A computer system, comprising: a processor; a communication connection for receiving a file; and a memory; wherein the computer system is configured to perform a method comprising: determining, in response to receiving a file from an external source at the communication connection, whether the received file includes user data areas (210, 212) for storing user data and other data areas (202, 204, 206, 208) for storing at least one of macros, templates, embedded objects and applied styles, and if so: filtering out those portions of the received file that are within the user data areas; generating a file signature based only on those portions of the received file that were not filtered out; connecting with a white list data store comprising a collection of records of trusted files, wherein each record includes a file signature of a trusted file, and submitting the generated file signature to the white list data store and in response thereto, obtaining a trust level corresponding to the received file; determining whether the received file is malware based on the obtained trust level; and if it is determined that the received file is malware, processing the malware according to established procedures; and if it is determined that the received file is not malware, admitting the file to the computer system according to established policies relating to the obtained trust level; wherein the white list data store is remote to the computer system, and wherein the computer system is further configured to access the white list data store via the communication connection. a processor; a communication connection for receiving a file; and a memory; wherein the computer system is configured to perform a method comprising: determining, in response to receiving a file from an external source at the communication connection, whether the received file includes user data areas (210, 212) for storing user data and other data areas (202, 204, 206, 208) for storing at least one of macros, templates, embedded objects and applied styles, and if so: filtering out those portions of the received file that are within the user data areas; generating a file signature based only on those portions of the received file that were not filtered out; connecting with a white list data store comprising a collection of records of trusted files, wherein each record includes a file signature of a trusted file, and submitting the generated file signature to the white list data store and in response thereto, obtaining a trust level corresponding to the received file; determining whether the received file is malware based on the obtained trust level; and if it is determined that the received file is malware, processing the malware according to established procedures; and if it is determined that the received file is not malware, admitting the file to the computer system according to established policies relating to the obtained trust level; wherein the white list data store is remote to the computer system, and wherein the computer system is further configured to access the white list data store via the communication connection. determining, in response to receiving a file from an external source at the communication connection, whether the received file includes user data areas (210, 212) for storing user data and other data areas (202, 204, 206, 208) for storing at least one of macros, templates, embedded objects and applied styles, and if so: filtering out those portions of the received file that are within the user data areas; generating a file signature based only on those portions of the received file that were not filtered out; connecting with a white list data store comprising a collection of records of trusted files, wherein each record includes a file signature of a trusted file, and submitting the generated file signature to the white list data store and in response thereto, obtaining a trust level corresponding to the received file; determining whether the received file is malware based on the obtained trust level; and if it is determined that the received file is malware, processing the malware according to established procedures; and if it is determined that the received file is not malware, admitting the file to the computer system according to established policies relating to the obtained trust level; wherein the white list data store is remote to the computer system, and wherein the computer system is further configured to access the white list data store via the communication connection. filtering out those portions of the received file that are within the user data areas; generating a file signature based only on those portions of the received file that were not filtered out; connecting with a white list data store comprising a collection of records of trusted files, wherein each record includes a file signature of a trusted file, and submitting the generated file signature to the white list data store and in response thereto, obtaining a trust level corresponding to the received file; determining whether the received file is malware based on the obtained trust level; and if it is determined that the received file is malware, processing the malware according to established procedures; and if it is determined that the received file is not malware, admitting the file to the computer system according to established policies relating to the obtained trust level; wherein the white list data store is remote to the computer system, and wherein the computer system is further configured to access the white list data store via the communication connection.