Connection Control - Work Smarter, Not Harder, To Stop Spam

IronMail offers the most sophisticated and precise detection of spam available. However, given the ever-growing volume of spam that enterprises must deal with, blocking the bad while allowing the good is a job that demands constant innovation and dedication.

IronMail Connection Control is just such an innovation. Connection Control combines two critical protection technologies: traffic shaping and reputation services to dramatically increase the message handling capability of IronMail, thus reduce the cost of fighting spam.

How Connection Control Works

Traffic shaping is the “throttling” of incoming network traffic based upon certain characteristics. In this case, it refers to deciding whether to accept incoming connections to a mail server, i.e., accepting messages from a sender. The secret to success becomes integrating this approach with a sophisticated measure of sender quality. The process follows, from the arrival of spam from a new sender:

Message arrives from IP @ “bob.spammer.net.” Message Profiler scans and blocks. TrustedSource (local and global) updated.
More messages arrives from IP @ “bob.spammer.net.” Message Profiler scans and blocks. TrustedSource (local and global) updated. Connection Control threshold reached.
More messages arrives from IP @ “bob.spammer.net.” Connection Control rejects connections.
After a designated period of time, Connection Control resets and the process repeats
Message arrives from IP @ “bob.spammer.net.” Connection Control allows. Message Profiler scans and blocks. TrustedSource (local and global) updated.

Key Benefits and Functionality

Our customers report that Connection Control has reduced spam volume entering IronMail by an average of 50%, and can go higher if a greater proportion of spam originates from only a few spamming entities. This significantly reduces the workload on IronMail and increases efficiency and scalability without requiring faster processors or additional appliances.

Global Intelligence, Local Protection

Connection Control uses message scoring from IronMail’s Message Profiler to create a local reputation database of senders to identify spammers – along with global sender reputation data from TrustedSource Reputation Service – and then dynamically limits or rejects messages from offending senders. The result is the highest performance in the industry and the best return on investment for our customers.

Change the Economics of Spam: Offense or Defense

Administrators can decide whether to take an offensive or defensive posture with spammers targeting their servers:

• Defense – Messages from violators are rejected at the gateway, providing the maximum performance benefit.
• Offense – Turns the tables on spammers by accepting a connection, but slowing the flow of e-mail to a handful of messages per hour. This forces spammers to expend more effort and makes domains protected by IronMail very unprofitable targets for spammers.

Change the Economics of Spam: Dynamic Connection Rejection

CipherTrust researchers determined that rejecting connections from known spammers for pre-defined intervals could significantly reduce the amount of spam that must be fully inspected and analyzed. Connection Control identifies and rejects connections from targeted IP addresses to limit the number of messages that reach IronMail and restrict the resources available to the offending IP. By relying on data gathered by the IronMail global network, CipherTrust research has determined the optimal intervals to reject and allow connections.

Integration with other Key IronMail Technologies

• Anomaly Detection Engine – Examines and controls overall traffic flow for IronMail to identify threats.
• ThreatResponse – The IronMail global network comprises over 4000 IronMail units protecting over 7.5 millions enterprise e-mail units. The TRU system provides data and updates to IronMail units as often as in real-time.