Your Reputation Precedes You

“Reputation, reputation, reputation! Oh, I have lost my reputation!
I have lost the immortal part of myself, and what remains is bestial.”

--Spoken by Cassio, in Shakespeare’s Othello (circa 1602)

Though written over four centuries ago, the sentiment behind these words still holds true – you’re nothing without your reputation. Every day, different reputation systems dictate who you are to those who don’t know you. To lenders, you’re a credit score. To insurance companies, you’re a calculated risk. And now, thanks to the next generation of reputation systems, you’re an IP score.

For obvious reasons, spammers, phishers and virus writers would prefer to hide their identities. They use countless techniques to disguise themselves with the intent of sneaking into your enterprise inboxes, robbing you blind or hijacking your network – or both.

On the other hand, those who would fight these senders are well served to know who the senders are and what they’ve been up to. To that end, email reputation systems are used to figure out what sort of behavior senders have demonstrated in the past and make educated predictions of their future behavior, for better or for worse.

Content Inspection Is Not Enough

Unfortunately, many enterprises rely on an email security solution based solely on message content; understanding the source of a particular message never enters the equation. While this approach is moderately effective when dealing with messages that contain specific spam identifiers, it is completely ineffective at stopping spam that employs techniques not yet seen.

Email Security with Reputation

A comprehensive approach to email security involves examining both message content and sender history. By evaluating senders based on their past behavior, a more accurate picture of their intentions and legitimacy can be discerned. Has the sender engaged in spamming, virus distribution or phishing attacks? If they have, an effective reputation system knows and flags the message. Has the sender even been seen before? If not, a reputation system should pay close attention to ensure that the sender is not a “zombie” machine being controlled remotely by a hacker.

First-Generation Reputation Systems

In the “early days” of spam (circa 2001), simple blacklists and whitelists seemed like an appropriate response to the nuisance messages that had begun to show up in inboxes around the world. Blacklists contain the IP addresses of known spammers, phishers and virus senders; whitelists contain the IP addresses of senders known to be legitimate. Referencing these lists allowed companies to filter a segment of their total mail flow, briefly curbing the onslaught of spam messages. However, their shortcomings were exposed relatively quickly.

The very nature of whitelists and blacklists makes them manual by default. In order for a list to be updated, all messages (both wanted and unwanted) must first be received by an end user and then manually reported to a system administrator. With this sort of end-user reliance, it’s easy to see why the glory days of list-only reputation systems were short-lived.

Further compounding matters, lists rely on anecdotal evidence, opening the door to “vigilantes” who add senders to blacklists without first verifying that they’re actually malicious; and spammers, who add themselves to whitelists which take a “pay-to-play” approach, allowing any “bonded” sender to buy their way onto the list.

Other mitigating factors were behind the decline in blacklist and whitelist effectiveness. In the end, the failure of these lists as email security solutions was largely due to their inability to factor message quality into the equation.

Second-Generation Reputation Systems

The next iteration of reputation systems built on the failure of blacklists and whitelists to maintain control over the spam flood. While the lists remained an integral component, new features briefly increased second-generation reputation systems’ efficiency and effectiveness. With time, however, spammers adapted their habits to evade detection.

Among improvements seen in second-generation reputation systems were dynamic lists, necessary to combat the introduction of “zombies” into the email security landscape; automatic updates, which removed the administrative burden of manually uploading lists; and message scoring, which assesses a message’s likelihood of being spam and assigns a corresponding “score.”

The Next-Generation Reputation System

Today’s spammers are more clever than ever, so today’s reputation systems must be equally sophisticated. An effective reputation system must be dynamic, comprehensive and precise, and based on actual enterprise email traffic in order to keep the spammers from gaining any advantage. To that end, CipherTrust developed TrustedSource, the most precise and comprehensive reputation system available. TrustedSource keeps enterprises ahead of the spammers by leveraging research generated by CipherTrust’s industry-leading network of customers. In developing TrustedSource, CipherTrust has succeeded in defining to a reputation for every IP address in use across the Internet (all 4.2 billion!), not just those that have been encountered in the past.

By combining years of industry-leading research with the unmatched capabilities of IronMail’s Message Profiler, CipherTrust has made some ground-breaking discoveries about the email sending behavior of IP addresses. TrustedSource merges CipherTrust’s unmatched knowledge base and global customer network of over 1,400 companies with generally available data such as traffic patterns, white/blacklists and network characteristics. This powerful combination allows TrustedSource to assign accurate scores to any IP address encountered by IronMail, considering both sender history and message characteristics.

Trust Your Reputation to Ours

A traditional email security approach that relies solely on identifying messages based on content and/or characteristics, or an approach that relies solely on blacklists and whitelists, is incapable of generating adequate data about senders. In order to accurately identify messages as wanted or unwanted, corporations must embrace an approach that includes a comprehensive reputation system like TrustedSource. To learn more about TrustedSource and how it can help you take control of your enterprise email security, download CipherTrust’s free whitepaper, “TrustedSource: Reputation Redefined.”