SOE Technology Services SPAM Firewall FAQ

I am happy to announce that the School of Education and College of Health Sciences have just purchased a new Barracuda SPAM Firewall to intelligently detect and dramatically prevent spam messages from reaching the GroupWise servers. Barracuda firewalls are one of the best anti-spam filtering devices in the world!  All GroupWise accounts are now being protected against SPAM.

Each email message goes through 10 layers of tests to determine if it is SPAM. It is designed to be as unobtrusive as possible. When the Barracuda firewall knows that a message is 100% spam, it blocks it so you do not have to waste time deleting it. If the firewall is not 100% sure a message is spam, it will be quarantined for your review. You will automatically receive an email if any messages become quarantined along with instructions on accessing the quarantine.  Below are answers to some frequently asked questions.  If you have any other questions, please email support@uwm.edu.

Frequently Asked Questions

1. How do I check my quarantined email messages?
2. How does the Barracuda SPAM firewall work?
3. How does the SOE Barracuda SPAM firewall differ from the UWM campus spam filters?
4. How well does the Barracuda SPAM firewall work?
5. What if the Barracuda SPAM firewall isn't 100% sure an email message is spam?
6. What is whitelisting and blacklisting and how does it work?
7. What happens if someone's email is blocked by the SPAM firewall?
8. Can I disable SPAM filtering if I don't want it?
9. What happens if I also turn on the campus spam filters?
10. Why are some legitimate email messages containing attachments being quarantined?
11. Can I disable the Barracuda SPAM quarantine?

1. How do I check my quarantined email messages?

When your first email message is quarantined, you will receive an email from the Barracuda with instructions on accessing your personal quarantine area to review your email messages for spam.  If you accidentally deleted the email, you may visit http://cuda.soe.uwm.edu:8000 and request a new email be sent to you.  Just enter your full email address as your login.  Then click the link provided in the email message to access your quarantine.

2. How does the Barracuda SPAM firewall work?

The Barracuda spam firewall sits in front of the GroupWise servers accepting all email messages from the Internet.  It then scans them for viruses and spam.  Allowed messages are then delivered to the GroupWise server.  Each message goes through 10 layers of tests to determine its spam probability.  A few of these include:

• Real-Time Blacklists - Barracuda Central maintains lists of the known largest spammers.  These lists are automatically updated in real-time as new spammers emerge.  Email from spammers on the blacklists are automatically blocked.
• Email Keyword Scanning - The Barracuda firewall looks for certain keywords such as 'viagra' and uses a rating criteria and threshold to determine spam likelihood.  An advertisement selling viagra would look very different than a study about viagra and the emails would be rated accordingly.
• Checksum Technology - Barracuda Central monitors email traffic through the Internet and uses checksum technology to keep track of the number of times a particular message has appeared on the Internet. If a message has appeared very broadly, it would be categorized as known spam. Checksums of known spam messages are utilized by the Barracuda Spam Firewall to block spam messages.
• Message Authenticity Checking - Several algorithms are utilized to verify the authenticity of a message. Some of these are simple checks to verify that the "from address" is authentic. Some are more complex relating to the SMTP protocol.
• Blacklists & Whitelists - Domains, IPs, and email addresses can be blocked or whitelisted (allowed through). These lists are maintained on a per-user basis and a full system basis.
• Bayesian Algorithms - Bayesian filters are personalized to each user and adapt automatically to changes in spam. To determine the likelihood that an email is spam, these filters use Bayesian analysis to compare the words or phrases in the email in question to the frequency of the same words or phrases in the intended recipient's previous emails (both legitimate and spam).
• Intention Analysis - Email messages are scanned for links to known websites promoting spam.

3. How does the SOE Barracuda SPAM firewall differ from the UWM campus SPAM filter?

The SOE Barracuda SPAM Firewall is very effective at combating spam because it is fast and extremely accurate.  The number of spam messages that slip by the SPAM filter is very small and the number of false positives is phenomenally rare.

The UWM campus anti-spam filter only uses a static set of widely-available rules to determine if an email message is spam.  Since these rules are well known throughout the Internet community, they are also well known to the spammers who have learned to defeat these rules.  Continually updating these rules to defeat spam would require a dedicated full-time team of staff.

SOE has purchased a cutting edge spam firewall along with a 3-year subscription of hourly updates so a dedicated team at Barracuda Central can continually modify rules and improve spam email detection.  Along with the anti-spam rules are many other types of intelligent technologies to combat spam.  See question #2 for more detailed information.

The SOE Barracuda firewall also employs Bayesian rules that can be personalized by each user allowing you to "teach" the Barracuda firewall and personalize it for your needs.  In addition, we allow you to add your own custom whitelists and blacklists again custom tailoring the Barracuda's behavior.  Our SOE Barracuda firewall will be enabled for everyone by default so there is no need to activate spam filtering.

