I first started hearing about reputation-based technologies used in conjunction with filtering messages a couple of years ago. What a great idea! It does make sense to analyze the characteristics of a message to help determine whether or not it is legitimate, spam, contains malware, or is likely to be some other type of message you do not want getting onto your corporate network, doesn’t it? Trying to determine the “reputation” of the message seems to be a good additional check. Banks and credit card companies have been doing similar types of activities for decades, looking at the reputation of their loan and card applicants, when generating credit scores. It seems as though this type of analysis, while not fool-proof, could also have the potential to greatly assist with keeping unwanted messages from clogging the enterprise networks and mailservers.
Email security threats and related annoyances have been plaguing organizations since email left the mainframe and dumb-terminal-only view and started residing on distributed mail servers, communicating with anyone who wants to send messages from outside the enterprise network. One of the first types of malicious and annoying email messages that started to occur was spamming. It was soon followed by fraud schemes, then phishing. Security has been trying to keep up with all the new and clever ways to get around the protections that organizations implement to try and keep spam and related types of malicious messages from entering the enterprise network.
Some messaging filtering methods work better than others. Some worked fantastically well when first introduced, but then the evolution of spamming methods soon outdated the once wonderful spam fighter. When new message-filtering solutions are rolled out, the spammers adjust their spam delivery methods to defeat the filters. Reputation-based messaging has the potential to stay one step ahead of those devious spammers, phishers, malware spreaders, and generally obnoxious Internet villians.
I’ve discussed the topic with some of my information assurance colleagues, and we’ve had some fascinating conversations. I wrote a white paper, “What Businesses Need to Know About Reputation-Based Messaging Technology” that describes what reputation-based messaging technologies seek to do, along with outlining some of the techniques used within these technologies and listing some of the features to look for within a reputation-based filtering solution. If you are considering getting a reputation-based system, prepare yourself to know the questions to ask the vendors so that you do not have to depend solely upon their marketing literature to make a decision.
Check it out, and please let me know what you think! Did you find it useful? Are there other issues you think should be added to my list of things to look for? I’m also interested in hearing about your own experiences with reputation-based solutions; which ones have worked well, and which ones do you advise information security practitioners to steer clear of?
Tags: awareness and training, image spam, Information Security, IT compliance, messaging technology, policies and procedures, privacy, reputation, risk management, spam