Email Monitoring and Spam Filtering

1
E-mail Monitoring and Spam Filtering

• Jeffrey Deason
• Chick-fil-A, Inc.

2
Agenda

• Company Overview
• Overview of Chick-fil-As E-mail Volume
• Monitoring E-mail
• Spam/E-mail Virus filtering
• Why this is important and what we do to minimize
  our risks
• QA

3
Company Overview

• Based in Atlanta, Ga
• 1103 locations (418 Malls, 437 FSU, 29 DTO, 188
  Licensee Locations, 31 other) in 36 states
• 1967 first Chick-fil-A in Greenbrier Mall,
  Atlanta
• 1986 first FSU in Atlanta
• 1992 licensee locations began opening on campuses

4
Corporate Purpose

• To glorify God by being a faithful steward of all
  that is entrusted to us. To have a positive
  influence on all who come in contact with
  Chick-fil-A.

5
Chick-fil-A E-mail Overview

• Microsoft Exchange 2000 Servers
• 1700 mailboxes
• Centralized Administration
• 500,000 messages processed monthly
• 35,000 messages sent to Internet
• 275,000 received from Internet

6
Monitoring E-mail
7
Know Thy Traffic

• How much traffic do your servers handle?
• Who are your top senders/recipients?
• What external domains do you communicate with the
  most?
• What content is being e-mailed?
• What business process rely on e-mail
• Does any traffic need to be secure?
• What type of attachments are being e-mailed?
• How big are attachments?

8
How we learned more about our Traffic

• Implemented a reporting/analysis tool
• Monitor the System Administrator mailbox
• Monitor filtering queues
• Asked departments to keep IT in the loop
• Keep ears open

9
Spam/E-mail Viruses

• What is Spam?
• Why do Spammers spam?
• How big of a problem is Spam?
• How wide spread are e-mail viruses?
• Why worry about Spam?
• What can you do about it?

10
Why do Spammers Spam?

• Far Reaching
• Little Effort
• Small Investment
• Possible huge ROI

11
Spam blocked at Chick-fil-A
12
E-mail Viruses blocked at Chick-fil-A
13
Why worry about Spam?

• User productivity
• User frustration
• Hard to measure, but HUGE
• ITs responsibility to protect users and their
  data
• Costs
• Storage/Bandwidth
• Helpdesk calls

14
Why is blocking Spam Difficult?

• Spammers use many tricks
• Randomly generate FROM addresses and SUBJECT
  lines
• C h o p p y text
• M1sspe11ed w0rd
• Images Only
• Not everyone will define Spam the same way
• Whats the difference between a newsletter and a
  Spam message?

15
What can you do about it?

• Educate your users
• Lunch and Learns
• Add information to IT Orientation
• Implement a point of contact mailbox for users to
  forward junk e-mail
• Monitor your systems
• Implement e-mail filtering products

16
E-mail Filtering Solutions

• Internal vs. Outsourced
• Internal
• Software vs. Appliance
• Gateway vs. Desktop

17
What to look for in a solution?

• Customizable for your business
• Attachment filtering
• Virus protection
• Allow end-user management
• Client software required?
• Redundancy/Fail-over servers
• Anomaly detection
• Costs?
• Reporting

18
Internal Solutions

• Pros
• More direct control and customization
• Security, as all mail is quarantined locally
• Cons
• A lot of administration
• Requires admin to view a lot of inappropriate
  e-mail to tweak rules
• More expensive upfront costs
• Did I mention administration ?

19
Outsourced Solutions

• Pros
• Turnkey solution
• Leverage experience from ISP
• Less administration
• Lower upfront costs
• Usually better redundancy/fail-over
• Cons
• Usually less customizable
• Who is watching your mail??

20
How has Chick-fil-A addressed Spam and E-mail
Viruses?

• Oct. 2000 - Installed internal gateway software
  solution for virus protection/e-mail filtering
• Jan. 2003 Replaced Windows server and filtering
  software with a gateway appliance for filtering.
  Began testing client software.
• Aug. 2003 Contracted external service to
  process mail before entering our network

21
Lessons Learned

• Be careful with word filtering
• Newsletters Spam??
• Be Careful with attachment content filtering
• Bypass filtering content for some addresses (i.e.
  feedback_at_chick-fil-a.com)
• Ask departments to keep IT in the loop
• Outbound Content Filtering can be tricky
• Without understanding your traffic, business
  processes that rely on e-mail can break
• E-mail is a vital application that all users
  should be trained on.
• Inform Users of E-mail filtering systems
• Layered approach may be necessary

22
Questions ?
23
Contact info

• Jeffrey Deason
• jeffrey.deason_at_chick-fil-a.com
• 404-305-7661