Many employees bound for vacation enable their Lotus Notes’ out-of-office function and modify their voice mail message so those sending e-mail messages or calling know they are unable to respond to incoming messages. But is there a potential security risk in doing so?
Perhaps, but UNMC’s Information Technology Services staff says there are reasonable steps employees may take to mitigate potential risks without disabling the out-of-office function.
To mitigate any potential risks, ITS recommends employees:
- Configure their out-of-office agent so it does not reply to Internet addresses. Doing so, will keep the message from getting looped into a listserve. It also minimizes other risks by not releasing the out-of-office information outside of the company/organization. To configure the out-of-office agent, users can click on the “Exceptions” tab and click the checkbox that says “do not automatically reply to mail from Internet addresses.” (Questions, contact the HelpDesk at 559-7700)
- Be advised of the potential risks posed by out-of-office messages.
- Using vague wording, such as “currently unable to reply until xx/xx/xx” or “not in the office at the moment.” Avoid saying that you are on vacation.
- Do not provide your mobile or home phone number, address, or hotel contact information within the out-of-office message.
- Do provide alternative contact details and make sure that the designated person is fully briefed regarding your absence so they do not give information to unidentified callers.
Last year, a United Kingdom organization warned its members of the potential security risk posed by automated out-of-office messages, identifying three main risks with automated out-of-office messages:
- Risk to personal property –If an individual sends a message to a large e-mail list, and a user’s out-of-office agent replies to the message it could potentially let the sender know you are out of town and make your home the target of a break-in.
- Risk to UNMC campus security — Similar to the above scenario, the message may tell the sender that your log-on ID is not in use, prompting them to experiment with it or try to hack into the system.
- Personal privacy concerns — If you leave personal or cell phone numbers or hotel information on your out-of-office message, it could be abused for unsolicited purposes.