Educause Security Discussion mailing list archives

Re: Outbound spam filtering


From: Joe St Sauver <joe () OREGON UOREGON EDU>
Date: Thu, 5 Jan 2012 10:58:04 -0800

One point worth noting: as spammers get more and more aggressive in an 
effort to keep getting their spam through, and spam filtering companies 
are under increasing pressure to keep even the most subtle of spams out, 
false positives ARE on the rise.

Normally, user review of content that's been filtered, including content
that's been accidentally misfiltered, will serve as "second set of eyes"/
check on this problem, but many users have just given up and have stopped 
checking their spam folder for potential false positives. That's really bad.
If they do that, they may/will miss potentially critical communications. 

Worse yet, some sites may just silently drop blocked content, notifying
neither the sender (while a connection is still in place) nor the
recipient that a message isn't going to be accepted and delivered.

This means that it's increasingly important to:

-- stress to users that email is NOT an assured communication medium

-- encourage your users to whitelist their routine collaborators, if
   that's an option

-- if spam does get delivered to a spam folder at your site, train 
   your users to actually CHECK that folder; mistakes DO get made, 
   and if you don't routinely check your spam folder, you WILL often 
   miss legitimate email

-- if a legitimate message does get filtered, and if your spam filter
   provides an ability for you to provide feedback about that false
   positive, take the time to do so. 

Regards,

Joe


Current thread: