December 13th, 2016
It comes down to a simple distinction between “good guys” and “bad guys”. Good guys are the customers, partners, suppliers, other business associates, friends, service providers, teachers and everyone else you already communicate with or who you may want to communicate with in the future. Bad guys are whoever sends (or gets some bots to send) any bogus messages.
If you already knew all of the good guys you ever wanted to communicate with, you could simply create a “white list” with their addresses. That would solve the first part of the problem. Unfortunately, there are always new good guys coming online (like new prospective customers). You do not want to create bad impressions and administrative headaches by simply rejecting messages from unknown people and then having to manually add them to your white list.
Open Internet email was essentially “invented” in August 1982 with the publication of RFC 821, which described the Simple Mail Transport Protocol (SMTP). At that time, everyone using the Internet was a good guy, so no mechanisms were included for blocking bad guys. More recently, communications tools like Instant Messaging (AIM, GTalk, Skype et al) and social networks like Facebook have been released, and their designers learned from watching how bad guys abused email.
All of these more modern communications tools assume that there are good guys and bad guys (i.e. “friends” and “everybody else”), and they provide a means for creating each user’s “community” of friends (or “buddies” or “contacts” or “followers” etc.). You interact with your community, and are protected from everybody else. New people can ask to join your community, and you control the process.
Community for Email
This concept of community is EXACTLY what email needs in order to solve the abuse problems. But, it must be simple and intuitive, and not add any administrative overhead. As an email administrator (presumably), you have two basic choices: request that your email system vendor add this functionality to their product, or externally augment your system. (We, of course, would recommend adding our products as the ideal course of action.)
At a high level, Sendio’s definition of communities for email can be summarized as:
- Take the effectiveness of white listing
- Add a straightforward automated mechanism for new “good” people to join that “bad guys” won’t use
- Provide an easy way for dumping a “semi” good guy that you just don’t have the need or interest to communicate with
- Add extra features for dealing with mailing lists, newsletters and other automated messages that come from “software” and not “people”
- Finally, perform a virus check on messages just to make sure nothing is trying to sneak in via a message from a “good guy”
- Building an Initial Community
- So, how do you go from lovely concept to hard reality ? First, you recognize that there can be both company-wide communities and personal communities. A company-wide community is the list of people that everyone may want to communicate with, whereas a personal community would include people that are specific to an individual.
The company-wide community would import all of the system contacts in your email server and, typically, all of the contacts in the your CRM system (SAP, Siebel et al). Personal communities would import all of an individual user’s contacts (from Outlook for example). In this way, everybody you already do business with or interact with is automatically in your community.
Maintaining a Community
Once your community is defined and deployed, the communications process is straightforward:
- Every email sent to your server first has a series of SMTP validity and header checks performed to eliminate obviously bogus, forged or spoofed messages
- Next, the message is scanned for viruses and other malware, and it is rejected if anything is found
- Then, the message is analyzed to determine if it violates any corporate policies (e.g. message size, attachment types, standards compliance [DKIM, SPF, etc.])
- Finally, the message sender is compared to the community lists, with two potential outcomes:
- If the sender is already a member of the community, the message is forwarded on to the email server for routing to the appropriate inbox(es)
- If the sender is NOT a member of the community, the message is held in a “pending queue” while the sender is invited to join the community
The “Invitation” Process
Here is where the bad guys get shut down while new good guys get connected. When a message from a non-community member comes in, it gets held in a “pending queue” while an invitation-to-join-my-community email is sent back to the non-member. All that person needs to do to join your community is reply to the invitation (click Reply and Send). This proves that a real person sent the original message.
Once they reply, they are now a part of your community and their original message gets delivered. Then, from now on, all messages from the new community member get delivered to you immediately, unless you decide to block then at some point. You “own” your community and completely control who has access to your inbox.
The “trick” here is that the bad guys won’t (and in fact can’t) reply to the invitation-to-join-my-community message. Bad guys go to great lengths to be “anonymous” so that they cannot get tracked down. A message sent to them goes to either a fake address or a compromised bot system, neither of which will respond. So, the invitation gets ignored and the original message gets dropped from the pending queue. You never see it.
This process is EXACTLY the same as when you joined Skype or Facebook. You had to confirm you were “real” and then you were in (until you break the rules at which point you get dropped). Everybody is familiar with this.
Newsletters and Subscriptions
But wait, you ask, what about legitimate messages that come from automated systems, not “people”, like newsletters and subscription notices and other online services ? No problems. When you first implement email system protection using communities, you “teach” the system about each user’s personal preferences. One user may want notices from Adobe, while another user NEVER wants those notices, and each can be accommodated.
No “Lost” Email
So, adding community management protects your email system from attacks and abuse by:
- blocking all messages from bogus senders
- blocking all messages that include malicious components (e.g. viruses and trojans)
- In addition, it eliminates the “lost email” problem. So called “email security” products create this problem when they attempt to block bad messages using techniques like “probabilistic risk assessment” and “reputation scoring,” which are fancy technical marketing terms for GUESSING. And we have all seen how they frequently guess wrong.
With communities, it is simply about message senders. If they are a part of your community, you get ALL of their messages. If they are outside, you get NONE. You have total control.