From the AEGIS e-Journal, Volume 10 Number 2, February 2007
ChoiceMail DigiPortal $39.95 http://www.digiportal.com/ The other day we realized we were drowning in a sea of spam, with this editor alone receiving between eighteen to twenty thousand pieces of spam each month, and growing. MailWasher, the excellent tool we had used up to now was ideal when the flow of spam was more reasonable, but we had reached the point where, if we went on a trip, our mailbox was full, with bouncing messages, before we had checked into our hotel. We decided to look at challenge-and-response systems, and tried ChoiceMail, which had been recommended by a friend. DigiPortal makes ChoiceMail in versions for in-house servers and third- party servers, as well as for single users, which is what we tried. They also have a free version if you have only a single POP3 account (ChoiceMail Free does not work with Yahoo, AOL, MSN and Hotmail Webmail accounts), and can live with some minor restriction of features. ÆGIS, February 2007 12 After downloading the trial software from http://www.digiportal.com/redirect/try_cmo.htm, we installed it and configured it (we ignore here the internals of the system), which was quite straightforward. We were able to import our MailWasher friends list, which meant that the people with whom we were already in correspondence would not be subject to challenge. For them the change wwould be transparent. For the rest, this is the way it works. You select a time-period for mail checks. The program downloads all your mail from all your accounts on that schedule. E-mail from people on your approved list (or who meet criteria you set up, such as accepting mail from listservs) go into the approved mail section of the program. Everyone else gets sent a response asking them to take a few seconds to click on a link and verify themselves. When they do this, the system (as we have it configured) adds them to the approved list and moves their mail into the approved folder. After a period of time that you specify (we chose three days), mail in the unknown senders list gets moved to the junk box, where it sits for another user-specified time (one day for us), at which point it is deleted. Over time ChoceMail stabilized at 92% of the incoming mail being spam. For the first few days we checked the unknown users list regularly, but stopped bothering once we had confidence in the system. Now we check it only if we expect something unknown, like order confirmation from a new on-line vendor. Keep in mind that unlike MailWasher, which allows you to delete e-mail on the server without ever downloading it, ChoiceMail will download all e- mail. This means you will be getting a lot of malware laden e-mail hitting your computer. The good news is that you don’t care, because A) your anti- virus software will kill all of it and B) this mail will never receive a response to the challenge, so it will go from unknown to junk to gone without your ever having contact with it. The bad news is that if your anti-virus software makes a noise when it finds a virus, you will need to turn the noise feature off. Rest assured that this will not slip your mind for too long…. The only problem we foresee is travel. As an example, next month we will be away for several weeks in places as far apart, geographically, culturally, and alphabetically, as Argentina and Uzbekistan. During this period we won’t, for a variety of reasons, be able to directly access our e-mail. While we can have someone check it regularly, we may just set up a temporary account on one of the Web providers, and send all legitimate users an away ÆGIS, February 2007 13 message saying to either wait until we get back, or re-send to the temporary Web mail account. The only oddity we experienced was that six months after we bought our copy they came out with a new version. You got a free upgrade if you bought it in the previous month, but those who bought it earlier in the calendar year had an upgrade charge of $19.95, or half the original purchase price. We feel this high a percentage this soon after purchase is untoward. Since we could see no functional difference between the old version and the new, we chose to stick with what we had. If you have small amounts of spam then MailWasher continues to be a useful tool. If you are overwhelmed with spam then ChoiceMail is definitely worth a look. 7. Subscription/Unsubscription/Copyright Information •• ÆGIS is supported and maintained by voluntary efforts. This publication is owned, published, and copyright © 2007 by The LUBRINCO Group Ltd, Inc. and Financial Examinations and Evaluations, Inc. It is edited jointly by Richard Isaacs (RBIsaacs@lubrinco.com), L. Burke Files (LBFiles@feeinc.com), and Terry Philips (TPhillips@aegisjournal.com). LUBRINCO provides services in three high-threat areas, too specialized to be dealt-with in-house, that can adversely affect domestic and international bottom lines. • Identification, valuation, and protection of intellectual assets and critical information. 