Does Your Email Reputation System Have a Bad Rep?

The recent spike in the volume of spam travelingcharges. There is also a time-lag between when a
across the Internet, combined with the dangers ofspammer starts sending spam from a particular IP
phishing and virus attacks that frequently accompanyaddress and when the address gets added to the
these messages, has forced enterprises to reconsiderblacklist. By the time the services become aware of a
how they determine which messages will be allowedspammers activities, the spammer has already sent
into their network. The latest advances in anti-spammillions of messages.
technology have been enabled in part by the use ofTwo prominent examples of bonded programs are
reputation services which determine the “good”IronPort’s Bonded Sender Program and and
and “bad” senders. There are severalHabeas’ Sender Warranted Email programs.
approaches to determining a sender’sThese programs allow email marketers to secure
reputation; some more effective than others.bonds to certify that their email adheres to guidelines
In order to determine whether senders are “good”on the basis of privacy, mailing practices and issue
or “bad”, organizations must have the ability toresolution. ISPs and other mail servers can then query
accurately identify the sender of an email. SpammersBonded Sender when scanning incoming messages
and their ilk would prefer to hide their identities —and handle them accordingly. However, this
especially for those that are engaged in open fraud“pay-to-play” model is fundamentally flawed, as it
such as phishing attacks. They modify email headers ingives spammers the ability to simply “buy” their
an attempt to fool recipients into thinking the email isway onto the list by securing a bond as a legitimate
coming from a legitimate source. This practice, calledsender, regardless of whether they’re actually
“spoofing”, is a common tactic used bylegitimate or not. While the cost of the bond may be
spammers to obfuscate their true identities.prohibitive to some senders, the benefits far outweigh
To confront this issue, Microsoft, CipherTrust and otherthe costs to most spammers, as the only way the
industry leaders have worked to create standards thatbond will be debited is if Bonded Sender receives
allow organizations to determine whether an email iscomplaints about a specific account sending spam.
coming from a legitimate sender. To date, thereAnd really, when was the last time you or anyone you
continues to be debate as to which technology willknow reported receiving spam? Would you even
prevail. Microsoft’s Caller ID (now dubbed theknow where to report it? In reality, spammers are
Sender ID Framework or SIDF) has emerged as apaying IronPort for the right to clog your inbox.
front-runner along with Meng Weng’s SenderTrustedSource is CipherTrust’s adaptive,
Policy Framework (SPF) .real-time email reputation system that provides
Unfortunately, merely knowing who is sending an emailinformation on email sender behavior. Who sends
doesn’t necessarily stop spam. As it turns out,spam? Who polices their outbound email well?
spammers have been early adopters of the newTrustedSource knows. By constantly observing and
standards, they are better about applying for senderanalyzing email traffic across the Internet, CipherTrust
authentication technologies than normal corporations,identifies the "good guys.” TrustedSource provides
and they are eager to participate!constant updates on sender status to improve
Regardless of how many spammers adoptspam-fighting accuracy and allows IronMail, the secure
“honest” emailing practices, the technology toemail gateway, to achieve the highest level of
identify email senders is quickly being adopted byaccuracy in determining good email from bad.
major ISPs and corporations. Armed with thatTrustedSource servers provide data to IronMail by
knowledge, reputation-based filtering can have acontributing negative values to IronMail’s Spam
significant impact on the level of spam inProfiler (SP) algorithm for messages sent from
everyone’s inbox.senders that are deemed reputable. Every message
There are a number of methods companies use tothat passes through IronMail is checked against the
determine whether a given email sender has aTrustedSource list and based on the reply, IronMail will
“good” reputation. Some of the most commonmake a decision about whether to reduce the overall
tactics are:SP spam score for that message and improve its
By far the most costly method in terms of humanchances of not being classified as spam.
resources, In-house lists require IT staff to maintainWhat constitutes “good behavior”
whitelists and blacklists in order to cut down on theSpammer behavior changes constantly so no definitive
spam problem. The difficulty with these programs isanswer is available. However, the following practices
that they require that the IT staff becomeare considered “best practices” for email senders:
knowledgeable about a host of email security and- Comply with the proper RFC protocols for email.
spam issues, and the investment is rarely sufficient to- Do not attempt to obscure content or messages in
overcome the thousands of variations of nuisancesemails.
and threats posed by spammers, phishers, and other- Do not send email to unverified or nonexistent email
dubious email senders. By the time the administratoraddresses.
becomes aware of a new spam attack, the spam has- Post privacy policies where they can be read and
already gotten onto the network, and into usersunderstood, prior to submission of a request.
inboxes.- Offer opportunities for users to opt-out of programs.
These whitelists and blacklists are built and maintainedAdopting a reputation-based anti-spam system alone
by third party organizations for the benefit ofhas not proven effective to stop spam. However, by
subscribers. These lists are subject to many of thecombining reputation-based systems such as
same problems faced by in-house administrators. InCipherTrust’s TrustedSource with other
addition, some blacklists are maintained by vigilantemethods of spam control technologies such as SIDF,
groups that are quick to penalize an organization forSPF, Bayesian Filters, Blacklists, Whitelists, Anomaly
spam; sometimes without due diligence and withoutDetection, and Spam Signatures, IronMail has achieved
giving that organization time to respond to spamindustry-leading success.