I have a small number of employees who use a company computer but these people aren't very tech-savvy. They use an email client and a messaging client.
I'm pretty sure they wouldn't click on a .exe or .zip file in an email without thinking, and I know that's one area of concern.
However, I'm thinking about images. In fact, regardless of how capable a person is with technology, I believe that attaching things (code or anything else) to an image can be a security risk.
What can be attached to images to harm another?
I believe that images can pose a security risk as they 'automatically execute' or something.
There are so many ways that images can be received by a computer (or a phone or tablet, of course):

email
iMessage (or any other messaging app)
someone right-clicking and saving an image from a web page
just viewing a web page of course downloads the image to cache

What precautions do I need to take regarding the above four things? Can someone just attach some code to an image and it execute?
What do I need to do to prevent images being used against my computers?
I'm guessing you couldn't just attach code to an image and iMessage someone's iPhone. What about Android?

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that.  The user could just execute malicious code directly if that's their goal.

Really you're interested in whether there's a possibility of unexpected, arbitrary code execution when viewing an image.  And yes, there is such a possibility of an attacker constructing a malicious image (or something that claims to be an image) that targets specific image viewing implementations with known flaws.  For example, if an image viewer allocates a buffer and computes the necessary buffer size from a naive width * height * bytes_per_pixel calculation, a malicious image could report dimensions sufficiently large to cause the above calculation to overflow, then causing the viewer to allocate a smaller buffer than expected, then allowing for a buffer overflow attack when data is read into it.

Specific examples:


http://technet.microsoft.com/en-us/security/bulletin/ms05-009
http://technet.microsoft.com/en-us/security/bulletin/ms04-028
http://www.adobe.com/support/security/bulletins/apsb11-22.html
https://www.mozilla.org/security/announce/2012/mfsa2012-92.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205
http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability


In general, these sorts of things are difficult to protect against.  Some things you can do:


Keep your systems and applications updated.
Enable DEP.
Enable ASLR if possible.
Avoid running programs with administrative privileges.
On Windows, Microsoft's EMET could also provide some protection.

