Allies in the Spam War

Other nuisances - like getting employees to delete e-mail regularly or to quit saving 25 versions of the same Excel spreadsheets on their hard drives - are harder to tackle. But for spam and virus management, more CIOs are looking to outsource the headache.

Spam now makes up about 60 percent of all messages pouring into corporate e-mail boxes. But it's not so much the spam that strikes fear in the heart of CIOs, it's the potential viruses lurking within the unwanted messages, says Andy Toner, a partner at PricewaterhouseCoopers who advises clients on security policy.

The average company shells out at least $US2.5 million a year to deal with spam - when you add up productivity lost, bandwidth and storage consumption and support costs, according to server software maker NetIQ. Remedies range from simple whitelists and blacklists for filtering approved and disapproved mail, to software that analyzes the algorithms used to write e-mails. Many CIOs are using an army of tools to tackle spam, including CipherTrust's IronMail, Brightmail's Anti-Spam Enterprise Edition and Postini's Perimeter Manager.

At Daiwa Securities America, co-CIO Stephen McCabe outsources e-mail filtering to MessageLabs, which uses an artificial intelligence tool to weed out viruses and spam from incoming e-mails. Now, when MessageLabs finds either offender, it's quarantined for further review and McCabe (rather than the end user) is notified. Filtering e-mail offsite before it enters the network has helped solve the problem, he says; they haven't had a bad virus in more than two years. "When a virus hits an organization of our size, everything stops," he says. "You have to quarantine and clean the machines. It takes a day to resolve."

Mary Finlay, deputy CIO of Partners HealthCare System in Boston, says she's considering outsourcing virus management because it's become just too much of a nuisance. In January 2003, Slammer attacked a vulnerability in Microsoft SQL 2000 Web servers. For Finlay, whose company is largely standardized on Microsoft servers, Slammer was the last straw. She realized that her 1000 IT workers weren't communicating well and that they should be handling viruses - big and small - in a better way. "We were managing each virus as it came," says Finlay, whose network ferries crucial information on everything from patient registration to lab tests to medication orders among employees at 10 hospitals. That virus-by-virus approach - done differently within each department - is typical at big corporations where each manager wants to handle the problem in his own way.

But that method made the company's network vulnerable, Finlay says. So she initiated a system to keep antivirus software consistently up to date on both Windows NT servers and desktops at all 10 sites. "Whenever we've been hit since, having this process in place makes things run more smoothly," Finlay says. Still, she says she's looking to companies such as Symantec for help. "It's very labour-intensive and confusing to gather intelligence around an impending virus," she says.