4. How well does the Barracuda SPAM firewall work?

The Barracuda SPAM firewall is extremely accurate.  While it is very aggressive at fighting spam, it is also conservative erroring on the side of caution.  It would rather deliver a spam message than block a legitimate message.  Barracuda Networks has received many awards and is considered to be one of the best anti-spam appliances currently available.  Between 12/18/04 and 1/18/04, the SOE Barracuda SPAM Firewall has scanned nearly 170,000 email messages.  Here is the breakdown:

5. What if the Barracuda SPAM firewall isn't 100% sure an email message is spam?

After an email message goes through its 10 layers of tests, the Barracuda SPAM Firewall assigns it a spam probability number.  If Barracuda is 100% sure the email message is spam, it will be blocked.  You'll never see blocked messages so you won't have to waste your time sifting through these spam messages.  When Barracuda is about 50%-99% sure a message is spam, it will quarantine the message.  Quarantined messages are saved on the Barracuda firewall for your review.  See question #1 for accessing the quarantine.  If the Barracuda is less than 50% sure a message is spam, it will tag the message by adding "[BULK]" to the subject line and deliver the message to GroupWise.  A good example of an uncertain message might be an email from Amazon.  The Barracuda sometimes has a difficult time knowing whether an email from Amazon.com is a receipt of purchase or an advertisement.

6. What is whitelisting and blacklisting and how does it work?

Whitelists are lists of email addresses you always want to receive email from.  Email that you "whitelist" does not get tested for spam although it will be scanned for viruses.  You might, for example, whitelist a company you conduct business with if you want to receive their regular advertisements and not worry about the Barracuda quarantining messages from them.  Tip: It isn't recommended to whitelist uwm.edu.  While the Barracuda will give special consideration to email from UWM, spammers often use fake uwm.edu email addresses hoping to bypass spam filters.  They won't bypass our filters by faking their address, but they will bypass yours if you whitelist uwm.edu.

Conversely, blacklists are lists of email addresses you never want to receive email from.  Email that you "blacklist" is automatically blocked whether or not it is spam.  On rare occasion, the Barracuda might not catch spam messages from a particular sender.  In this case you could blacklist the email sender.  Blacklisting is not always effective because not only do many spam senders fake their email address, they will often change their email address after they spam a bunch of people.

To add/delete email addresses from your personal whitelists and/or blacklists, visit the quarantine and click the Preferences Tab.  Then click on the Whitelist/Blacklist sub-tab.  Please visit question #1 if you need assistance accessing your quarantine.  See the figure below for more information.

7. What happens if someone's email is blocked by the SPAM firewall?

If the Barracuda SPAM Firewall blocks a message someone sends to you, they will automatically be notified by email that the message was blocked.  A "false-positive" where legitimate email is mistakenly blocked, is extremely rare.

8. Can I disable SPAM filtering if I don't want it?

Yes!  Its our intent to make the SOE Barracuda SPAM firewall work for everyone and we will do what we can to make it work for you.  But we also understand that there may be such an unusually exceptional need that warrants disabling the SPAM filtering.  In this scenario, you can either contact support@uwm.edu to have SPAM filtering disabled for your email account or you can disable it yourself by visiting the quarantine.  See question #1 for assistance with accessing the quarantine.  Once inside the quarantine, visit Preferences -> SPAM Filter Enable/Disable.  From there, you can disable the spam filter.  Note: Virus checking email messages will still be activated and cannot be disabled.

9. What happens if I also turn on the campus spam filters?

If you turn on the campus spam filters, the Barracuda has a little less work to do!  We don't recommend enabling the campus spam filters for a couple of reasons.  First, it makes troubleshooting email delivery problems more difficult if any should arise.  Second, when you activate the campus spam filters, you'll need to check all that spam in your PantherMail account.  Third, you increase the likelihood that legitimate email messages will be trapped by the campus spam filter before it makes it to the SOE Barracuda SPAM Firewall.

NOTE: You may need to turn on the campus spam filters if you don't forward your messages to GroupWise or use PantherMail to check your email.  Contact support@uwm.edu for assistance.

10. Why are some legitimate email messages containing attachments being quarantined?

The Barracuda will automatically quarantine messages that have attachments containing executables for security reasons.  These are the attachments that can execute or run on your computer potentially causing the most problems.  Although every attempt is made to scan for viruses at the campus level, department level, and at the computer, new viruses appear all the time that may not be detected.  The extra step of visiting the quarantine will help ensure that you choose to accept the message before it is delivered to your inbox.  From the quarantine, simply click "deliver" and the message will be delivered to GroupWise.

11. Can I disable the Barracuda SPAM quarantine?

Yes!  If you find the quarantine inconvenient, you can disable it.  Email messages will still be scanned for spam likelihood.  Messages that are 100% spam will be blocked.  Messages that would ordinarily be quarantined,  would instead be delivered to your inbox with "[SPAM?]" added to the subject line.  Advanced users can create GroupWise rules to move those tagged messages to a spam folder if they desire.