Spam has climbed back up the priority list for IT managers. But this isn't 2002 when spam first began clogging inboxes. Today, IT managers are cynical about product offerings and the vendors providing the so-called solutions.
It's no longer just about spam. For vendors it's a global, $US5 billion-plus secure content management market (SCM), covering spyware, phishing and other malicious code.
As Clayton Utz CIO Garry Clarke explains, the IT security landscape is very "vendor driven".
"There is a lot of hype and some vendors are almost unethical in trying to generate a need for their service or solution," Clarke said. "I get 10 cold calls a day; but what's worse is vendors that go to the CEO or board members to say 'your IT person isn't speaking to me and I have a solution you need'. CIOs know when the business needs a particular product."
Clarke referred to a large, global infrastructure company that sends him five different marketing blurbs but in each his name and title are totally different.
"Security is obscure because it's not just locks on doors; it is far more intangible," he said.
According to an IDC report into the SCM market from 2005-2009, financial gain is the number one driving force behind the spam epidemic, with spyware and phishing attacks becoming incredibly sophisticated.
E-mail pipelines will continue to be a favourite target for malicious attacks at a time when IT departments are tasked with preventing information leakage, meeting compliance standards and ensuring networks, servers and inboxes are not clogged with spam. As much as 80 percent of e-mail is spam and IDC believes that more than three-quarters of all corporate machines are infected with various forms of spyware.
Rather than continue to exhaust internal resources, enterprises are now looking to managed service offerings.
Clayton Utz CIO Garry Clarke turned to MessageLabs even though techies were initially reluctant to hand the job over to a provider.
Previously, Clarke had two and a half people managing the spam problem and there were still plenty of complaints from users.
"The perception from the techies is that a managed service provider can't do as well as we can, but now the techies are doing more high-value tasks such as e-mail and bandwidth management. They are fine-tuning instead of just keeping the lid on a problem," Clarke said.
Frost & Sullivan security analyst James Turner said increased adoption of managed services is likely in the next three years as one way to overcome the spam problem.
"Spam is most definitely an issue for business and it's a long way from being fixed," he said adding that one of the major banks manages 4TB of e-mail a day of which 60 percent is spam.
"We're talking big numbers here. A complete revision of e-mail architecture is required to help restore faith in an area of communication that could be so much better than it is."
Another MessageLabs customer is Bank of Queensland IT security manager Grant Slender, who says spam is like unclean water going through your infrastructure.
Slender is currently planning for greater scalability and didn't want to put infrastructure in place to cope with increased bandwidth.
"Using a managed service isn't simply about cost savings, the goal was to simplify infrastructure," he said.
With IT security, Slender said there is always a fear that there aren't enough hands on deck.
"I'd prefer to hand it over to a specialist that has access to resources across the globe," he added.
But for those managing the problem in-house, it's about having the right tools, according to former Packateer founder Robert Jones, who is the new ANZ regional manager at CipherTrust.
The company provides a combined software and hardware offering that covers the SCM spectrum.
"It's not just about spam anymore the problem is much wider than that," Jones said.
"Not all messaging security threats are inbound. Solutions need to cover outbound threats also to cover compliance, intellectual property and theft of confidential information."
Jones estimates 80 percent of corporate IP leakage is through e-mail and points out that e-mail is involved in 85 percent of corporate litigation. So who are the players in this market? The top five SCM software providers are Symantec, McAfee, Trend Micro, Sophos and Websense while the top appliance providers include CipherTrust, IronPort and SonicWall. For hosted services, the biggest players include MessageLabs, Postini and FrontBridge.
Then there are the Web filtering providers such as SurfControl, Clearswift and Computer Associates. It is a highly competitive market.
Nuisance timeline
Spam moved from being a nuisance for IT managers in 2002 to a full blown nightmare in 2003, according to IDC. As many organizations implemented spam technologies during 2003 and 2004 spam started to slide down the priority list. But IDC believes the enterprise threat returned in 2005 with several factors driving this resurgence.
These include increased phishing attacks, the use of bot networks and zombie machines and new spamming technologies to distribute e-mails and viruses with greater speed.
Propogation times for malicious e-mail viruses have dropped from hours to minutes. From the start of the Spam Act, on April 10 2004, until 31 March 2006, the Australian Communications and Media Authority( ACMA ) received 4274 formal complaints, issued formal warning letters to 10 companies or individuals, entered into enforceable undertakings with five companies, issued 13 fines collectively to five companies or individuals; and successfully prosecuted a company and its managing director in the Federal Court in Perth.