How to explain to a customer that spamfilters don't catch everything

Question

I used to work in a small office which provided basic desktop support for users.

One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one email slip through their spam filter/network-based antivirus software (if there is such a thing, that's what he claimed), and the attachment got filtered/caught by the antivirus software on his desktop.

Till I could reach my boss I had to tell him that a spam filter is not flawless/perfect and sometimes one email mange to pass.

Also to support my claims, I explained to him Gmail themselves allowed that email to attachment despite that his antivirus software had detected and removed it.

Was my explanation right? How would a security expert deal with this situation?

Answer 1

Your answer is pretty OK, but you could explain the ongoing "game" between spammers and spamfilters a bit more. This makes it understandable why some spam always will find its way to the customer.

Spam filters try to catch all mail that is spam.

Spammers try to create mails that are trusted not to be spam - both by spam filters and by humans.

For spammers, this comes down to creating mails that...

1. can pass spam filters;
2. when arrived in the inbox look like legit email so the user opens it;
3. and then is interesting enough so users click on the link inside to buy something or have malware installed.

Spammers buy spam filters, and test their new spam tactics to see if their mail passes the filter. If the mail passes, they are one step ahead. Then they go out in the wild, send out millions of mails, effectively showing their new tactic. The spam-filter makers notice, and they update their filter. This is an ongoing game. It's similar in the virus industry.

When you see spam that has no links or attachments, it is probably spam to poison filters, to confuse filters, to make it easier to fool them later on.

Answer 2

The main function of a SPAM filter is to block anything that looks like a SPAM. The objective of an anti-virus software is to detect and remove anything that possess the signature of a virus (worms included) based on the virus definition installed. Both programs work differently based on different heuristics.

An email that doesn't look like a SPAM may contain a virus. You can't realistically expect a SPAM filter to perform the job of an anti-virus since that is not its primary task. And even with an anti-virus software installed, it is never a foolproof method to eliminate all kinds of virus.

If your SPAM filter keeps a log of the emails that have been blocked, then maybe you can appease your client a bit by showing the unseen good work it has done.

Answer 3

I like to use the analogy of an arms race as it's a familiar theme that non-technical people understand. Analogies are useful when trying to explain concepts such as this. Also throw in statistics. Last, use some pseudo-personal stuff to make them feel like you're in the same boat. Something like this may work:

I completely understand your frustration with spam, I myself get at least 30 spams a day, and although almost all get picked up by the spam filters the occasional one makes it by and dirties my inbox. Spam is an arms race where spammers invent new ways to get around the filters which security companies build. When a filter gets updated to block the latest stratagems the spammers go back to work to find another way to get around it. While the security companies are smart so are the spammers, so no matter how good filters are some spam is going to get through. 130 Billion spam emails are sent every day using hundreds of different ways to fool filters and even with the best technology from some of the finest minds in the industry some will make it through.

Answer 4

A spam filter can be created that will block all spam; one could simply have the filter block all incoming email. Most users would find such a filter unacceptable, though, so the challenge is to find a balance between blocking email that users don't want to receive, but at the same time allowing through all the email they want to receive. If the filter is very strict, there will likely be false positives and email they would consider legitimate will be blocked. If a relative or friend of the user sends an email that has some characteristics typical of spam messages a strict filter may block it whereas a filter with more loose settings may allow it through.

So should the filter be very strict or less strict? Different users may have different views on the matter. Some may prefer to have less strict settings so that no legitimate email is blocked, but that means more spam gets through. Some may hate spam so much that they are willing to trade off the possibility of legitimate email being blocked in return for getting less spam. A company dealing with a large number of email users may have to pick a moderate level of filtering that applies to all users so that some spam gets through, but, hopefully, resulting in few false positives. But there is always a tradeoff between blocking spam and false positives that block legitimate email.

And as others have mentioned, spam purveyors are constantly trying to outwit anti-spam filters. E.g., one spam detection method is to block email that exactly matches known spam messages. After email service providers started comparing incoming email to known spam and blocking any email messages with content that matched known spam, spam purveyors just started inserting random words in the body of their spam email, often in text invisible to users by having the color of the text match the color of the background for the message, e.g., white text on a white background, so that spam filters could no longer rely on exact matches against known spam messages.

