Because of this, the scanning software should be able to identify different types of content and attachments in messages and apply specific rules to them. The rules should quarantine encrypted messages until anti-virus software on recipients' desktops can be confirmed. As encryption becomes more widespread in the future, it will become even more important to have anti-virus software that can allow or disallow encrypted messages to predetermined groups of recipients. The scanner should immediately alert system administrators, and the user, upon detection of a virus. The alert options should be adjustable depending on the severity of the issue.
Infected messages originating from the inside are a completely different matter.
An outbound virus signals a breakdown in anti-virus protection on the network and should be treated as an emergency. As with any good security system, logging is paramount. The SMTP gateway scanner should provide a complete history log, or audit trail, to track the virus' origin. When a virus outbreak is detected, it can be difficult to respond to all alerts immediately. With good logs it is possible to review the path of the virus and ensure that all machines involved have been checked, and that procedures and polices have been modified to keep similar outbreaks from happening again.