Subscribe

Sign up to get the Inside Skinny on Epostmarks happenings


Categories
Twitter Feed

Epostmarks Tweets

    Follow Epostmarks on Twitter
    Loading..
    Loading..

    The Modern Wisdom of Epostmarks

    Entries in Phishing (4)

    Saturday
    May092009

    Why the US Economy Needs PostmarkedEmail

    Since email’s modest beginnings as an academic tool it has become the cornerstone business communication and commerce medium, preferred even over Web portals. Despite its history, current significance, and future promise, the modern world threatens email’s integrity, reliability, and efficacy.

    Today, the estimated annual cost of spam and phishing combined exceeds $113 billion in direct monetary and non-monetary losses. This recurring cost to the US economy is nothing short of astounding. Despite efforts from both government and private industry independently, the costs associated with spam and phishing continue to grow. After spending almost a decade researching spam and phishing, and doing business with experts in the private and public sectors, I believe a public-private partnership that incorporates the U.S. Postal Service Electronic Postmark (EPM) platform is one of the best methods of mitigating the negative impacts of spam and phishing while contributing to a sustainable U.S. economy. Our supporters agree although it will take significant time and hard work by many for this to work effectively.

    A necessary element for this service to run properly includes a tokenization platform that enables delivery and receipt of multiple classes of email within the existing email ecosystem. Internet Service Providers (ISPs) such as AOL and Yahoo! that adopt the platform guarantee the delivery and full functionality of these various classes of email by allowing them to bypass filters used to block spam and phishing emails. This enables a valuable way for the trusted brand and legal enforcement of the U.S. Postal Service (USPS) to extend into email.

    I believe that the service described above, which Epostmarks named PostmarkedEmail, has the potential to save the U.S. economy billions annually. In addition to cost savings, I believe that national implementation of the PostmarkedEmail service will create new jobs and provide existing employees with modern skills, particularly within the USPS.

    In prior articles, I elaborated on the costs to consumers and businesses due to spam and phishing.

    Saturday
    Mar212009

    The True Corporate and Consumer Costs of Spam

    Due to the persistence of spam and phishing, we have generally come to accept them as negative byproducts of eCommerce and online communication with which we must cope. Below I detail the major costs of spam - the costs of phishing are detailed in a subsequent post.

    Combined, U.S. corporate and consumer spam are at least a $108.8 billion annual problem, $92.2 billion of which is due to lost consumer and employee productivity and another $16.6 billion in preventative and administrative costs - IT and Helpdesk costs, respectively. The staggering (and rising) costs of both the price of current spam countermeasures and the inefficiencies of these countermeasures implicate a broken model and market. The economic burden of spam is placed entirely on the victims of such perpetration. Furthermore, the only solutions offered to date are not discrete (constantly needing to be updated and paid for regardless of usage) and thus have widely varied results. Hopefully the figures below elicit the same sense of urgency our team has felt for almost a decade. 

    Cost of Spam to Businesses

    Productivity - $25.5 billion/year

    At a price of between roughly $.01 and $.04 per email, spam costs the U.S. economy $25.4 billion annually in lost employee productivity. In total, roughly 80% of all U.S. corporate emails are spam. In 2005, the average U.S. worker received at least 30 spam emails per day with 15% of corporate spam filtered by desktop solutions and 49% filtered at the server level. Beyond automated filtering, 36% of all incoming spam gets manually filtered despite widespread adoption of spam filtering software. Without effective countermeasures, this figure will continue to grow.

    IT Costs (Spam Prevention*) - $5.8 billion/year

    At an average cost of $2.99 per user per month, the aggregate U.S. corporate IT cost for anti-spam systems is projected to be $5.8 billion in 2009. Assuming all businesses in the U.S. offer this service and will continue to do so especially as spam and phishing become more prevalent, the annual cost for protecting roughly 140 million non-farm employees is not likely to drop below $5 billion. 

    * In this posting, we will not the costs of detection although they are significant.

    Helpdesk Costs - $10.8 billion/year

    Help desk costs of spam in 2009 are projected to amount to $10.8 billion in the U.S., $33.5 billion worldwide. This estimation entails both the operating cost of a help-desk and the email users’ paid time using the service, particularly to retrieve filtered emails. For corporate email users manually filtering spam, this amounts to roughly 9% of the total cost of spam. For desktop and server filtering, the help desk cost is roughly 39% and 34%, respectively.

    Cost of Spam to Consumers

    Productivity - $66.8 billion/year

    Consumer spam cost the U.S. economy an additional $66.8 billion in productivity loss in 2007. This figure was estimated assuming an opportunity cost of $.04 to delete each of roughly 1.7 trillion annual unfiltered U.S. consumer spam messages received during non-business hours. The collective time spent deleting these messages could otherwise be allocated to non-primary work, volunteer work, education, or other activities that contribute to our overall economic and social development. Although the opportunity cost varies widely by person and is thus difficult to quantify, it is important to identify this problem and is reasonable to assume that the potential value of this lost time is as high as our primary working time.

    Thursday
    Nov202008

    Phishing for Beginners

    I came across a video that explains Phishing in an amazingly simple way. Check it out:

    Thursday
    Oct302008

    New Best Practices for Domain Registrars

    The Anti-Phishing Working Group (APWG) published a list of best practices for registrars of domain names that, if adopted, will make it harder for Phishers to register and use domains for fraudulent purposes.

    I found the most interesting of these recommendations to "Share fraudulent domain registration information with law‐enforcement". This may seem like a no brainer but a few difficulties arise when considering this recommendation.

    The first difficulty is that the information associated with domain registration transactions isn't often captured. In days gone by there was no need to store items like the originating IP address or the time it takes to fill out a form--to identify automated form-filling scripts--just to process a domain registration.

    The second difficulty is knowing an appropriate law enforcement organization to share the information with. In today's era of terrorism threats and homeland security the FBI for example doesn't have enough bandwidth to effectively deal with these types of investigations. An ideal group to deal with some of these communication based issues is the U.S. Postal Inspection Service. They have a long history of effectively countering communication based frauds and swindles. This expertise is one of the most exciting parts of the Electronic Postmark program.

    Another notable item is that the APWG is developing an accreditation process for Phishing site takedown providers. This interesting concept could go a long way to assisting expedient remediation of events when they occur. Unfortunately, a process like this doesn't help when it comes to prevention which I believe is where the real value lies.