A Look at the Past, Present and Future of Email Reputation Systems
Reputation, reputation, reputation! Oh, I have lost my reputation!
I have lost the immortal part of myself, and what remains is bestial.--Spoken by Cassio, in Shakespeares Othello (circa 1602)
Though written over four centuries ago, the sentiment behind these words still holds true youre nothing without your reputation. Every day, different reputation systems dictate who you are to those who dont know you. To lenders, youre a credit score. To insurance companies, youre a calculated risk. And now, thanks to the next generation of reputation systems, youre an IP score.
For obvious reasons, spammers, phishers and virus writers would prefer to hide their identities. They use countless techniques to disguise themselves with the intent of sneaking into your enterprise inboxes, robbing you blind or hijacking your network or both.
On the other hand, those who would fight these senders are well served to know who the senders are and what theyve been up to. To that end, email reputation systems are used to figure out what sort of behavior senders have demonstrated in the past and make educated predictions of their future behavior, for better or for worse.
Content Inspection Is Not Enough
Unfortunately, many enterprises rely on an email security solution based solely on message content; understanding the source of a particular message never enters the equation. While this approach is moderately effective when dealing with messages that contain specific spam identifiers, it is completely ineffective at stopping spam that employs techniques not yet seen.
Email Security with Reputation
A comprehensive approach to email security involves examining both message content and sender history. By evaluating senders based on their past behavior, a more accurate picture of their intentions and legitimacy can be discerned. Has the sender engaged in spamming, virus distribution or phishing attacks? If they have, an effective reputation system knows and flags the message. Has the sender even been seen before? If not, a reputation system should pay close attention to ensure that the sender is not a zombie machine being controlled remotely by a hacker.
First-Generation Reputation Systems
In the early days of spam (circa 2001), simple blacklists and whitelists seemed like an appropriate response to the nuisance messages that had begun to show up in inboxes around the world. Blacklists contain the IP addresses of known spammers, phishers and virus senders; whitelists contain the IP addresses of senders known to be legitimate. Referencing these lists allowed companies to filter a segment of their total mail flow, briefly curbing the onslaught of spam messages. However, their shortcomings were exposed relatively quickly.
The very nature of whitelists and blacklists makes them manual by default. In order for a list to be updated, all messages (both wanted and unwanted) must first be received by an end user and then manually reported to a system administrator. With this sort of end-user reliance, its easy to see why the glory days of list-only reputation systems were short-lived.
Further compounding matters, lists rely on anecdotal evidence, opening the door to vigilantes who add senders to blacklists without first verifying that theyre actually malicious; and spammers, who add themselves to whitelists which take a pay-to-play approach, allowing any bonded sender to buy their way onto the list.
Other mitigating factors were behind the decline in blacklist and whitelist effectiveness. In the end, the failure of these lists as email security solutions was largely due to their inability to factor message quality into the equation.
Second-Generation Reputation Systems
The next iteration of reputation systems built on the failure of blacklists and whitelists to maintain control over the spam flood. While the lists remained an integral component, new features briefly increased second-generation reputation systems efficiency and effectiveness. With time, however, spammers adapted their habits to evade detection.
Among improvements seen in second-generation reputation systems were dynamic lists, necessary to combat the introduction of zombies into the email security landscape; automatic updates, which removed the administrative burden of manually uploading lists; and message scoring, which assesses a messages likelihood of being spam and assigns a corresponding score.
The Next-Generation Reputation System
Todays spammers are more clever than ever, so todays reputation systems must be equally sophisticated. An effective reputation system must be dynamic, comprehensive and precise, and based on actual enterprise email traffic in order to keep the spammers from gaining any advantage. To that end, CipherTrust developed TrustedSource, the most precise and comprehensive reputation system available. TrustedSource keeps enterprises ahead of the spammers by leveraging research generated by CipherTrusts industry-leading network of customers. In developing TrustedSource, CipherTrust has succeeded in defining to a reputation for every IP address in use across the Internet (all 4.2 billion!), not just those that have been encountered in the past.
By combining years of industry-leading research with the unmatched capabilities of IronMails Message Profiler, CipherTrust has made some ground-breaking discoveries about the email sending behavior of IP addresses. TrustedSource merges CipherTrusts unmatched knowledge base and global customer network of over 1,400 companies with generally available data such as traffic patterns, white/blacklists and network characteristics. This powerful combination allows TrustedSource to assign accurate scores to any IP address encountered by IronMail, considering both sender history and message characteristics.
Trust Your Reputation to Ours
A traditional email security approach that relies solely on identifying messages based on content and/or characteristics, or an approach that relies solely on blacklists and whitelists, is incapable of generating adequate data about senders. In order to accurately identify messages as wanted or unwanted, corporations must embrace an approach that includes a comprehensive reputation system like TrustedSource. To learn more about TrustedSource and how it can help you take control of your enterprise email security, download CipherTrusts free whitepaper,
TrustedSource: Reputation Redefined. About the Author
CipherTrust is the leader in anti-spam and email security. Learn more by downloading our free whitepaper, TrustedSource: Reputation Redefined. or by visiting www.ciphertrust.com.
