Case Study: University Of Missouri-Columbia

May 30, 2006

Download as PDF Document

Academic staff and students at the University Of Missouri-Columbia are certain to have their mailboxes well guarded against spam. Their recent adoption of the Microsoft Exchange Intelligent Message Filter together with WinDeveloper IMF Tune greatly hardened their layered message hygiene architecture.

The University Of Missouri was founded in 1839. Their research activity has an economic impact of more than $380 million, supports more than 8,000 jobs, prepares students to succeed in a knowledge-based economy, solves problems and improves lives, leads to innovations and new companies, attracts new money to the state and helps make Missouri and the U.S. more competitive.

The Challenge

With thousands of new students every year, the University is equipped with best of breed email architecture. Their Exchange Organization services over 55,000 mailboxes distributed across 10 backend servers. Their 3 inbound SMTP gateway servers handle a daily load of 750,000 internet originating emails. In such an environment spam certainly cannot be allowed to deliver its disruptive load.

Despite already adopting other anti-spam filtering solutions, the University did not miss the opportunity to further reinforce itself through the Exchange Intelligent Message Filter (IMF). The benefits of IMF were immediately evident, but so was the need to better harness its power.

The first requirement was to control filtering based on the email originating host IP. This triggered the evaluation of IMF Tune. Once installed, it was clear IMF Tune was going to broadly exceed the initial requirements.

Solution

IMF Tune immediately satisfied the need for controlling emails based on the originating host IP. A set of rules were configured for adjusting the Spam Confidence Level (SCL) ratings assigned by IMF. These leveraged the ability to apply SCL increments/decrements and to completely override the current SCL rating.

In this manner legitimate emails were whitelisted bypassing any filtering. Others were blacklisted, blocking emails from known spam sources. Whilst others had their SCL rating adjusted upwards/downwards. This enabled influencing email classification without completely overriding IMF.

The IMF and IMF Tune tandem was added to the already present email hygiene architecture. Stephen Phifer, the Email System Administrator, highlighted their careful product selection process, "We tested and/or reviewed a multitude of 'appliance' based products as well as other Exchange centric software solutions. IMF Tune works well with other Exchange filtering tools and does not cause any conflicts."

Apart from resolving their key requirement, IMF Tune was ready to deliver more functionality. "Once acquired, we discovered numerous uses for IMF Tune and have implemented a dozen custom rule-sets", explained Stephen. "The feature we use most often is IMF Tune log reporting. This allows us to quickly and easily determine (via logparser 2.2) the source of our most obnoxious spammers so they can be added to our custom RBL blacklist."

Apart for enhancing IP based filtering, the IMF Tune logs enabled a broader analysis of the emails received. As a result the SCL ratings for some top-level domains (.biz, .info, etc.) were incremented. The logs also helped identifying the characteristics of image-based spam and phishing attacks. Again IMF Tune rules blocked spam that would have otherwise managed to go through unfiltered.

About WinDeveloper

WinDeveloper Software delivers applications and consultancy services for the Windows platform. WinDeveloper specializes in Microsoft Exchange integrated applications as well as other core Windows technologies. For details on our current consultancy projects and other products, visit our website, www.windeveloper.com

All product and company names herein may be trademarks of their respective owners.