By some estimates, spam costs US companies more than $20 billion a year in lost productivity. In a recent study, Nucleus Research put that figure at $712 per employee per year.
While there is no method to completely eliminate spam from the workspace, very effective measures can be put in place to eliminate at least 99.9% of it In this article I shall discuss some of the common sense methods to avoid spam in the first place, as well as some of the business class spam- fighting strategies.
Steps to avoid spammers in the first place
- Don’t publish your email – This is common sense, but if your email is published on your web site, you are probably already receiving a lot of spam. The proper way to allow the public to contact you via your web site is to have a CGI mailform which allows the user to fill in their contact requests and it allows the server to turn that request into an email and send it to you without exposing your actual email on your web site
- Don’t use your email on sites you don’t trust – For example if there is a site offering a promotion or a free vacation, don’t use your regular business email. If you absolutely have to give out your email to untrusted sites, first create a public email on a free site such as GMail or yahoo and use that email instead.
- Don’t reply to spam – Many spammers will harvest your email by scouring the web and once they find you they will send out some spam. If you happen to respond to it, even if you complain or to ask not to be emailed again, then they know they have a valid email and will continue sending you spam. It is reasonable to assume that spammers have no scruples.
- Use Encrypted Emails Portals – If you are away from the office and are using your business email portal (e.g. Outlook Web Access) or a public email exchange, make sure you are on an encrypted channel. You can tell if you are on an encrypted channel by the small lock symbol at the bottom of your browser. If you don’t see the lock symbol on a page, don’t enter your email on that page. If you business email portal doesn’t have encryption (SSL) put one in place. Bear in mind that anything you type or send over an unencrypted channel (including emails and passwords) travels in plain text and can easily be intercepted and revealed, especially if you use a wireless connection.
- DNSBLs and RBLs – DNSBL (DNS black list) and RBL (Real-time blackhole list) are two extremely effective way of blocking spammers from getting to your email system. DNSBL and RBL refer to online databases of IP addresses of well-known spammers. These list are compiled by a community of dedicated professionals determined to reducing spam from the cyberspace. Examples of RBLs are SpamCop and Spamhaus. Most business class email server such as Microsoft Exchange can be configured to utilize DNSBLs and RBLs. Once configured, when an email comes into your system, the server first checks to see if it came from one of the IP addresses in the blacklist which you configured. If it did, then you server simply drop the communication with the foreign server and discards the email. This way you never even see the spam. Alternatively, the server can be configured to allow the spam through and mark the subject header with a something like “***SPAM***”. This makes it easy for the user to sort the good emails from suspected spam. Since many spammers use “zombie” computers propagate their emails, some RBL’s optionally include dynamic IP as these are most likely assigned to home users and not likely to be sources of legitimate emails. DNSBL and RBLs to your email server will eliminate more than 99%+ of spam and it costs little or nothing, so it should be your first step in corporate spam fighting strategy.
- Heuristic Algorithms – Spam fighting software such as SurfControl and SpamKiller use heuristic algorithms to assign a spam score to an incoming email. Based what threshold you set, the email will get routed to your Inbox, Suspected Emails or Junk Mail. This approach, while effective, cannot be configured by the user because the formulas used to determine the spam scores are typically considered trade secrets and the user can only configure what the threshold should be, so if this is the only method being used, there can be a lot of false positives, i.e. email that is legitimate, but is being blocked.
- White Lists & Black Lists – A feature available in many systems is the concepts of white listing 9always allowing) and black listing (never allowing) a particular sender or domain. While the idea made sense in the old days of the internet, this concept no longer has merit in today’s web space since spammers almost never use the same email twice to send out spam. The one exception is this: Whitelists are useful in cases where legitimate senders keep getting blocked by your spam filter. This tells your software to that you trust this sender and to always allow mail coming from them to get through.
- Anti-Spam Hardware Appliance – Vendors such as Cisco and SonicWall make very effective products that are typically built into a firewall or a router and perform content filtering at the border or gateway into your network which is typically your firewall. This approach works really well because it eliminates the guesswork by filtering out spam (and usually viruses and malware) before it enters your network, specifically your servers.
- 3rd-party Spam Filtering – Whether you house your own email server in house or have a service provider host you email for you, one effective strategy is to have a 3rd party such as McAfee receive your emails first, scrub them from spam and viruses and then send them to you. This is a cost effective method and works really well in small environments (10 – 20 employees)
- Desktop Spam Filtering – The lowest cost method of fighting spam (and viruses) is to have a desktop spam filter such as the Kaspersky Internet Security which monitors and flags or deleted content deemed to be spam or inappropriate for business. This approach work for small companies that don’t have their own email sever and rely on a host provider. The shortcoming of this approach are these: a) the spam has to received and downloaded to your desktop and your email client, e.g. Outlook, before the software can recognize it as spam. This takes up bandwidth and it slows down the user’s PC, and b) the software determines what should be considered spam and what shouldn’t. Typically, there is no user configurable option or set of parameters to control what and how the the software determines what is spam and what isn’t.
- Other Methods – Some smaller organizations use GMail Small Business Email System to send and receive all the business emails. GMail uses Postini which is a very effective spam filter and it costs little or nothing depending on the level of service and number of email accounts you have. This method works by changing your MX record of your domain and pointing it to GMail instead of your domain. Gmail then received any email sent you “yourdomain.com” and does the scrubbing for you. Your server or workstations then retrieve the cleaned up mail and the reverse happens when users send out emails. This approach works well for smaller organizations and is costs effective