Outsmarting Spam

Junk E-mail is a frustrating fact of life. For business-technology execs, fighting it is, too
Admittedly, no one's got the perfect solution--technical or legislative--to fight spam, which may be tempering enthusiasm for an all-out war against it. Half of the respondents to the InformationWeek survey say they believe spam has become a permanent part of 21st-century life. Those who don't monitor it cite the ineffectiveness of filtering technology and the speed at which spam techniques change among the reasons for not paying closer attention to spam E-mail volumes. But Michael Osterman, principal analyst at messaging research firm Osterman Research, says anti-spam technology has gotten noticeably better in the past year and that overall satisfaction with anti-spam tools is on the rise. (For more on spam-fighting tools, see the Tech Guide.)

Things have gotten better at MasterCard since the company fine-tuned its CipherTrust Inc. IronMail gateway appliance to protect its 5,500 employees from spam and viruses. Initially, MasterCard had IronMail configured to filter too aggressively, resulting in too many valid messages being incorrectly tagged as spam. But after tinkering with the filtering settings, the company is "reasonably happy" with IronMail, Mattox says. The software identifies spam using a combination of rules-based heuristics (a process of analyzing spam to discern its characteristics and then using that information to determine the likelihood that future messages are spam), known-spammer blacklists, and message scoring.

There's some frustration that efforts to contain the stuff may take away technology resources from other priorities. In large companies, IT departments can spend almost 10% of their time implementing filtering software, according to the InformationWeek Research survey. Mattox has one person from his eight-person messaging staff focus full-time on spam and longs for the way things were a couple of years ago, before spam began competing for budget dollars and distracting his staff from its core objectives. "It would be nice if we could just fix hard-drive crashes and dead network ports," he says. "It was so simple then."

chartBerlin Packaging's Canter would rather devote his time to more important matters. "It's something we didn't ask for," he says of the battle against spam.

Beating back spam is "certainly not in the same class as using IT to increase sales and customer satisfaction at our pizza stores," says Peter Wagner, senior director of information systems at Domino's Pizza LLC. But when E-mail-savvy CEO David Brandon started chiming in on the problem, Domino's attention to spam intensified. If your executive team thinks it's a priority, "then of course it becomes a priority for IT," Wagner says. Domino's has been evaluating anti-spam vendors, and at least one product in testing for five months looks like a keeper: IntelliReach Corp.'s MessageScreen spam-filtering software.

There are ways around getting internal IT staff too caught up in the spam wars. Eighteen months ago, Stephen McCabe, senior VP and co-CIO of Daiwa Securities America, saw that the increase in spam would aggravate the compliance burden at Wall Street firms, which were already dealing with stricter regulations that require them to audit and archive E-mails. So he signed up Daiwa with MessageLabs, an anti-spam service that scans all inbound E-mail for the company at a location outside the network. Of the 7,000 inbound E-mails Daiwa receives each day, MessageLabs tags 43% as spam. That's a huge volume of messages IT no longer needs to audit and archive, McCabe says. Now, "we actually don't think about spam anymore."

But Daiwa is ahead of the game, McCabe says, and he should know. In addition to his role at Daiwa, he's chairman of the Securities Industry Association's data-management committee, a group of IT execs from brokerage firms who meet regularly to share knowledge related to technology issues. Surprisingly, many of the normally security-conscious firms that make up the association's membership have no spam protection, McCabe says. He's trying to attract more members to the data-management committee to spread the word that firms need to address the situation.

There is the potential for glory in the spam fight: IT groups that conquer the problem may win senior executive support for other projects. "Most people don't notice the IT organization until something bad happens," Berlin Packaging's Canter says. But down the road, the company's executive leadership will factor in the success Canter and his team ultimately have in combating spam when it comes time to allocate budget dollars for future IT projects. According to the InformationWeek Research survey, that success may be measured in a number of ways: 86% expect improved productivity; 76% see a reduced demand on mail servers; 71% cite improved security; and 41% expect reduced liability related to potential hostile workplace claims from offensive spam.

And then there's just plain old user happiness, the result of not having to wade through a mountain of in-box spam mails. Says Canter, "The next time we need something, we can say, 'Hey, we've got another idea that will make our users happy.'"

Contine to the online sidebars: How To Get Serious About Fighting Spam and Lost In Cyberspace: Containing Spam