February 10, 2008   Sign In |  About ebizQ |  Contact Us |  Join ebizQ Gold Club
Peter Schooff
Peter Twenty-Four Seven Security
Peter Schooff's blog is a daily look at what's going on in the world of computer security with an emphasis on how it affects businesses.

« What Does Spam Cost? | Main | Major Shift -- More Phishing than Virus Emails »

January 30, 2007
Spam I Am Not!

After you've spent the time and energy constructing the perfect Newsletter to keep your happy customers abreast of your company's new offerings, the worst thing that could happen is for that email to get mistaken for spam and, BAM, it gets deleted before it even gets opened. Here’s how not to avoid your company being mistaken for a spammer, taken from Dark Reading:

1. Ignore “unsubscribe” requests - This is pretty self-explanatory, and requires good list management so as the people who do not want your fantastic Newsletter don’t keep getting it ('cause if they do, they're going to end up hitting the SPAM button on their email, which will only add to your email delivery problems). Of course that means making sure your unsubscribe link is still working. It’s also key to note that in the U.S. it is ILLEGAL not to provide the ability to unsubscribe.

2. List “repurposing” – Your company email list should be treated as your company’s lifeblood and your livelihood, and in no way whatsoever sold to another company so they can’t start trying to sell them on something. We’ve all had this happen with snail mail, and as a matter of fact, a recent magazine subscription of mine had my name misspelled, and you would not believe how many subscription offers I now get with that very same misspelling. But online, that will likely get you tagged as a spammer, and render your mailing list useless.

3. Provide unclear privacy checkbox instructions, and then ignoring users’ responses – Fairly simply and self-explanatory, but also includes things like NOT having the opt-in box prechecked, which looks unprofessional and a little shady. Also, if the directions are not clear, this could also create some consumer distrust, which is exactly NOT the way to run a successful enterprise (unless you’re a spammer, of course).

4. Lose track of the company’s desktop and server machines that could be co-opted by someone else – Andrew Lee, chief research officer for Eset, says he recently conducted an audit for a client and found an infected machine sitting under some tables in the janitor's broom closet. It was pumping out thousands of IP scans per minute. "No one had any idea it was there, or why it was there, and by the age of the hardware, it had been there a very long time," he says. "It's very hard to get free of the taint of being a spammer, or being associated with an IP that is on a lot of block lists. And it can be really hard to clean that up." A company simply needs to account for every connected computer. Enough said.

5. Not keeping lists up-to-date – This is fairly simple, and is as important as not allowing customers to opt out. But this also means not using old lists for the very reason that the opt outs may suddenly be opted back IN. If your company is reported to Spamcop or any other spam reporting service, be sure to follow up immediately for a speedy resolution.

6. Having vulnerable mailer forms on your website – botnets have made this less common, but if you have a mailer form on your Website that is vulnerable to an open relay, an old-school spammer could use this to shoot his mail through, notes Eset's Lee. "This is much less common now. But it still happens, particularly in smaller businesses where there is less expertise in the organization."

"Hackers usually begin by sending to a potential target's domain a massive number of messages using different names just to see if they can get any responses," says Mike Katz, President of Message Partners, an up-and-coming email security company. "This is how a cybercriminal typically uncovers working addresses inside an organization to coordinate their attack."

7. Working with less than reputable third-party mailers – Like buying stolen goods known to be stolen, if you’re not part of the solution you are part of the problem. A good way to make sure a company is reputable is make sure they use the same policies as you, i.e. checking email addresses and maintaining clean databases. Adds Eset's Lee. "Unfortunately, even legitimate companies that have no intention of spamming have been caught outsourcing their [email] advertising to companies which are less than scrupulous."

Another warning sign, if a price is too good to be true, ask more questions, like where do they get their mailing lists, and ask to see their opt out page and check to see if it actually works.

Posted by pschooff in Spam |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1248

Comments Post a comment




Remember Me?

(you may use HTML tags for style)

We ask that you type your code (displayed below) in the text box.This code is an image that cannot be read by a machine. It prevents automated programs from submitting comments.


Code:



Most Recent ebizQ Blog Entries
ADVERTISEMENT
Subscribe
News Feed
Blog Roll
Blogosphere
This Work
Accountability:The opinions expressed in this blog are solely representative of the blog's author, and not of ebizQ

Subscribe to our Newsletters
ebizQ Weekly Gold Club Update
Live Webinar Updates
Updates from ebizQ Partners
ebizQ SOA Update
ebizQ BPM Update
ebizQ Security Update
ebizQ BI Update
ebizQ Open Source Software Update
Virtual Show Newsletter
Your E-mail Address:
BAM: The Killer App for CEP
Date: Feb 12, 2008
Time: 12:00 PM ET
(17:00 GMT)

I WANT TO ATTEND
Event Processing Market Pulse
Date: Feb 14, 2008
Time: 12:00 PM ET
(17:00 GMT)

I WANT TO ATTEND
Archived Webinars | Upcoming Webinars

Marketing Solutions | Feedback | About ebizQ | Unsubscribe | Privacy Policy | Site Map