IronPort Gets Tougher On Spam

The enhancement will increase the antispam functionality of its e-mail security appliances.

Assessing the reputation of the e-mail sender was not enough to block spam and phishing attacks that are becoming increasingly complex, said IronPort's vice president of technology Pat Peterson. That's why IronPort is now tracking URLs within the content of the e-mail, and placing a reputation score on them to filter out spam such as phishing attacks that can look identical to a legitimate message, but contain a bad URL link.

IronPort is not the only vendor to use reputation data filtering, but its database that analyzes and scores the IP addresses of incoming e-mail is one of the largest on the market, said Jay Gregg, practice manager with Houston-based solution provider Accudata Systems. IronPort claims its SenderBase network is built with data from more than 100,000 participating organizations that identify bad URLs and known spammers. SenderBase filters out so much spam at the perimeter, customers initially don't think it's working because they no longer see as much spam on a quarantine list, Gregg said.

"It's a testament to its accuracy," Gregg said.

Not only does having less spam to deal with appeal to customers, but it is an advantage for dealing with compliance regulations that require companies to account for how much spam has to be deleted or added to a blacklist, Gregg said.

Dale Mitchell, general manager with Cincinnati-based solution provider Data Processing Sciences, estimated that SenderBase filters out between 88 and 92 percent of spam. One client, he said, found out that its own IP address was being blocked by SenderBase because they had a virus and didn't know it.