How secure is your Internet connection?

Spam, or unsolicited e-mail, is sent indiscriminately to millions of recipient addresses around the globe every day. These addresses are often obtained illegally, through the tapping of network communications, by individuals and companies that specialise in creating e-mail distribution lists.

The problem with spam is it's far more than a time-consuming nuisance. Both users and their computers can be faced with very real security threats. Some e-mail spam is positively dangerous to handle. Usually, these messages contain the scams that try to get you to give up your bank details so the spammers can either withdraw money, or steal your identity.

The world's first known spammer was Gary Thuerk, known today as 'the father of spam'. In May 1978, he disseminated a product presentation for his computer company over the network of government and university computers, known as the ARPAnet, the forerunner of the Internet. The presentation was sent to 600 addresses - the entire ARPAnet user base - but software limitations meant only about 300 people actually received it.

From this early beginning, the amount of unsolicited e-mails has mushroomed. In 2005, there were around 30 billion cases of spam logged every day. This grew to 55 billion in 2006, and 100 billion last year (2008). Industry watchers believe the figure could easily top an average of 200 billion spam messages per day in 2009.

Despite the spam blockers available today from Internet service providers (ISPs), spammers still manage to break through these barriers.

Good advice is to be suspicious of any e-mail message that offers something for nothing. There's no such thing as a free lunch - there must be a catch somewhere.

Significantly, spammers are increasing their use of psychological tricks to persuade people to part with contact details, identity information and even cash.

They're also changing the nature of spam - to the point where it's barely recognisable - by using local languages and cultural nuances. Both of which are easy to employ in multilingual countries with ethnic diversity. Many of these attacks use an invented scenario to persuade someone to perform an action.

This technique - known as phishing - is often used to trick a business into disclosing customer information. The spammer pretends to be calling on behalf of a sales person or someone who has legitimate reason to access sensitive information, but who is 'unavoidably detained'.

Good advice is to be suspicious of any e-mail message that offers something for nothing. There's no such thing as a 'free lunch' - there must be a catch somewhere.

Mike Hamilton is MD of Channel Data.

More seriously, research indicated that a large percentage of spam e-mails carry dangerous viruses, while many allow malware to be silently installed on users' computers by persuading participants to surf unsafe Web sites.

According to a separate report from a US market researcher, eight out of 10 spam e-mails examined contained covert tracking codes, enabling the sender to record and log recipients' e-mail addresses as soon as a message is opened.

One of the largest anti-virus software and intrusion protection companies says popular scams focus on the current global recession by offering bogus, pre-approved loans or 'free' credit cards.

There is little doubt spam is becoming more closely linked to the broad spectrum of cyber-crime which, like any form of crime, will be with us for many years to come. It's no longer a question of resolving the spamming problem, but of managing it with ever more sophisticated ways.

From a technological perspective, it is important to determine the role the ISP intends playing in helping to stamp out spam and cyber-crime, before signing up for the service.

For example, it's vital to ascertain whether the ISP has a formal security policy in place - and if it is enforced. Find out what measures are taken by the ISP to prevent data traffic from taking unauthorised routes into or via the network.

It might be wise to dig even further and quiz the ISP on a more technically advanced level. Determine whether the ISP's own network infrastructures that support the Internet connection are segmented by means of 'virtual' networks or non-broadcast networks. If they are, these will act as firebreaks to halt the uncontrolled spread of viruses or malware.

Notwithstanding, the ISP should be able to outline the measures taken to protect Internet-linked computers from such malicious threats as denial-of-service attacks, break-ins and spoofing.

Finally, check with the ISP about reporting methods for suspected or actual security incidents and what response is expected in real-time.

If the company has access to a tame hacker, challenge the ISP by asking whether the company would allow its host and network security to be tested by mounting a deliberate attack at a mutually agreed time. The answers might be interesting.

* Mike Hamilton is MD of Channel Data.