Small Business Defense – Anti-spam

There are many anti-spam solutions in the market.  They tend to fall into a handful of types.  However, all of them must do the same thing:  somehow determine which emails are legitimate and which ones are not.  There are many ways to do this, and most of them use differing combinations of the same techniques.  Thus, the main distinguishing characteristic is where the antispam solution fits into the network.

Client Software

A common solution is to use software that plugs into the email clients.  This gives the user direct control over spam handling at the cost of requiring the spam to completely traverse the system and end up on the final computer.  Thus, the risk exists that any malicious software may exploit the client and then run directly on the target.  Additionally, the server must handle the additional load of processing spam and the administrator has no direct control of the anti-spam system.

This solution is generally not a good fit for businesses, though it can be quite effective for home-based users or businesses small enough so as to lack an I.T. department or contracted service.

Server Software

A traditional solution is to purchase anti-spam software for the server.  This gives the email administrator direct control over the way that the anti-spam system operates.  The users typically see an email folder that contains “known safe” spam messages.  Thus, the users are protected against problematic emails but still able to inspect the acceptable ones if they choose to do so.

This is the standard solution for businesses, and works fairly well, though it does result in emails still traversing the system and adding load to the mailserver.  As spam traffic increases, the resources of the server must be scaled up.  Since there is no control of the spam until it reaches the server, the business still risks denial of service by choosing this solution.

Appliances

One way to solve problem of the limitless scaling of server resources is to shift spam protection to an appliance.  In this solution, a dedicated device is placed between the Internet and the mail server which serves only to filter spam.  It is more complicated for the email administrator to manage, but it does keep everything within the control of the business.

Some of the larger businesses use this method.  It still requires email to enter the network, but it does protect the core systems against exploitation and limits the amount of email that the end users must sort through.

Cloud Solutions

Though “cloud” solutions are getting a lot of market buzz these days, some have been around for a long time.  In the anti-spam world, in particular, a cloud solution is often a good one.  With this solution, spam need not ever enter the business network.  The business is protected against malicious software and denial of service attacks.  The users don’t have to deal with spam at all.

However, nothing is perfect.  The main drawback to the cloud solution is that it inevitably delays email delivery.  In short, you are adding an additional layer of processing and network transport, so every single email is going to be slower. While email administrators often state that “email is not instantaneous”, the delays are often noticeable with this sort of solution.

Conclusion

As always, a balance must be struck.  You can emphasize usability — giving control to your users and risking both direct exploitation and the consumption of internal resources.  You can emphasize security — making email administration more difficult and delaying email delivery.  You can pick a solution anywhere along this spectrum, but no solution will ever be perfect.

What you can’t do, however, is nothing.

Small Business Attack – Spam

We’ve been battling spam for many years now.  We all know that the problem exists, and that it can be annoying… but sometimes it seems like the constant complaining of email administrators is even more annoying.  Is spam really such a big problem?

Let’s look at it for a minute…  The influx of email can slow the mail servers.  Manually sorting legitimate email from spam can reduce employee productivity.  In some environments, the adult nature of spam can cause HR issues.

So sure, spam can be annoying, but is it really a serious problem?

Though I try to keep this blog from getting overly technical (after all, there are technical security blogs far better than mine), I am afraid that I have to dig a bit into the labyrinthine mess that is SMTP.  The Simple Mail Transfer Protocol dates back to 1971 and is the method still used to transfer email today.  (Though it has been extended and tweaked many many (many) times.)  These days, it is far from simple but it is still deeply flawed.

At it’s heart are three problems:

First of all, the protocol is plain text.  This means that anyone who can read the network traffic as it flows from the sender to the receiver can read the message.  This allows attackers to read or alter messages as they go by, thereby preventing the receiver from knowing for certain that the messages are private or even reliable.

Secondly, the protocol is honorary.  Just as anyone can drop a letter into a mailbox and put on whatever return address they wish, anyone may send an email and forge any From addresses they want.

There are numerous technical measures that can be put in place to limit these two problems.  However none of them work perfectly and each them make the maintenance of the system increasingly complex.  If too many of them are implemented, you run an increasingly greater risk of email being greatly delayed or simply getting through at all.

Then, we have the final problem.  Though it doesn’t relate directly to SMTP, the fact is that email is not human readable (by most humans, anyway), so recipients have to use email clients. As always occurs, a handful of email clients have become the most popular and are analyzed by attackers for problems. Then, email messages can be forged and sent containing malicious code that will exploit a flaw in the email client.

So what does all this mean?

Basically, in addition to spam being annoying and the extensions we’ve built around it making the actual system work poorly, we have a situation where attackers can target specific people and run their own software directly on the targeted workstation.

So how do we protect against it?