New security toolbar rates e-mail senders

March 15, 2006

Internet users have a new ally in the uncertain world of e-mail, as security vendor CipherTrust this week unveiled a toolbar for e-mail clients that lets users know how trustworthy the mail they're receiving is.

The TrustedSource Toolbar, which is compatible with Microsoft Outlook and LotusNotes e-mail software, checks each e-mail's sender against CipherTrust's database and gives users literally a green or red light.

"Our system monitors global e-mail traffic ... to figure out who the good guys are and who the bad guys are," said Paul Judge, CipherTrust's chief technology officer.

Judge explained that the toolbar looks at the sender's IP address and evaluates that IP's activity history in 24 behavior classifiers in order to decide how to rate the sender.

"The behavior classifiers try to figure out, is the sender's activity indicative of good mail senders or bad mail senders," he said.

Paul Stamp, analyst for Forrester Research, said that the toolbar has CipherTrust's long history of work in online security standing behind it.

"CipherTrust provides as good an assessment as anyone," he said.

Judge agreed, noting that CipherTrust's work with many companies, including over one-third of Fortune 500 companies, gives it a wealth of information to work with.

"Based on the IP, we are able to detect the basic probability of if the sender is reputable, without looking at the content of the message at all," he said.

Judge said that the TrustedSource Toolbar's computer-based method of determining sender security is a more efficient approach, given today's rapidly-changing Web technologies.

"In the past, there have been very manual approaches to classifying," he said. "Humans could not scale to keep up with (the changing technologies)."

Joel Caracciolo, advanced product development engineer for CipherTrust, noted that users not only get information from the toolbar, but also offer feedback if a sender is unverified or wrongly classified.

"The toolbar empowers the user to give feedback, which is often missing in the world of toolbars," he said.

Stamp said that given the dangers of spam and phishing, services like the TrustedSource toolbar can be valuable tools for users.

"There is never going to be 100 percent accuracy," he said, "but it can help users decide what to trust."

The TrustedSource Toolbar leaves about 25 percent of all e-mail volume as unverified, due to lack of information about the sender's IP, Judge said.

Judge said that CipherTrust is currently developing versions of the toolbar for mail services like Hotmail and Yahoo!. He said the company aims to provide the toolbar eventually for all email providers.

"We want to provide information at the point of first interaction, before the user has to go interact with the Web site," he said.

Stamp said he expects things to move in that direction, with security ratings like CipherTrust's eventually ubiquitous.

"I don't think we're too far off from that," Stamp said. He noted that spam has already become less of a problem than it used to be on large email services like AOL and Yahoo, as anti-spam technology has gotten more powerful.

Stamp said he believes that eventually, e-mail sender security verifiers will become like pop-up blockers, where "it will be harder to not have it than to have it," because it will come bundled with other software.

Copyright 2006 by United Press International