|
|
|
|
|
||
|
|
|
|
|
||
|
|
|
 |
||
|
|
August, 2004 If there are any topics you would like to see discussed in the future or if you have any comments, please contact me at JoeT@HighCaliber.com
Email filtering systems and business policies should be designed around legal, risk-avoidance and infrastructure considerations. Filtering email messages has become a necessity because of the exponential growth of spam as well as regulations and legislation that require businesses to retain all inbound and outbound email and instant messages. Together with the traditional reasons for filtering - malicious payloads attached to or embedded within the message and inappropriate or sensitive message content - filtering technologies and the market are undergoing radical change. This makes purchasing and implementation decisions difficult. Cost-Justify Email Filtering Unlike other technology investments, e-mail filtering investments will rarely require business justification. Senior management will find the money to get rid of spam. Regulated-industry firms will implement technologies and processes to ensure compliance. Enterprises that have paid millions of dollars and have had their credibility challenged because of civil lawsuits (in which an electronic message was the "smoking gun") will implement whatever they must to protect themselves. In the case of email, filtering is generally considered baseline security. The cost of doing nothing is just too high. Choosing email filtering technologies The term "email filtering" can refer to a single-purpose application or to a group of applications. Cleansing or "hygiene" technologies filter for malicious code (commonly viruses), spam, and harmful text or graphical content. Email relay, denial-of-service protection and some level of message encryption, although not filtering technologies, often are bundled with the filtering applications. Where are email filtering technologies and the market headed? A major consolidation of products and services is ongoing, most noticeably in the spam-filtering area, where vendors are attempting to keep one step ahead of sophisticated spammers. Vendors with email filtering products or services are moving away from stand-alone applications toward a framework model, where best-of-breed applications can be purchased and installed modularly. These are controlled through a central console with consolidated, analytic reporting. Evaluating spam-filtering applications With spam making up around 50 percent of all inbound email, you need to know spam-filtering vernacular and techniques to avoid getting caught up in vendor hype when selecting anti-spam products and services. Enterprise-level spam technologies may use a multilayered approach (messages are scanned through each filtering layer sequentially) or a "cocktail" approach (messages are scanned through one layer that comprises multiple filters) by using different spam-detection methodologies for ranking the probability that a message is spam. Some methodologies, such as Bayesian analysis (statistical identification), are maturing. Once spam is identified, a good spam-filtering application will enable different ways to get rid of it. For example, "gray mail" (that is, mail with a questionable probability of being spam) is sent to the recipient, but annotated as possibly being spam. Management capabilities include such services as defining the specificity of control that the administrator and user have over spam, for example, by giving users access to the messages that were quarantined as spam, as well as the ability to view and release the messages. Should internal email be filtered? It depends. Most enterprises will only filter inbound Internet email for malicious code and spam. Filtering for text-based content, such as inflammatory language, is normally done on an "as needed" basis, for example, when an employee is suspected of sending harassing messages to a colleague. Regulated industries may use text-based content filtering for post-send self-audits.
|
|
