Establishing Digital Trust: Don't Sacrifice Security for Convenience
The Carnegie Endowment for International Peace, a Washington, D.C.-based non-profit agency focused on promoting cooperation between nations, was under siege itself. The agency and its 120 employees were being slammed with spam -- individual boxes receiving 100 or more a day, says Michael O'Brien, the agency's director of information technology. And viruses, O'Brien adds, were a constant problem, with new ones worming their way into the network just as they got rid of the old ones.
But that was a little more than a year ago.
Today, spam has dried up down to a trickle and a virus making its way onto the network is a rare occasion. And O'Brien says it's all because he switched email servers.https://o1.qnsr.com/log/p.gif?;n=203;c=204650394;s=9477;x=7936;f=201801171506010;u=j;z=TIMESTAMP;a=20392931;e=i The Endowment used to run IBM's Lotus Domino on the backend and Netscape Messenger on the client. It was all running in an NT environment. O'Brien says they have 14 NT 4.0 servers and about 120 desktops running Windows XP. And with an IT shop of only four people, O'Brien says one of them was basically dedicated to the messaging software -- dealing with problems, fending off spam and just keeping it running.
``One of the things with Domino is that I was spending nearly all my time administering it,'' says O'Brien. ''It's a very, very complex program. That's real money you're spending when you have someone dedicated to that.''
And the amount of time he was spending administering Domino was just one of O'Brien's problems. His big troubles sprouted from the deluge of spam and viruses that he was being hit with.
''Being an international organization, we had a terrible problem with spam,'' says O'Brien. ''If you're dealing with people in Cedar Rapids, Iowa, that's one thing. The second you start dealing with people in places like Russia, it gets really bad. We were getting thousands of email messages a day here. We weren't blocking anything. We had no means of blocking spam. It was terribly disruptive.''
Disruptive and time consuming.
O'Brien says workers at the Endowment were constantly being interrupted by the arrival of unsolicited commercial email. And getting rid of it broke their concentration and work flow, and often offended, as well.
And the viruses were not only disruptive. They were damaging.
''I was having a horrible time with viruses,'' says O'Brien. ''We were getting hit with viruses constantly. We had one virus where we had to go around and unplug every computer. We spent days cleaning those computers. It killed our productivity but we had to stop it from spreading.''
O'Brien says he knew they had to make a switch. And he decided on migrating to Gordano Ltd.'s NTMail, an Internet messaging server that runs on Microsoft Corp.'s Windows NT platform. Convincing his bosses to spend the money with, and depend on, a small company based in England was the next step.
''They hadn't heard of Gordano before,'' says O'Brien. ''It wasn't the easiest sell. No one ever gets fired for buying Blue. But if it's a small company from England, people are going to be more suspicious of the decision you make.''
O'Brien says he told his bosses that if they went with any of the big email products, like Exchange or Groupwise, they'd have the same problems.
''People like options. I like options,'' he says. I wanted something that was standards based. The big three work with standards but they're not truly standards based. I didn't want any bizarre problems with other software.''
Executives at the Endowment backed up O'Brien and forked over about $12,000 for NTMail and gave O'Brien two or three months for testing.
Stephen O'Grady, an analyst at Nashua, N.H.-based Illuminata, says more and more companies are starting to look beyond the major players when they choose email products.
''Traditionally, Exchange and Domino have been big sellers but a lot of administrators are starting to look at the overhead attached to dealing with some of the problems that come with them,'' he says. ''Today, they can be configured to filter, but some of the smaller and newer players are preying on the historical problems they've had. They're working hard to give people what they haven't had.''
And what O'Brien isn't having now is a problem with spam and viruses.
''Since the day we implemented NTMail, I haven't had one virus,'' he says. ''NTMail has a feature that blocks certain types of attachments. I couldn't do that with the Domino version I had. Almost all of those viruses -- Code Red and Nimda-- come with attachments. If you block those attachments, the viruses just can't get in. We also have a virus scanner but we probably only get one or two a month after we knock out all the attachments.''
And the ability to filter is also what's cut down on the amount of spam coming in. O'Brien says he simply enters in key words and phrases that generally appear in spam subject lines and it blocks out much of what was bothersome.
Filtering should be a key part of every company's security plan, according to Dan Woolley, a vice president at Reston, Va.-based SilentRunner Inc., a wholly owned subsidiary of Raytheon.
''This guy has extended his security layers,'' says Woolley. ''Security is all about layers. As you lay more security devices in place, the greater your security. He found a way to block viruses and worms by changing mail providers and that's improved his security and his services.''
O'Brien says he's improved his agency's security but he's also discovered that he has a lot more time -- time that he can use working on projects other than email.
''The migration has paid for itself already,'' he says. ''This basically runs itself. We can go weeks without having to do anything to it. Now I'm able to do other things. Our customer service wasn't where I wanted it to be. I wasn't able to give my attention to certain management issues that I can now. I'm more present as a director to supervise projects and just do other things.''