at the suggestion, backed by telecoms regulator Ofcom and the European Commission.

"Removing 'net neutrality' is likely to reduce innovation and reduce people's ability to exercise their freedom of speech," said Jim Killock, executive director of the Open Rights Group (ORG).

"ORG will campaign against any market abuse, if companies like BT, Sky and Virgin restrict customer's internet access for market advantage."

However, Vaizey concluded: "The government is no fan of regulation and we should only intervene when it is clearly necessary to deliver important benefits for consumers."

As the war against spam heats up, internet service providers (ISPs) are blocking millions of legitimate emails every day.

The worst hit are social networks. More than a quarter (27 per cent) of Friends Reunited's emails, for example, were bulk blocked by ISPs in May, according to email delivery company Return Path.

"About one in five commercial permission-based emails are being blocked globally, and 15 per cent in Europe are blocked because ISPs are treating them as spam," Margaret Farmakis, senior director of response consulting for Return Path, told sister title PC Pro. "I wouldn't be able to say if it was millions or billions, but it is countless."

"We're not talking about spam, these are emails that people have asked to receive, but that are being treated like spam," she added. "It doesn't effect one-to-one emails, but a lot of marketing emails and communications from social networks, for example, are never delivered to the end user."

According to Return Path, email is often caught in the spam trap because some end users flag emails as unsolicited when actually they have just got bored of receiving emails from a company. If a company receives too many spam reports around one per cent of mails from any one company then all emails from that company are tarred with the same brush.

Social networks are increasingly falling into ISPs' spam filters because of the way subscribers sign up to the services, with networks often suggesting that users import email address books.

Return Path said emails from social networks were twice as likely to be caught up in the ISP bulking traps than mails from other industries.

"The practice of importing loads of addresses can have an impact," said Farmakis. "Effectively you are sending a lot of emails to people who haven't asked for them, and some of those email addresses could be really old, which might be out of use or being used as spam traps. It can be risky."

Despite the high number of false positives, Farmakis refused to blame ISPs for the wrongly blocked missives, saying that some legitimate emails were inevitably going to be caught in the crossfire.

"Between 97 per cent and 98 per cent of all email is spam," she said. "ISPs have to weed through it and try and discover what they should deliver and when they should protect their end users from spam. It's like they're fishing and if a company's email looks too much like spam they get caught up in the net."

T-Mobile has delivered an Android double-whammy by officially starting to take orders for both the HTC Desire and the Sony Ericsson Xperia X10.

The network will start shipping both phones on Friday, but early adopters can make sure they don't miss out by pre-ordering today, though T-Mobile anticipates delivery times of seven days for the Desire and 10 days for the X10.

The X10 is Sony Ericsson's first stab at using Google's mobile platform, and is now available free on deals starting at 35 per month over two years. For that you get 900 free minutes, 500 texts and unlimited internet.

However, if you're willing to fork out 226 up front you can bring that right down to just 10 per month, although you'll also have to put up with just 100 minutes of calls and 100 texts though you still get unlimited online access.

Indeed, such a limited deal seems out of place for the X10, a smartphone that certainly doesn't pull any punches. A massive 4in capacitive touchscreen sets the tone, complete with 854 x 480-pixel resolution, making it officially the biggest Android phone thus far.

Interestingly, even the attractive-sounding 10-per-month T-Mobile offer still adds up to a total cost of ownership of 466, which is only a little below the 490 one-off price Play.com is charging to get the handset SIM-free.

The equally anticipated HTC Desire, meanwhile, is largely the same as the HTC-made Google Nexus One, featuring the same 3.7in capacitive touch screen, 1GHz Snapdragon processor and Android 2.1 OS. The main difference is that the Desire uses HTC's own Sense interface over the top of Android.

Like with the X10, the cheapest way to get the Desire which is exclusive to T-Mobile until next month without paying anything up front is on a 35-per-month contract, though in this case you get 1,200 minutes, 500 texts and unlimited internet.

Similarly, T-Mobile is offering the same stripped-down 10-per-month deal for headline-grabbing purposes, though this time with an up front cost of just 164.

A10 Networks is breaking its way into the UK with a new 64-bit operating system to deliver applications and load balance servers in the data centre.

Its Advanced Core Operating System (ACOS) is designed to work with the company's Application Delivery Controllers (ADC) to improve performance, speed and scalability.

Todd Kleppe, senior director of Global Operations for A10, told IT PRO in an interview: "The prior version of ACOS was 32-bit. It was effective but there was one drawback. It limited memory to 4GB per CPU. This really limits what you can do, but with 64bit it breaks this barrier."

By increasing addressable memory, scalability is hugely increased and helps with surge protection, enables larger RAM caching and optimises application response times.

In addition, the new ACOS uses shared memory architecture, which removes the need for communication between processors. By eliminating what it calls Inter-process Communication (IPC), the system speeds up reaction times and increases efficiency.

Dan Buckley, regional sales manager for A10, told IT PRO: "If memory is shared, adding processors just ups the performance without diminishing the return."

"To have a truly scalable symmetric system it needs to be zero IPC and shared memory," he added.

