Suppose there is a small, non-profit, organisation; say a church or music society. They want to communicate with members, for example to distribute minutes of meetings. The members are have varying degrees of computer literacy, but none are IT professionals.

Currently they email Word documents to each other. This implies that they open Word documents received as attachments.

Questions: Would distributing the documents in a different format (eg. PDF) reduce the risk of attack via spoofed emails? Should the society simply not communicate via attachments? To be more specific: my concern is that a spoofed email would contain an attachment containing malware. I don't care that we receive spurious minutes or other communcation; rather I'm concerned that recipients will think they are receiving trusted attachments.

  • no, you can prevent email spoofimg with DKIM, DNSSEC and SPF. Also PDF files can contain malware. – Daniel Ruf Dec 26 '15 at 10:31
  • I don't understand why you would email Word documents to communicate. Why not just put the communication in the email directly? – André Borie Dec 27 '15 at 23:33
  • Because the documents are also printed and displayed on notice boards, they contain tables and figures and hence benefit from formatting most easily created in a word-processor. – djna Dec 28 '15 at 5:36

The format of the document doesn't matter. It's a matter of balancing risk. How lucrative of a target is your organization or its members? How far do you think an attacker would be willing to go to get a persona on your group? If you are sending out a Word document once a week, and all of a sudden a PDF shows up, it's up to the users to know better not to open that.

If security is that much a concern in your organization, your best option is to include all of the text in your email body, and don't use attachments. But then again, if you are that concerned about security, it may be worth investing some money into a website or a Sharepoint site.


As Lutefisk mentioned. All text in the email body would be the best way to go.
It's probably also worthwhile advising the members how to be more secure on the internet: keeping av installed/updated, keeping their OS fully updated, safe extensions for their web browser (e.g. Netcraft, Noscript, HTTPS Everywhere, Ghostery, Ublock Origin).


I would use Word if all your members have Microsoft, or else pdf. Because you are distributing minutes. You aren't sending financial payments, or personal sensitive information.

In this scenario, what do you see as your risk? What could an attacker do to you? Send emails with incorrect minutes? Is that really a problem? I'd suggest you don't have a scenario where an attacker could send false content that would cause a problem.

  • How about malware in the form of a Word macro? – djna Dec 31 '15 at 7:12
  • Malware is available on various formats. Word documents, PDF documents etc. – Rory Alsop Dec 31 '15 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.