A holistic approach to spam

People-based methodologies
The first step any business should take is to allocate specific responsibility for spam protection. In large organisations, this would involve creating and maintaining an IT security department, but the equivalent for small businesses entails nominating an employee whose job it is to keep abreast of spam developments.

The appointed individual should ensure that the company takes whatever measures are required to maintain and protect data (we’ll look at some of the available methodologies later) and must stay informed about real-time developments in spam and malware distribution.

This can be done easily by making a point of regularly viewing websites that provide breaking news on spam or malware generally.

A quick Google search reveals relevant sites. For example, several well-known
news-related sites target spam-based topics - see the comprehensive Topix, for example. Other sites - such as Spamfo - are exclusively dedicated to providing up-to-date information on spam.

Part of the nominated individual’s job should also involve formally training the workforce in how to recognise, and deal with, any spam that penetrates the organisation’s defences.

Naturally, this training needs to be refreshed at frequent intervals. This step is arguably the most important but it’s one that, in small businesses, is often overlooked. When the focus on spam protection is diffuse, little if anything is accomplished.

Process-based approaches
The ideal is to eliminate spam, while at the same time avoiding sidelining genuine messages as junk. However, in the real world there is no magic solution that will achieve this fully. Additionally, no single anti-spam solution, however clever or well conceived, can even come close to this goal.

The answer is to adopt a multipronged approach. There are three broad aspects to this. First, ISPs and email hosting companies aim to filter out spam before it reaches the consumer. This so-called ‘in-the-cloud’ filtering is effective up to a point but beyond the control of the business. Second, incoming and outgoing mail can be verified at the network edge.