A Look at
Past, Present and Future of Email Reputation Systems
“Reputation, reputation, reputation! Oh, I have lost my reputation! I have lost immortal part of myself, and what remains is bestial.”
--Spoken by Cassio, in Shakespeare’s Othello (circa 1602)
Though written over four centuries ago, sentiment behind these words still holds true – you’re nothing without your reputation. Every day, different reputation systems dictate who you are to those who don’t know you. To lenders, you’re a credit score. To insurance companies, you’re a calculated risk. And now, thanks to next generation of reputation systems, you’re an IP score.
For obvious reasons, spammers, phishers and virus writers would prefer to hide their identities. They use countless techniques to disguise themselves with intent of sneaking into your enterprise inboxes, robbing you blind or hijacking your network – or both.
On other hand, those who would fight these senders are well served to know who senders are and what they’ve been up to. To that end, email reputation systems are used to figure out what sort of behavior senders have demonstrated in past and make educated predictions of their future behavior, for better or for worse.
Content Inspection Is Not Enough
Unfortunately, many enterprises rely on an email security solution based solely on message content; understanding source of a particular message never enters equation. While this approach is moderately effective when dealing with messages that contain specific spam identifiers, it is completely ineffective at stopping spam that employs techniques not yet seen.
Email Security with Reputation
A comprehensive approach to email security involves examining both message content and sender history. By evaluating senders based on their past behavior, a more accurate picture of their intentions and legitimacy can be discerned. Has sender engaged in spamming, virus distribution or phishing attacks? If they have, an effective reputation system knows and flags message. Has sender even been seen before? If not, a reputation system should pay close attention to ensure that sender is not a “zombie” machine being controlled remotely by a hacker.
First-Generation Reputation Systems
In “early days” of spam (circa 2001), simple blacklists and whitelists seemed like an appropriate response to nuisance messages that had begun to show up in inboxes around world. Blacklists contain IP addresses of known spammers, phishers and virus senders; whitelists contain IP addresses of senders known to be legitimate. Referencing these lists allowed companies to filter a segment of their total mail flow, briefly curbing onslaught of spam messages. However, their shortcomings were exposed relatively quickly.
The very nature of whitelists and blacklists makes them manual by default. In order for a list to be updated, all messages (both wanted and unwanted) must first be received by an end user and then manually reported to a system administrator. With this sort of end-user reliance, it’s easy to see why glory days of list-only reputation systems were short-lived.
Further compounding matters, lists rely on anecdotal evidence, opening door to “vigilantes” who add senders to blacklists without first verifying that they’re actually malicious; and spammers, who add themselves to whitelists which take a “pay-to-play” approach, allowing any “bonded” sender to buy their way onto list.
