Re: asrg - research or die

On Mar 20, 2013, at 2:21 PM, Dotzero <[email protected]> wrote:
>> 
>> Could you share those positive results? Actually, more importantly than
>> the actual results is what you decided to measure, and why.
>> 
> 
> I have shared those results at MAAWG, OTA, ISOI and other closed
> forums. I'm not in a position to make them public without sign off
> from my management - not in the cards because it involves disclosing
> some details which are considered sensitive.
> 
> Knowing you personally I'll reach out to you out-of-band.

No need - it was the choice of metrics that's the really interesting
bit right now.

> 
> As far as the metrics measured, we look at number of direct domain
> attacks (abusive mail claiming to be from one of our domains),
> (estimated) volume per attack, volume per attack dropped at domains
> providing rua and/or ruf reports, volume of submissions/use complaints
> to our customer service or security teams, (estimated) volume to
> mailbox providers not validating DMARC.
> 
> We also look at/model attacks abusing our domains/brands that are not
> direct domain abuse. This would include attacks where some other From
> email address is used but the display name abuses our domain/brand,
> attacks where the abusive content is only in the body of the message,
> etc.

Seems like a decent basis.

Cheers,
  Steve
-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org