Re: Moving forward ...

There's more stages than that -- you can do all kinds of 
blocking/filtering and even alteration of the traffic at the network 
level, before you even get to the MTA.  Think of a bad-ass active IDS 
system which is sniffing the network traffic, possibly re-assembling 
packets, and then hijacking "bad" network connections to either shut 
them down, or do something else with them.  This could happen, say, mid 
SMTP conversation when the IDS suddenly realizes someone's trying to 
blow out a MAIL FROM buffer or something.  Or maybe it'll happen in the 
middle of a DATA section, when the IDS recognizes some malware 
signature which is designed to actually attack the MTA or MDA itself.  
It could then take over the connection, end the DATA cleanly and want 
to notify someone that it did so...

Not sure how this fits in with the 3 phases you're describing Jesse -- 
are those layers temporally separated?  Are they ordered?  I can 
picture situations where you'd want to do AV before archiving, but can 
also picture the opposite.  I can even picture situations where 
personal rules should trump administrator-defined Protection or Policy 
decisions (eg if mail's going to Craig, don't spam filter it, cos he 
actually works on spam, and wants that crap).

C

On Feb 26, 2004, at 11:52 AM, <[email protected]> wrote:

> [snip]
>
>>
>> There are two possible outcomes from this, since one
>> presumably wants virus scanning to occur before the MUA gets
>> its mitts on it:
>>
>> 1. You can't train spam filters on viruses/worms/etc. The
>> probable corollary is that it's going to be a given that
>> virus/worm content should be removed from the mail stream
>> when detected. It shouldn't even get to the spam filter.
>>
>> 2. Spam and malware filtering must happen at the same time,
>> before the user has the opportunity to be stupid. Once again,
>> viruses, etc., must be removed from the mail system before
>> delivery, regardless of spam tagging/processing.
>
> I see the message filtering happening in 3 phases (not all networks 
> will
> have all 3 levels).
>
> Forgive the alliteration, I sometimes have to deal directly with our
> marketing groups :)
>
> 1) Protection - MTA/MDA - implemented by administrator
>   - malware
>   - UCE/spam filtering
>
> 2) Policy - enforce communications policies (MTA or MDA)
>   - content policy
>   - archiving
>   - ...
>
> 3) Preference (MDA or MUA)
>   - personal rules
>   - personal bayes filtering
>
> Each level may remove items from the mail stream, or add data to the
> messages for consumption later down the line.
>
>
>>
>> Karl B.
>> Drexel University Postmaster
>>
>
>
>