Both the ACOS and a range of ADCs are available immediately.

When deciding which operating system - or platform - is best for business, there are a number of considerations you'll have to take into account, such as which handles email in the most efficient way, whether browsing is clear enough for online applications, and which platforms are best to carry out multiple functions.

Blackberry for example, syncs all office applications including POP and IMAP email with its Enterprise Server. Windows for Mobile utilises Microsoft's exchange server, while the iPhone utilises Apple's own MobileMe platform for push email.

Matt Hatton, principal analyst at Analysys Mason, believes that when deciding which OS is best for business comes down to survival of the fittest.

"The business market differs from the consumer market in two ways. There's the need for reliability and the availability of IT support in business applications, and in consumer markets, open models will dominate," he explained.

"The business market demands a rather more managed approach. An end-to-end managed environment is more in keeping with the demands of business. That's why a company like RIM is so successful with the Blackberry product. It controls all elements of the service including device, application and server to ensure the optimal user experience."

The contenders

However, James McCarthy, head of business marketing at Microsoft, believes that the familiarity a platform such as Windows provides for business people is one of the most important factors when deciding which OS to choose.

"Windows brings the familiarity of Microsoft Office to the mobile device, including Outlook Mobile, Word Mobile, Excel Mobile and PowerPoint Mobile. Through these we deliver a great deal of similarity from PC screen across to mobile screen."

"Outlook Mobile can be securely enabled on Windows Mobile devices without the need for any additional software or servers, just with a relatively inexpensive data bundle' from the mobile operator," he told IT PRO.

"This makes delivering Outlook Mobile to all employees a very cost effective use of existing company assets more so than mobile email solutions that require additional servers and expensive tariffs."

David Wood, part of the Leadership Team at the Symbian Foundation, thinks that platform support and development is one advantage that Symbian has over other platforms.

"Symbian is the only platform with roadmap input from a range of the world's leading mobile companies. It has a uniquely proven capability in both roadmap design and roadmap delivery.

"We have healthy and productive relationships with network operators around the world and support a wide range of hardware, device form factors, and user interface models - offering great choice to both consumers and business people," he said.

"The powerful ecosystem of partners means that we can quickly provide new solutions catered for specific consumer and business use."

Examining applications

When examining which platform is most useful for business, there are two main considerations, said Hatton.

"There are horizontal applications that are relevant to all business, such as email, web browsing. Other than voice, email is probably the single most used application, simply because it is such an integral part of how we do business today.

A well-implemented email application can save businesses time and money.

"As little as a 15 minute per day time saving is enough to pay for a mobile email solution for most businesses," Hatton explained.

McCarthy explained how Windows brings together these two elements.

"Windows is the platform of choice for line-of-business applications for businesses who want to give their field-based' workers direct connectivity to business processes. If you've ever signed for a parcel on your doorstep directly on to a mobile device, it's almost certainly running Windows Mobile and is connected to very efficient processes that reduce cost and waste, while improving competitiveness of the delivery company as a business."

The question of openness is another important factor when considering which platform is best for business. The possibility of developing and more installing applications that benefit business means that a mobile phone can become an office on the move.

App stores

Application stores were one of the main talking points of Mobile World Congress last week, with companies including RIM, Microsoft, Google and Symbian launching or revamping an application marketplace in the face of Apple's version.

Hatton explained that this puts the vendors into a certain amount of conflict with mobile network operators who historically have controlled the sale of applications, at least to consumers.

Wood said: "Symbian's open source and open processes will encourage and support a much greater range of third party innovation, resulting in numerous new and improved enterprise applications and services. We're being transparent with our roadmap and decisions, as well as with our source code."

There are more than 18,000 known mobile applications available for the Windows Mobile platform according to McCarthy.

In Hatton's opinion, you have to go a long way to beat RIM, despite its application marketplace being one of the newest.

"Businesses benefit from a controlled ecosystem even if it means that some third-party innovation is lost. RIM's dominance of the enterprise space is based on tight control of the end-to-end user experience.The company has also recently been putting a lot of effort into extending the range of third party applications supported by their devices," he added.

"The big issue is that we're seeing an increasing fragmentation of the application development environment, meaning that application developers need to produce more and more different versions of their applications to sell across multiple platforms."

Hardware choices

When it comes to hardware range, Windows and Symbian lead the way, with a large number of manufacturers taking on the platforms.

"Windows Mobile offers a wide choice of devices, of all shapes and sizes some have keyboards, some have numeric keypads, some are even ruggedised' which makes them suitable for delivery drivers and other outdoor workers who need something tougher," McCarthy said.

Symbian has been taken on by Nokia, Samsung plus Sony Ericsson and this is set to increase too, with the formation of the Symbian Foundation that brings together major players including Nokia, Sony Ericsson and LG.

The three main smartphone platforms each have advantages; Blackberry's business-controlled environment gives IT managers complete control over features, whether it be synching or email, while Windows is the most familiar platform for those using PCs. Symbian has the support of major telecoms companies, but only time will tell if it can sustain its focus on business rather than consumer devices.

For the latest mobile phone news and reviews, check out Know Your Mobile.