1. American businesses lose $300 billion annually to competitive intelligence, economic espionage, and information theft. 2. Sarbanes-Oxley requires internal controls tracking the costs, and impact on valuation, of competitive intelligence, economic espionage, and information theft. o LUBRINCO is the leading private sector provider of access to OPSEC, the government-standard process for identification, valuation, and protection of intellectual property and critical information from competitive intelligence, economic espionage, and information theft. • International asset location and due diligence. o Location of concealed assets in fraud, theft, and divorce. ÆGIS, February 2007 14 o Due diligence to prevent fraud and loss in China, Central and Eastern Europe, Central Asia, the offshore financial centers, Latin America, and the Caribbean. o Financial fraud and anti-money laundering program development and training for compliance with the US International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001 and the EU Revised Money Laundering Directive of 2001. • Protection of management, staff, and families. o In the high-threat environments of Latin America, Africa, the Mid- East, and Southeast Asia. o When traveling and living overseas. o When transporting items of substantial value. LUBRINCO identifies and quantifies threats and vulnerabilities, and their associated risk, then manages the vulnerabilities so you can transfer or live with the residual risk. We prevent disastrous financial loss to your company, and physical harm to you, your family, and your staff. For information on LUBRINCO and its services, or for the archive of all past issues of ÆGIS in PDF format, please go to http://www.aegisjournal.com/. Subscription to ÆGIS is available for $15 per year in North America and $20 per year outside of North America. To sign up for a complimentary subscription to ÆGIS or the ÆGIS PDF notification list, go to http://lb.bcentral.com/ex/manage/subscriberprefs?customerid=7768 or send an email to subscribe@aegisjournal.com. To subscribe to our AvantGo channel, go to http://avantgo.com/channels/_add_channel.pl?cha_id=1773 To be removed from the subscription list, follow the instructions on the mailing you received, or send an e-mail to unsubscribe@aegisjournal.com. If you know of anyone else who should be receiving ÆGIS, please send their e-mail address to subscribe@aegisjournal.com. If there is a topic that you would like to know more about, send it to editor@aegisjournal.com and the editors will consider it as the topic for an article in an upcoming issue. If you would like to submit an article for publication in ÆGIS, send it as an attachment to an e-mail to editor@aegisjournal.com. Submission of an article ÆGIS, February 2007 15 certifies that (a) all information in the article is in the public record, or (b) that you are authorized to release any personal or corporate proprietary information contained in the article, and (c) that none of the article has previously been copyrighted. The submission of materials for publication in ÆGIS constitutes a license to LUBRINCO, and/or Financial Examinations and Evaluations, Inc, their assigns, associates, or affiliates, to abridge and/or edit said submission, and to copyright and publish/republish any submitted materials in whatever written and/or electronic form they may choose. If you would like to go beyond normal fair-use in reproducing articles from this issue of ÆGIS, you may do so freely as long as appropriate source, copyright, accreditation, and link to the ÆGIS Web site is included. This should be in the form
Article Title, from the February 2007 ÆGIS (© 2007 LUBRINCO & FEEINC), to be found at http://www.aegisjournal.com/. ÆGIS is a forum for the exchange of information, ideas, operating styles, theories, and related topics for corporate managers who make decisions about threats typically outside the expertise available in-house, yet which have the potential to affect their company’s domestic and international bottom lines. Nothing appearing in ÆGIS should be construed as legal advice. The information provided is “general information,” not “specific advice.” The solution to any problem is highly dependent upon the precise facts involved. Thus, before making any reliance upon anything said here, you should consult with an appropriately skilled professional. Opinions expressed by contributors are not necessarily endorsed by the publisher, and may be presented to encourage a dialogue among subscribers. The publisher and any re-publisher cannot be held responsible for any loss incurred as a result of the application of any information published in ÆGIS. Please be safe, and be smart.