|
The Challenge of Spam for ISPs
The challenge to solve the problems of spam e-mail is reaching the desks of ISP CTOs across North America and Europe. A combination of factors has elevated the urgency for better management of spam, including:
- Pressure from end-users and the ensuing tax on help-desk staff in dealing with spam-related complaints. - The need to protect networks and end users from malicious threats carried via e-mail.
- The increasing collusion of commercial spam with fraud schemes, phishing attempts and malicious viruses. - A desire for tools that help ISPs protect customers from unwanted email.
However, ISPs present one of the most complex environments for managing spam due to the volume of e-mail, wide variety of users and high level of service demanded by customers. This white paper reviews the most common approaches to spam management for ISPs and details how a suitable solution, such as Roaring Penguin Software's CanIt-PRO, must address particular challenges for ISP administrators.
The paper concludes with comprehensive best practices for spam management for ISPs. It includes guidelines for evaluation, roll out and deployment of an anti-spam solution. Roaring Penguin has developed these best practices through extensive work with ISPs in resolving their spam challenges.
Common ISP Solutions to Spam
ISPs generally consider three types of anti-spam solutions:
- Outsourced filtering services relay your mail through a third party system housed off site. These systems can sometimes be too costly for the typical ISP budget. These can also present concerns about a loss of control or security over ISP e-mail.
- Home grown solutions are typically based on open-source software such as SpamAssassin and Roaring Penguin's MIMEDefang. In most cases, these solutions were sufficient until about 2002, when the volume of spam and spammer's ever-evolving techniques began to render homegrown solutions unmanageable.
- Third-party in-house solutions offer a balance point between the above two options. While benefiting from the experience of a third party provider you keep the flow of your email traffic on your own network.
A solution that deals with spam at the mail server is preferable for ISPs. Such a solution is centrally manageable and deals with the problem before spam and viruses reach end-users or consume network resources.
Getting Anti-Spam Right at an ISP
The main challenge for an ISP looking for an anti-spam solution is to find a product for the server that also provides the flexibility most ISPs need to suit their wide variety of users and those users' preferences. For example, ISPs would be unable to globally define that messages that look like newsletters or product information are spam, as some users may have legitimately requested to receive this information. In addition some ISPs do not want to be thought of as censoring the content that their users are accessing, unless explicitly asked to do so.
Other key requirements for an effective ISP anti-spam solution typically include:
- Ability for administrators to set global policies, in particular as regards the filtering of viruses and certain types or sizes of mail attachments.
- Ability to let end-users make the final decision about what is or is not spam ? or even to opt out of spam filtering all together.
- Integration with existing user authentication engines and web-mail interfaces, so that users need only one password for all mail services.
- Integration with existing or preferred anti-virus solutions.
- Extensibility, including the ability to cost-effectively expand the system, to filter outgoing mail, to easily add more users, and to write customized rules and filters if required.
- Minimizing the performance overhead that content filtering can put on systems.
- Ability to roll-out the solution in manageable increments, reducing strain on help desk staff.
- Ability to meet privacy concerns of end users.
- Cost-effective pricing, or pricing structures suited to the ISP environment and budget.
Anti-Spam Best Practices for ISPs
Based on Roaring Penguin Software's work with numerous ISPs, we have assembled best-practices for ISPs looking to evaluate, plan for and deploy an anti-spam solution. Itemized below, these best practices are useful during all phases of an ISP anti-spam project. They will assist in requirements development, evaluation and deployment.
|
