Search /
Docfinder:
Advanced search  |  Help  |  Site map
RESEARCH CENTERS
SITE RESOURCES
Click for Layer 8! No, really, click NOW!
Networking for Small Business
TODAY'S NEWS
Valentine's Day Patch Tuesday: Microsoft to issue 9 patches, 4 critical
Mobile World Congress sneak peek: Quad-core smartphones, Ice Cream Sandwich & more
Microsoft details 'Windows on ARM' program
March debut of 'iPad 3' a sure bet, says analyst
FBI unbolts Steve Jobs 1991 investigation file
Cisco boosted profit, sales in Q2 while cutting costs
Macs take on the enterprise
Four crazy tech ideas from Google's Solve for X project
Obama 2012 campaign playlist revealed courtesy of Spotify
Oracle buying Taleo for US$1.9 billion in direct hit at SAP
Amazon attacks Apple: You get 3 Kindle products for price of iPad 2
Pre-rendered pages highlight latest Google Chrome release
Microsoft exec: Lync-Skype integration a 'compelling opportunity'
The future of hypervisors
/

Spam filters revealing their darker side

Today's breaking news
Send to a friendFeedback

Stepped-up efforts to eradicate spam are creating collateral damage as network executives and others find that aggressive filters can block receipt of legitimate mail and create uncertainty over successful delivery.

Antispam filters are a work in progress, and network professionals must carefully fine-tune the software to ensure they don't cripple confidence in the reliability of e-mail, which has become an indispensable business tool.

Filters are causing head-aches for e-mail senders, especially those who ship large volumes of legitimate mail such as news-letter publishers, who are seeing spikes in the number of messages that are filtered out by corporate systems.

Network executives and vendors admit that keyword searching just won't cut it, and that a combination of filtering techniques and more sophisticated filtering methods such as those that examine context must be used.

"There were good intentions with the design of content and spam filtering," says Dave Bailey, e-commerce and messaging architect for Imerys, a global mineral processing company in Atlanta. Bailey says the percentage of spam as part of his total e-mail volume has hit 30%.

He says spam filtering is an absolute necessity, but the Symantec filtering software he uses has taken some getting used to.

"We have found that these systems take some care and feeding, and that periodically you must check your log files to see what you are trapping," Bailey says. "We try to communicate to our business users that we are going to tune our spam filter, that they may lose some legitimate e-mail, and that we have procedures in place to handle that."

The company began filtering image files, in which spammers can display their text messages and avoid filters, but Bailey says company engineers who needed to exchange images began complaining about mail being blocked and the system had to be adjusted. He says the company now quarantines blocked mail so users can inspect it if they wish.

Gail Coury, chief information security officer for software developer J.D. Edwards, says she ran her filtering software in monitoring mode for a month to gauge its effectiveness before it went live.

"We learned that we needed to relax," Coury says. "We had to relax the keyword search; that was one issue."

The company filtered out a crude three-letter word often found in pornographic spam only to discover that it was also an acronym used commonly by their developers. Coury says she logged 96 calls in the first 30 days of filtering from users who wanted to know why their mail was blocked. She says 40% of that mail was legitimate business mail.

"As long as spam is sent, we have to put some sort of controls in place, but it does create an uncertainty in message delivery," says Coury, who adds that users are pleased overall with the filtering because it eliminates the most offensive spam.

Uncertainty seems to be a consequence of filtering and is being felt by more users.

A recent survey by Osterman Research showed that only 25% of users were "very satisfied" with their spam filter's ability not to generate false positives. Another 35% said they were somewhat satisfied. Twenty-four percent were neutral on the issue, and 16% expressed a degree of dissatisfaction.

"The whole issue of blocking spam is a very difficult one right now," says Michael Osterman, president of Osterman Research. "This is still a real tricky area, and people are just getting their feet wet with filtering. It's experimenting with the tools to find the right balance for false positives."

He says what will drive administrators to take a more conservative approach is when the CEO sends a message that no one receives. "The bottom line is that people would rather get spam than not get e-mail."

Osterman says if companies can block somewhere in the neighborhood of 85% of the spam they get, they can be fairly certain that their false positives will be very low.

But he says the filtering issue is raising questions over trust in e-mail delivery, because spammers have taken such advantage of the infrastructure.

Filtering out newsletters

No one knows that better than those that publish newsletters or send out large volumes of e-mail that users choose to receive.

"I hope these filters are a stopgap measure and better solutions are on the way, because if they are as arbitrary as they are today [then] they will cause more problems than they solve," says Geoff Duncan, publisher of TidBITS, an opt-in e-mail newsletter for Macintosh enthusiasts.

Duncan says he has seen as much as 20% of his e-mail distribution of 45,000 newsletters get blocked. The offending words or phrases that have triggered filters included "Viagra" and "my pictures." He tried self-censoring but has since stopped because he said it was a losing battle.

"Private companies block e-mail, but for senders it can be a real problem," Duncan says.

"You never really know what filters are doing or not doing," says Brian Youngerman, who publishes an opt-in sports newsletter called Sports Bar Interactive.

"I hate spam as much as anyone but if you can't guarantee the delivery of e-mail or get the e-mail you are expecting, that's not the Internet. That's like Prodigy was years ago, a closed system."

Youngerman says this is the first time that users have to face the fact that their legitimate e-mail may not be delivered.

Vendors of spam filters are working to ensure that Younger-man's statement isn't fact for long.

Companies such as Brightmail, Postini, Cloudmark and Message-Labs tout the accuracy of their products and have devised various methods, such as dummy ac-counts to create lists of spam or tapping end users to create lists of known spam, to combat the inaccuracies cropping up with keyword and content filtering.

"Accuracy is critical for us," says Enrique Salem, CEO of Bright-mail, which provides server-side spam filters. "But if the recipient has a bad spam filter you never know what is going to be stopped."

Salem says Brightmail, which some estimate has nearly 50% of the antispam market, blocked 845 million spam messages in July and that the percentage of spam as a total of all e-mail sent has risen from 8% in September 2001to 35% in July.

"Content filtering is not the answer. It has to be used in conjunction with other tools," says Pavni Diwanji, co-founder of Mail Frontier, which released its first product last month - client-side software for Microsoft Outlook. That product will be followed this month by server-side software that can work in tandem with it to provide various levels of filters and techniques to trap spam.

"E-mail is an open system and instant messaging is a closed system where you establish who you want to talk to - the future of e-mail is somewhere in be-tween," Diwanji says. "Spam could ruin e-mail. You may just want to turn it off to the outside world."

Fighting spam
Network executives should follow a few general deployment guidelines to reduce the amount of legitimate e-mail that spam filters might block.
Run the software in a monitoring mode first to help you gauge what is being blocked before going live with end users.
Start off with a conservative attitude toward blocking, which will let a lot of spam escape the filter but nearly eliminate false positives, and work your way up to an acceptable balance.
Use a combination of filtering techniques such as keywords, domain and IP blocking, blacklists, whitelists or collection accounts. Look for software with more sophisticated filtering methods such as heuristics.
Quarantine blocked mail and give users the option to see their mail that has been filtered before it is deleted.

RELATED LINKS


NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
Click here to sign up!
New Event - WANs: Optimizing Your Network Now.
Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
Attend FREE
Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.