SPAM Control: Success or Failure ?

The Bad News
First, the bad news. In a year-end analysis, email-security solutions provider SoftScan announced that less than 3 percent of all of the email it scanned in December was legitimate. "Once again, the rapid increase of spam throughout 2007 demonstrates that there is not enough deterrent for spammers to give up their highly lucrative enterprise," commented Diego d'Ambra, SoftScan's CTO, in a company statement.

Anti-malware software vendor CA painted an equally gloomy picture in a January 2008 Internet-security report. The company observed that spam is now the preferred distribution method for malware, with 80 percent of spam containing links to malicious sites or malware.

Spam's quality is also improving, warned CA. The typical spam message is no longer riddled with grammatical errors and typos, giving the bogus email an increased aura of legitimacy. As always, CA observed, spam attachments such as documents, spreadsheets, graphics and videos typically contain malware or links to malicious Web sites.

The Good News
The good news about spam is not that the onslaught is receding - it isn't - but that spammers are not causing as much mayhem as many experts were predicting just a few years ago. So far, spam's biggest impact on businesses - at least those with adequate safeguards in place - has been the cost of transporting and filtering junk email.

People also seem to be feeling slightly better about spam. According to a study released in May 2007 by the Pew Internet & American Life Project, the percentage of email users who believe spam is "a big problem" fell from 25 percent in 2003 to 18 percent in 2007 - a small but significant decline. Additionally, users who believe spam is "not at all a problem," rose from 16 percent to 28 percent over the same time period.

There is also growing hope that fresh spam-fighting breakthroughs will soon give ISPs, businesses and other email defenders access to new and more powerful tools. Over the past few months, research teams at Carnegie Mellon University, Georgia Institute of Technology, IBM Research and a variety of other institutions have announced methodologies designed to tackle image spam, phishing and a variety of other email threats. More breakthroughs are likely to be announced in March at the MIT Spam Conference.

The Score
In light of all these facts and trends, who's winning the spam war: the spammers or legitimate email users? An objective look at the email battlefield shows that neither side is "winning" in any true sense of the word, despite the rapid rise in spam volume and the steady arrival of anti-spam tools and practices.

Spammers are devious, continuously experimenting with new technologies and shifting tactics. Spam defenders, on the other hand, are also moving quickly and are adopting enhanced protection technologies that effectively neutralize new spam threats almost as soon as they appear. The result of both sides' unflagging efforts has been a giant stalemate, with spammers failing to deliver a crippling blow to Internet email and defenders unable to stifle the flow of spam.

This situation is neither good nor bad news for businesses; it is simply a fact of life. For now, companies can rest assured that a combination of spam filtering, anti-malware technologies and user education will make their email environments generally safe and reliable. This situation may eventually improve or deteriorate over the next few months or years. For the moment, however, spam control has many of the characteristics of a virtual chess game.

(source: networksecurityjournal.com)