And users should understand that antivirus software won't catch all viruses as soon as they are released by virus developers. Virus developers are also constantly striving to outwit antivirus software. In a December 2013 press release, Kaspersky Lab, an antivirus vendor, reported that Kaspersky Lab is detecting 315,000 new malicious files every day. They reported that the number for the prior year was 200,000. If a user is unlucky enough to be among the first to receive a file containing a newly developed virus, not all antivirus vendors may be aware of that particular virus at the moment he receives it and so may not have a signature for the virus in their software. Suppose two new viruses are released, x and y, antivirus vendor A may be aware of virus x, but not y, whereas antivirus vendor B may be aware of y but not x. If someone is using vendor B's antivirus software, he may be protected from virus y, but x may get through and infect his system, if he is not cautious and opens a file containing it.

Answer 5

The explanation I have always used is the analogy of "Why did my bullet proof vest not stop that bullet?" is because the bullet proof is a misnomer, and someone simply used a bullet designed to defeat your bullet resistant vest ;) Most people seem to get that concept that it is a balance of too tight (false positives restricting mail flow) and too loose (spam flow over flowing business resources) and at best it is a MOVING target.

No one setting will catch something when someone can automate testing your defenses at the same rate or potentially faster than your defenses can adapt.

Their are ultra strict methods of doing things like stripping all attachments, queuing them, and holding them in quarantine for x days, but they are more a PIA to manage than just good common sense mail handling and educating end users... THAT is the only defense to scam tactics that is even a decent defense, end user education.

Answer 6

I think your answer is correct.

Nothing is 100% bullet proof. That is why the user has to have some awareness and some knowledge to understand when and how things look strange and what to do next. (this last part is forgotten and people tend to trust too much in applications) That is why those situations occur, people discover that applications are not 100% efficient. :)

Answer 7

You were right in your explanation. In trying to relay the issue, I would try to explain in less technical terms. Non-tech people don't like, and will have problems understanding technical explanations. So try to avoid them. Especially when they're already upset.

I like to use cars. In this case, spam filters are like looking at a car. A look at the car will reveal the make and model. So something like 'don't allow GM cars in' seems easy. What if a mechanic took the body of a Ford and put it on a an GM car? The GM car would look like a Ford car and visually it would be allowed. More detailed looks could be made by say looking at the engine or the interior. However, the engine and interior can be customized. How do you identify a GM when most of what could be used to identify it could be falsified by a good mechanic?

Answer 8

The email spam filters are not 100% effective, that's a fact and you said it correctly. As their name suggests they are filters, if something doesn't match the filter, it slips through, but that is why there are multiple levels of security used while receiving an email. Therefore if one fails, there are more checks being performed. This time it got caught by the antivirus software. People love hearing about multiple levels of protection. Besides that, if the customer now understands how filters work, you can tell him that thanks to the fact he/she reported the problem, you guys will be able to adjust the filters so they will no longer let through similar emails and therefore making the system ever so secure.

Answer 9

OH MAN am I glad that I no longer have to deal with these.

I would explain how a spam filter actually works. Generally spam filters have a "rating" system (The one provided to our company by Google worked this way).

• The rating would go up if it matched known-patterns
• The rating would go up if it matched known keywords (Many keywords related to drugs, pornography, and known phishing schemes)
• The rating would go up if many emails of a similar or same pattern were received across the system in a short period of time
• The rating would go up if attachments matched "risky" file types
• The rating would immediately hit 100 if it matched any corporate or user defined blacklist

The important caveats:

• There is typically no anti-virus built-in to a SPAM filter
• If a filter does have a virus scanner, no virus scanner in the world has a near-100% catch rate
• SPAM filters work off risk-assessment, typically a message is only considered spam if the risk is above some threshold. Our organization's threshold was 70/100.
• SPAM filters typically build definitions via repetition, the more unique the message received, the lower the assessed "risk"
• The more "personalized" an email, the more unique it is, and therefore the lower the assessed risk

The REALLY important caveats (which hopefully apply):

• SPAM filters are not 100% and never guaranteed to be
• Your company provides SPAM filtering as a convenience and nothing more
• Your users are responsible for maintaining their own security

Answer 10

Everyone is trying to explain the arms race, which is true, but there is the very simple logic that if spamfilters were perfect, then spam would not exist anymore because it's no longer profitable. And a spambox would not exist because we are 100% sure of what is spam and what is not, so it could go straight to trash without landing in a spambox first.

Since even Gmail has a spambox and receives spam, it should be pretty clear that, apparently, even Google can't keep all spam out. How could the customer ever expect you to do better than this multi-billion dollar business?

If they ask for technical reasons, you could explain it like this (another alternative for the arms race): people get spammed, the system detects the pattern, and the spam email will be blocked. But when the first spam email of its kind arrived (before a million identical ones), the spam filter doesn't know this one is spam yet.

There is more to it than that of course, but it's something pretty much anyone would understand.