General

Spam Busting with Brightmail

If you're not keen on routing all your e-mail through a third-party server or tapping into blacklisted IP addresses, what spam-killing options remain?

by Patricia Fusco Editor of ISP-Planet [April 30, 2002]

Spam: modern the curse of Internet users everywhere. Unsolicited e-mail is a bane to Internet services provides resources and a woeful threat to business networks. Unwanted e-mail is the target of mind-boggling laws and unenforceable regulations worldwide. No longer just a mere nuisance eliminated by a swift kick from a delete key, spam can take down servers, drain bandwidth, reduce productivity and incite superfluous lawsuits.

We all know spam is annoying, but how much spam is really out there relaying through severs connected to the Internet? Quantifying the volume of spam would be a gargantuan undertaking. So leave it to a bright, San Francisco-based e-mail security firm to try and get a handle on the volume of spam—leave it to Brightmail.

The company started tracking "spam attacks" nearly two years ago. Brightmail might not count the unsolicited e-mail that's delivered to you're and my inboxes everyday, but it does keep track of mass distribution of single e-mail messages to multiple e-mail addresses. For reporting purposes, these incidents are referred to as spam attacks.

BLOC building
In order to track spam attacks, Brightmail built and staffed a special center for e-mail experts tasked with monitoring suspicious e-mails. This center is called the "BLOC," short for the Brightmail Logistics and Operations Center. Brightmail e-mail experts know when a new spam attack is launched because they sort through hundreds of thousands of "probe" email addresses strategically placed at domains across the Net. These e-mail experts quickly analyze the spam and write rules that will block the e-mail message before the attack can reach most e-mail users.

With all these e-mails passing through the BLOC, Brightmail is able to compile vast amounts of data that illustrate spam trends. For example, Brightmail knows there were 312,969 spam attacks in August 2000 (left).

Messages caught by the decoy accounts of Brightmail's Probe Network are analyzed at the BLOC. The BLOC functions as a spam-attack center, staffed by spam experts working around-the-clock to create filtering rules to counter new attacks. The new rules are immediately sent directly to Brightmail's clients on a push system that allows ISPs to filter out spam for users while allowing normal delivery of legitimate e-mails.

The company also knows that there have been more than 26 million e-mail spam attacks since they started keeping track of unsolicited e-mail bounding about the Net. If you think that you're seeing more spam in your e-mail in-box than ever before—you're right—at least according to Brightmail's analysis. The company reports that there were 3,773,378 spam attacks last month. This means we're seeing 10 times more spam in March 2002 than we did in August 2000. Potentially fraudulent financial spam tops the chart of identified e-mail topics (above).

Although the data is not included here, it's interesting to note that spam attacks in the Adult category have almost doubled in the past year: up 3.8 percent since March 2001. Even though federal agencies have pronounced their commitment to cracking down on spam—particularly pornographic material sent to children and fraudulent spam sent to unsuspecting adults—few regulations have been crafted to actually thwart spam. This is in part due to the fact that law courts are mostly unable to define the words "pornographic" and "obscene" except by referring to local preferences, which makes a national law impossible.

Spam-Be-Dammed
Where legislation and regulations have failed, technology typically triumphs, which is where Brightmail's spam-stopping solutions come into play for ViaWest, a regional ISP serving the Rocky Mountain Western region in Colorado, Arizona, Utah, and Nevada. From four regional offices, ViaWest offers broadband access and server hosting as well as colocation and managed services for small- to medium-sized businesses.

Hell-bent on winning the war against spam, ViaWest set out to eliminate unsolicited e-mail landing in its customers' in boxes—or at least dramatically decrease the volume of spam slithering through its servers.

On a typical day, ViaWest processes approximately 150,000 e-mails for its customers. The ISP estimated that about 45,000, or 30 percent of these messages, were spam. As the number of spam messages increased, so did customer requests to do something about it.

Knowing that spam is one of the top five reasons why customers switch ISPs, ViaWest reckoned that spam filtering was the only way it could enhance customer satisfaction while increasing customer retention and decreasing the amount of time and money the company spent dealing with spam-related issues.

The ISP investigated two options: implement another company's technology or go it alone with a homegrown anti-spam solution. The first ready-made anti-spam solution that ViaWest evaluated offered a service that would route all of its e-mail through the vendor's servers to filter for spam. But this type of routing would prevent ViaWest from segregating its customer base into different groups, making it impossible for the company to offer customers opt-in or opt-out e-mail choices.

The ISP next evaluated the option of building an anti-spam solution in-house. At first, this option looked very appealing. However, the idea soon lost much of its allure as ViaWest determined that building and internal solution from scratch was going to cost the company a great deal of time and money.

Brian Dimoff, ViaWest senior vice-president, estimates the company saved $10,000 to $30,000 on capital equipment purchases alone by opting not to develop a homebrewed anti-spam solution. In the end, ViaWest turned to Brightmail because it gave the ISP's administrators control over messages flowing through its networks. Brightmail's Spamwall suite is built on architecture that can be readily customized to any environment.

"Choosing Brightmail was the easiest, most cost-effective way to offer our customers the relief they were seeking," Dimoff said.

ViaWest decided to market Brightmail's spam solution to its customers as a value-added service dubbed "Spam-Be-Dammed." Dimoff said the solution proved so popular among the company's dial-up users that many customers on legacy platforms (the last to be migrated to the Brightmail solution) requested that Spam-Be-Damned be made available for them as soon as possible.

"Thanks to Spam-Be-Dammed, ViaWest customers can now enjoy a faster, less offensive and more productive email experience," Dimoff said. "With Brightmail's component-based technology, implementation has been a snap. We can launch Spam-Be-Dammed by domain as we integrate our different platforms."

And ViaWest's customers covered by Spam-Be-Dammed are pretty happy, too.

—End