MODEM MEDIA, NORWALK, CT

Using  MIMEsweeper & Sophos to control email

Founded in 1987, Modem Media provides Internet strategy and end-to-end Me-business solutions to Fortune 100 companies and Internet start-ups. As an Internet pioneer, Modem Media has been a driving force in the digital economy. The Company's award-winning Internet-related services include strategic planning and consulting, engineering, visual and information design, media distribution and project management. With more than 960 professionals worldwide, Modem Media's global presence includes its headquarters in Norwalk, CT, and offices in New York City, San Francisco, Toronto, London, Paris, Munich, Tokyo, Hong Kong and São Paulo. Modem Media has created customer-focused Internet solutions for global brands such as Citibank, General Motors, Delta Air Lines, General Electric, IBM and JCPenney.

The company relies heavily on email for communications, supporting some 1,500 people around the globe. The email-centric nature of the company generates huge volumes of internet mail, averaging 50-60,000 messages per day with peaks of up to 100,000 messages.

A good proportion of email traffic was found to be potentially threatening and the company was receiving a large amount of spam mail, so a project was put in place to begin filtering email content. Modem Media worked with ReSoft International to implement a solution based on the MIMEsweeper product.

The MIMEsweeper Mailsweeper for SMTP product was installed and integrated with the Sophos anti-virus tool on a Compaq server with dual 600mhz processors, 512 megabytes of RAM and 3 x 18 gigabyte raid drives in the company's datacenter in Norwalk CT. MIMEsweeper was deployed as an SMTP relay host between the company's firewall and the Exchange Internet Mail Server. All internet inbound and outbound mail was then routed through the MIMEsweeper filter.

Various email filtering policies had to be developed that reflected the company's email policies. MIMEsweeper in conjunction with the Sophos anti-virus tool was configured to scan for viruses on inbound & outbound email. If a virus was identified the Sophos product would attempt to clean it so it could be delivered to the recipient if possible. If the virus could not be cleaned it would be moved to a quarantine area for manual inspection.

A File type policy was set up to block certain attached file types that may be threatening such as .exe and .vbs files. Legal disclaimer text developed by the Legal department was added to all outbound email. A keyword scanning policy was developed to look for spam-related keywords.

"MIMEsweeper & Sophos catch a good number of threats at the front door" says Eric Preston who is responsible for Modem Media's email systems. "When we are alerted to new viruses in the wild, we can very quickly set up for MIMEsweeper to quarantine items with attachments that have the characteristics of the new virus. This gives us breathing room to wait for the virus pattern to be updated at which point we can pass the previously quarantined items back thru the anti-virus process. "In the case of the Iloveyou virus we were able to set up a block based on a keyword search of the subject name while waiting for virus pattern updates".

In terms of results, the Spam keyword filter is catching over 1,000 messages per day which are being quarantined. Typical search terms include "Joke of the Day, You can win a brand new...., Make $$$ on the Internet". These mail items can then be manually scanned and deleted or released depending on their content. Similarly, the system is catching up to 25 viruses per day, including continuing iterations of the I love you virus!.