January 2007 / January 2007 - The Global Increase in SPAM

The first documented case of email spam was from an over-aggressive marketer advertising his company's new computer system to 600 ARPANET (the predecessor of the Internet) users in 1978. Not surprisingly, the response was less than positive. Fast forward almost 30 years and what started as 600 emails has now turned into over 12 billion instances of spam per day . In this month's Tech Brief we'll take a look at the global increase in spam and what you can do to protect your business.

Statistics

According to Postini, a leader in enterprise-level spam filtering:

• 83% of email, 10 out of every 12 messages, is spam.

• 1 in 366 messages is infected by a virus.

• Spam activity has increased by over 50% from month to month over the last half of 2006.

• Spam increases can cause email systems to experience unexpected overloads in bandwidth and server storage capacity – leading to a possible loss of valid messages.

• An average of 30% of an email server's capacity is hijacked by spammers trying to steal proprietary email addresses and other information stored in the corporate directory. This is called a Directory Harvest Attack.

How is Spam Sent?

Understanding how spammers operate will give you greater insight into choosing the right technologies to prevent their messages from reaching your email server. The following are the most common methods used to send spam.

Webmail services – A common practice employed by spammers is to bulk mail through free webmail services such as Hotmail. Since they send out such large quantities of email, spammers require multiple webmail addresses and have taken to using automated programs to create new accounts. To help prevent this, webmail services have started using a validation method called CAPTCHA, which prompts you to type the letters you see in a distorted image. Computers are unable to accurately read the image, so spammers are unable to automate account creation. Spammers have also taken to using fake webmail email addresses

Relaying through a third party – Another common approach is to route spam through an innocent third party's email server. Once an open email server is found, a spammer will use software that sends messages to the open server asking it to relay that email to its destination. Since open servers accept email from any source, the spam is simply forwarded. Along with opene mail servers, spammers also used open proxies to relay their messages through.

Zombie programs – A zombie is a program which infiltrates computer systems and sends spam through SMTP engines that are built into the programs themselves. Zombies are typically placed on or downloaded to hundreds or thousands of systems – resulting in spam that defeats blacklists by originating from a large number or sources. Zombies are commonly downloaded by unsuspecting users when they visit a website or run an email attachment.

How Can You Control Spam?

Thankfully there are steps that you as a business owner/manager can take to prevent non-business Internet usage from negatively affecting your company.

Invest in software or hardware that monitors web browsing activity : There are programs and devices available that allows you to monitor and review employees' browsing and set up filters to block specific content such as gambling or adult websites. Many devices also allow you to prioritize Internet traffic to limit non-business surfing and prevent critical applications or systems, such as VoIP, from losing bandwidth.

Track and archive corporate email : Most modern email systems have basic message tracking features that you should always have enabled. Also, make sure you have an archive solution in place that allows you to retrieve email in case you ever need to review old messages.

Block or monitor instant messaging traffic : If IM is not business critical, invest in a tool to block it from your system. For businesses where it is critical, you should standardize on one IM platform (be it AOL IM, Yahoo IM, or enterprise-wide private IM software). You should also invest in IM tracking solutions so that activity can be reviewed in the same way Internet traffic and email should be.

Implement and enforce company-wide policies on web browsing, email usage, and instant messaging : The American Management Institute found that 79% of employers implement a written email policy and only 20% of employers implement an IM policy. You should always have a set of guidelines in places governing Internet usage and make sure all employees are familiar with them.

Understanding the risk that non-business Internet usage poses to your company is What essential for all owners and managers. If you implement and enforce a strategy of reducing unacceptable employee activity, you will minimize lost productivity and your risk of legal liability.