AASP Adds Filtering and Archiving

The ISP cooperative focuses its buying power on helping ISPs solve some basic security issues.

by Alex Goldman ISP-Planet Managing Editor [January 19, 2007]

"You know how much I've hated spam over the years," says Russ Ferguson, president and CEO of the American Alliance of Service Providers (AASP). "We've finally keyed on a solution that will solve that for us."

The goal was to do what the most popular solution for ISPs (Postini) does, without taking so much control away from the ISP.

"I've been working in the anti-spam and anti-virus universe for years," says David Agee, part of AASP's member services team. "I was originally with Central Command (Unix- and Linux-based for the most part) and worked with large ISPs. They were going with Postini even though it offered them no control, no scripting. Even scanning outbound mail required another fee. So I started taking a look at the industry and found that with Vircom (which we at AASP use on our network), I could build a business model against Postini and tie and beat it on all features (except for a few that might be on an admin's wish list but which are not core features)."

Filtering solution
The solution combines a high end version of Vircom Modus for filtering with Computer Associates' Message Manager for message storage. Before offering it to ISPs, AASP ran it in house (running a service in house before offering it to your customers is a best practice that ISP-Planet recommends to all service providers).

"Before the solution went into operation on our servers, I was getting [blocked false positives] and sometimes had to ask people to resend their e-mails to an alternate address," says Ferguson. "I was getting 50 to 60 spam messages per day, mostly image spam. We started using the new solution around December 1, 2006, and I got only one or two spam messages during the first month. I also had to retrieve one e-mail from quarantine. The new solution has every feature you'd want: blacklisting, white listing, quarantine. I'm real pleased with the product."

Agee says Vircom has a real advantage in filtering out image spam. "Vircom's image spam engine is in its third generation," he says. "It takes a millisecond list. Its competitors are still working on the first generation."

The false positive rate is great too. "We're at 0.01 percent false positives." That's one in 10,000. Many vendors claim up to one per million, but ISPs find that actual performance is often worse than that, and that false positives come in clumps.

Agee believes that Vircom's advantage is its anti-spam technology team. "Vircom relies on people, internal technicians and engineers, on hands rather than rules," he says. "It's not just great at catching spam but also at preventing false positives. Grey is the hardest part of this gig. It's more apt to allow something grey to get through than the other products, but still at a rate that's acceptable, even to a corporate entity."

We've noted over the years that although spam is a problem for ISPs, false positives are a bigger problem. Customers expect to receive e-mail, and some spam, but become very, very angry when a legitimate e-mail is blocked. We suspect this is why many chose Brightmail, which for years had the lowest false positive rate, but also allowed the most spam to get through.

A key, final detail: both the filtering solution and the archiving solution are backed up into more than one data center.

Archiving solution
Although the hardware varies depending on the data center, Agee's ready to say what he's using in Georgia: Centera servers (see also: IBM, EMC Battle Over The Midrange).

Archiving is from everyone from residential customers with photo albums to corporations with sensitive e-mails from strategic planning and HR.

Agee says that only a few companies (such as large financial firms) are prepared for recent changes to FRCP that require companies to be able to provide e-mails and to ensure that the archived e-mails have not been tampered with (see, for example: Landmark Federal Discovery Rules Amendments Have Become Effective. Are You Ready?).

He therefore expects archiving to become a more significant component of the services ISPs and integrators offer to business customers. He recommends that any ISP that does not yet offer integrator services partner with a local integrator (ISP-Planet recommends the same).

The AASP future
Ferguson says the association is doing well, shrinking at a slower rate than the ISP industry. The filtering and archiving offering is part of one of AASP's goals, he says, wich is to find products other than connectivity that members can offer their customers.

The other goal is to offer ubiquitous broadband service so that members are no longer dependent on the telco, but have other options, such as wireless or BPL. On that, stay tuned. We expect to hear more about connectivity from AASP later this year.

— End