Seven tips for securing your organization´s network from spam and email viruses

Providing security against email related threats has become a burden for most IT professionals in 2006. According to a recent study by Postini, spam and email viruses now make up to 80% of all emails sent out as compared to 50% in 2000. As a result, IT professionals now face a tougher challenge in providing network security for this amount of spam. IT professionals also have the disadvantage of defending against new forms of email threats such as spam zombies, directory harvest attacks, mass mailing trojans, as well as the latest email virus.

In this article, I have listed the seven most effective spam fighting tips for organizations with in-house mail servers. These seven tips are proven techniques I have used for my customers, partners and associates who wish to tighten their perimeter (network) security.

1. Firewall: A firewall is your first line of defense against hackers, crackers, and spammers. Without a firewall, your network is a disaster waiting to happen and could give any novice hacker free reign over your network. If your organization has multiple Internet users, this tool is essential for securing your network.

2. Block Port 25: On your firewall, allow outbound traffic on TCP port 25 for all mail servers. Block traffic on outbound TCP port 25 for all other computers and servers. On the Internet, TCP port 25 is used for email traffic through SMTP (Simple Mail Transport Protocol). Blocking this port is a good security practice and prevents mass mailing worms and spam zombies from sending mail from your users' computers.

3. Managed Email Filtering: Consider using a managed filtering solution such as Postini, Brightmail, or SpamSoap. Managed Email Filtering services quarantine spam, viruses, and email threats before reaching the email servers on your network. In comparison to desktop filters and server appliances, managed filtering services provide superior perimeter (network) protection by preventing delivery of spam and viruses to your network and servers.

4. Check Relay Setting: A mail server's relay setting controls which computers and servers are able to send SMTP email on your organization's behalf. Check your settings and limit the IP address range to email users on your local network. Some mail servers have settings to limit email relay through authentication. If authentication-based relay is available, setup and configure it too. NOTE: If the relay is not set properly, spammers will be able to send email from your mail server. This exploit is commonly known as an "Open Relay" or a "Spam Relay." Use the Open Relay test at http://www.abuse.net/relay.htm to check if spammers can relay mail from your server.

5. Black Lists: Setup your mail server(s) with a black list. A black list (black hole list) is a database or listing of known spam sources. Most modern email servers can be configured to query inbound email against online blacklists. Messages originating from these sources can then be blocked. I recommend configuring your email server with SpamHaus blacklist. Spamhaus.org is an excellent free service to use. Some other good blacklists are DBSL and SpamCop.

6. Reverse DNS: Reverse DNS (rDNS) associates an IP Address with a Domain Name. Most mail servers, as an anti-spam feature, often use a reverse DNS lookup to compare an email address domain name with its IP address. If the IP address found from the rDNS lookup does not match the domain name, it is probably spam. If you haven't done so, setup and configure reverse DNS records on your DNS server.

7. Anti-Virus Scan: There are many tools that provide adequate anti-virus protection for desktops at the workplace. Most anti-virus software is good at detecting viral threats that proliferate email spam such as mass mailing worms, trojans, and directory harvesters. Large organizations might want to use enterprise anti-spam software with management and monitoring tools that will allow tracking of network virus outbreaks.

Recommended Links: - http://www.spam-x.com [Postini service - managed filtering, 1 to 500 users] - http://www.postini.com [Postini service - managed filtering, 500+ users] - http://www.spamhaus.org [Blacklist] - http://www.dbsl.org [Blacklist] - http://www.spamcop.net [Blacklist] - http://www.abuse.net/relay.htm [Open relay test] - http://www.dnsreport.com [DNS report/open relay test] - http://www.dnsstuff.com [Spam database lookup and open relay test] - http://www.cnn.com/2004/TECH/ptech/02/17/spam.zombies.ap [Spam Zombie Article]

Email viruses and related threats delivered through spam have cost businesses billions of dollars in expenses and lost productivity. Each spam email sent or received from your domain costs your organization money and bandwidth. By implementing these seven tips, your organization can reduce spam and recover costs.

This article: © Copyright 2006 Todd Green and free for republishing.