Spam Technologies
by Susan E. Bradley, CPA, CITP, MCP, GSEC
Once upon a time there was a processed meat product with a gelatinous coating packaged in a can and opened with a metal key. For many, many years, this was the only defined meaning for the word “Spam” … then came the Internet. Little did the early pioneers of the World Wide Web know that the invention of a communication means of “e-mail” would lead to our current state of junk-mail confusion.
According to various surveys, more than 60 percent of e-mail sent across the communications network is made up of Viagra-type medications, physical enhancement products, visual enticements for everything from making instant money to offers to get rid of the very offers that they you are currently receiving, among other offers! Unsolicited commercial e-mail is even being blamed for increasing the use of alternative communication technologies, such as Instant Messaging, RSS (Really Simple Syndication) feeds and Web logs (Blogs).
In 2003, companies scrambled to introduce systems and processes into firms to stop and filter Spam. This past year also saw a new phenomenon: the Spammers. These are individuals and companies that send out a great deal of this unsolicited e-mail, and during the past year, collaborated with virus and security researchers to gain access to relay mail on mail servers that historically would have been labeled “impenetrable.” This turned corporate mail servers into the very source of Spam that corporations are trying to stop by using a technique called SMTP auth attacks.
2003 began with e-mail as a much needed way to communicate. Unlike telephone, communicating with e-mail within our borders and internationally is easy, effortless and relatively inexpensive compared to the telephone. Unfortunately, this same “ease” blossomed into a cottage industry.
Today, three major technologies have come to the forefront to combat Spam: word filter, blacklist and whitelist.
In word filter technology , programs look at the words included in the e-mail body to determine whether the e-mail is valid (as it applies to a particular business or professional endeavor, for example). If enough “trigger words” are found, the e-mail will be filtered out and not sent to the mailbox. The issue with technologies based on word filtering is that they may produce “false positives” or incorrect identification of e-mail as being Spam, when it is not , in fact, Spam.
The second technology, blacklist , uses public databases of known sites that have been shown to be Spammers in the past. There is a recent phenomenon where a few of the maintainers of these lists were forced out of business by the Spammers, obviously demonstrating how lucrative Spam e-m ail can be because the stakes are so high. Make no mistake; this is a “war” of sorts that we are waging to attempt to stay one step ahead of the e-mail that clogs our inboxes on a daily basis.
The last technology is called “whitelist,” a method in which you only allow the people you want to have access to your inbox the ability to send you e-mail. All other e-mails are “challenged;” they receive a request from the whitelist “engine” to provide a reason why they should be able to obtain access to your e-mail box. Because Spammers do not take the time to respond to these requests, you do not receive these requests. You then receive an e-mail indicating that you have received a request from a sender to gain access to your inbox. At that moment, you grant or deny access accordingly.
When setting up whitelist technologies, ensure that you inform your clients and customers before implementing this solution. In a client engagement, for example, it can be a bit of a concern for a client to get an e-mail requesting additional information from the very person you hired. In an organizational setting, while anti-Spam technologies that use whitelist features are the most effective, ensure yo u plan for its implementation with your marketing and public relations department before implementing these features, and that all other key players are informed of the implementation.
Having an e-mail client limiting the number of “calls” back to a Web site also ensures that Spammers have less means to find “good e-mail addresses.” In the recent release of Outlook 2003, external .html documents and other images are automatically blocked to ensure that such “beacons” cannot “phone home.”
In your own organization and depending on your needs, you may need to implement a combination of all three technologies. Certain individuals may need to have a whitelist technology blocking all e-mails except those for which they ask. Others in your organization may need less restrictive anti-Spam technology.
Bottom line: businesses, large and small, must implement the required technologies to limit the amount of unwanted, unrequested e-mails entering your business. This filtering must be automated and minimize the amount of time spent filtering and organizing your inbox. Your time is too valuable to spend it deleting the volume of junk mails the average inbox receives.
For More Information
With Spam on the thoughts and minds of nearly every e-mail user, information on the Internet is constantly updated, and a quick search using “Spam” on Google ( www.google.com ) generates many sites for more information. Here are just a few for consideration.
• Fight Spam on the Internet: a clearinghouse of information related to dealing with Spam — http://spam.abuse.net .
• Spam Legislation: text of the most current anti-Spam legislation, including CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003) — http://www.spam laws.com/federal/108s877.html .
• Survey of Spam Statistics — www.spamfilterreview.com/spam-statistics.html .
• SMTP auth attacks — www. vamsoft.com/orf/authattack. asp .
• Sample Anti-Spam vendors — http://smokey.rhs.com/web/blog.
The AICPA's Top Technologies 2004 initiative was sponsored by the AICPA's Information Technology (IT) Membership Section and led by Certified Information Technology Professionals (CPA/CITPs). For more information on the AICPA's Technology Initiatives, including the Top Technologies, the CITP credential and the IT Membership Section, please visit www.aicpa.org/infotech.
Susan E. Bradley, CPA, CITP, MCP, GSEC, is a principal with Tamiyasu, Smith, Horn and Braun in Fresno , Calif. She writes an ongoing column, Ebitz, for AICPA's InfoTech Update newsletter, and is chair of the Top Technologies Task Force. Contact her at sbradcpa@pacbell.com.
