Giles Sirett, CEO of Octavia Information Systems outlines some simple ways of avoiding high volumes of spam.
Everybody knows that email spam has become a major problem to both individuals and businesses alike. It has been estimated that up to 90% of ALL internet traffic comes from spam. The exponential rise in the use of illicit direct email marketing has been driven by the simple fact that (however much we all hate it) spam remains an effective, low cost, form of advertising for many businesses, particularly those advertising the “underworld” of online services such as porn, gambling and medication.
The following is a list of simple rules to follow if you wish to avoid vast amounts of spam:
1. Remember that a spam filter is a painkiller NOT a cure
The use of a properly configured spam filter is one of the most effective ways of reducing the amount of spam you receive but it will only ever reduce the amount of spam you receive and not completely eradicate it. The reason for this is simple: there is a constant “dual” between the spammers and the anti-spam software manufacturers. The spammers are coming up with more and more ingenious ways of making their spam look like genuine emails. A good spam filter (such as PureMessage from Sophos) will typically remove c. 95% of spam – that’s pretty good. However, if your account is attracting 200 spam messages a day, that’s still 10 spam messages that you’ll have to deal with.
2. Avoiding the robots
The spammers generate lists of email addresses from a number of sources, but the most commonly used technique is to use “robots” to search websites and other sources for email addresses. You should therefore NEVER publish your email address directly on your company website. Either use a Contact form on your website or show the email address as an image instead of text – robots can’t read images but humans can! Also avoid entering your email address in blogs or bulletin boards.
Another source commonly used by the robots is the domain registration databases. If you have to register an internet domain name, consider using an alternative account when completing the contact information.
3. Check that privacy statement
There is a sub-set of spam that I call “soft spam”. This type of spam is generally legal (under UK legislation) and originates from companies or groups that you have done business with and given your permission for them to send you messages.
Under UK law, companies must have a privacy statement when you enter personal details. Check this carefully – if they don’t give you the ability to opt out of their (or “related companies”) direct marketing, buy your product elsewhere. You must also ask yourself if you trust the website to honour their privacy statement.
4. Don’t reply to spam, download images or click links
A lot of spam is sent speculatively: the spammers just send messages out to thousands of different, random names at a company. They don’t know whether those addresses exist, they’re just trying their luck.
If you reply to a spam message, choose to download images (in HTML messages) or click any links in the message it is quite likely that you’ve just let the spammer know that your account really does exist. I guarantee you’ll then get much higher volumes of spam.
If you get a spam email – delete it!
5. Making others follow these rules.
If you are responsible for the IT policy of your organisation, it is essential that your IT Usage Policy states that your users should follow the advice outlined above.
6. And when it all gets too much
At Octavia, we often work with companies where the volume of spam on certain accounts has become unbearable. We recently took a call from a user reporting “Sophos PureMessage can’t be working because I’m getting 250 spam messages a day”. After a quick bit of analysis, we saw that her account was actually receiving c.6000 spam messages a day – in other words Sophos was removing nearly 96% of all the spam she received.
In these situations, a brief discussion with the users concerned usually reveals that they haven’t been adhering to the advice that I’ve outlined above. Google often shows their email address listed on numerous websites, blogs and bulletin boards. Anti virus protection by this stage is simply “papering over the cracks”. A simple remedy in these situations is to create a new mailbox for the user and use Out Of Office rules to let their existing contacts know their new address.
