The common perception of information security software is that its purpose is to protect the confidentiality, integrity and availability of data. While this is true, it omits a major and rapidly growing additional threat: the threat of legal liability for illegal content held on corporate computer systems, or transmitted through corporate networks. Companies and company executives can now be held liable for any illegal content held on the network. This includes pornography, racist comments and sexual harassment either stored on disk or transmitted over company e-mail. Our definition of information security therefore needs to be expanded: its purpose is to protect the confidentiality, integrity, availability and legality of company data. We need an additional application: content security; an application that examines the content of messages to ensure they contain no threat.
But the threat contained in messages is not just liability for the content: we need also ensure that no sensitive corporate data can leak out of the company. Furthermore, viruses, Trojans and worms may be carried as attachments to the mail. Indeed, if the mail is in HTML format, it may contain active code malware in the body of the message itself. Finally, there have been several cases of malware exploiting vulnerabilities in the mail client. It follows, then, that we need some sophisticated software to analyse e-mail for both visible and invisible threats. This has come to be known as 'content security'.