At any large hospital, as with business in all industries, e-mail is an integral part of operations. At a hospital like Cedars-Sinai Medical Centre in Los Angeles, it relies on e-mail to transmit patient test results to doctors, coordinate the schedules of residents and staff, and send intensive-care unit alerts to the pagers of nurses and physicians. Physicians, residents and others use e-mail to collaborate.

"E-mail is a mission-critical application here," says Jim Brady, e-mail administrator at Cedars-Sinai.

While it's not news that e-mail has become a crucial part of business, what has changed is the sheer quantity of valuable business information that is being shared and stored exclusively as electronic mail.

"E-mail has taken over as the dominant way that employees and organizations exchange information. In the past, e-mail was the way information about a meeting or the company picnic was distributed. But today, e-mail is the way all employees transact real business," says Randolph Kahn, founder of Kahn Consulting.

But mixed with all of that critical data are volumes of junk mail and worse: spam, viruses, personal notes and potentially offensive content. Along with cuts in productivity, there are the risks of corruption, deletion or theft of corporate e-mails containing valuable business data, as well as the accidental leakage of embarrassing or legally damaging content. E-mail can also put a company in jeopardy of lawsuits or fines for not complying with government and industry regulations.

According to IT managers and industry experts, there are three key technologies that few organizations can be without: antispam and antivirus defences for screening incoming mail; outbound filtering and encryption to evaluate and protect outbound content; and archival software to ensure that e-mail containing intellectual property or addressing topics covered by government or industry regulations are retained in case of future need.

Organizations need inbound e-mail filtering software to catch spam, viruses and other junk mail before they clog or damage servers and desktops. Spam and virus protection usually starts at the network perimeter, either provided by an outsourced service provider or installed at the organization's Internet gateway. It's also a good idea to have antivirus software on e-mail servers and desktops, to guard against bugs on floppy disks, CDs and USB drives.

The 12,500 e-mail users at Cedars-Sinai are protected by IronPort Systems' e-mail security appliance installed on the hospital's e-mail gateway. The IronPort device has its own virus and spam filters, as well as Sophos' AntiVirus and Symantec's Brightmail AntiSpam software.

Because spammers have learned to evade traditional content-based spam filters, products like Brightmail combine multiple technologies, including heuristic analysis of the content, filters to detect URL masking, and reputation-based filtering of mail from suspect servers. IronPort also uses a reputation service to catch spam and viruses.

"If a piece of spam comes in from an IP address with a known bad reputation, it gives it a bad score," Brady says.

In the past, Brady's team employed a spam filter that deleted mail tagged as spam. But staffers complained that legitimate e-mail was being lost. With the current approach, spam is quarantined on the appliance and users get a list of suspected spam e-mails that they can opt to save, delete or ignore.

To block viruses at the gateway, the hospital uses Sophos antivirus software on the IronPort appliances, as well as IronPort's SenderBase Network service. SenderBase collects data about Internet e-mail traffic in an effort to find new virus outbreaks.

For added protection, Sybari Software's Antigen product is deployed on the Exchange servers themselves. "It's another layer of protection in case something makes it through the gateway," Brady says.

Controlling e-mail that goes out of the hospital is also a concern at Cedars-Sinai, mainly because of regulatory and privacy requirements.