Outsource e-mail, anyone?

Given rising complexities and security concerns, are those endless streams of e-mail best handled in-house or by someone else?

Can those endless streams of e-mail be best handled in-house, or is there a better way?

It seems like a long time ago now, but Australian companies were once happy to let individual employees deal with the mail that entered their inboxes. That was before the barrage of spam and viruses to those inboxes reached unmanageable levels. Research group IDC says more than 18 billion person-to-person e-mails were sent daily in 2003--a figure the analysts predict will double by 2006.

"Most of us were raised to believe that information is power, but people are now drowning in information. The majority of people are now spending between 25 to 50 percent of their day in e-mail," says Tony Hughes, managing director of enterprise software vendor Hummingbird.

"Up to three quarters of a company's know-how, and for many organisations that is their intellectual property, is buried in their e-mail system.

"By the end of next year over nine trillion messages will be sent globally. This is a horrendous problem and it will be very difficult to deal with."

Due to the huge increase in e-mail volume being handled by companies, IT managers are having to spend more of their time dealing with the problems of spam, viruses, storage, and archiving. One potential solution to the problem is the outsourcing of e-mail services. Advocates of e-mail outsourcing claim that it can reduce the amount of time spent dealing with company e-mail--allowing IT managers to get on with the running of their departments.

Such solutions offer up-to-the-minute virus protection, spam blacklisting, and archiving--as well as the option to have the e-mail server stored off-site.

According to research group Gartner, 80 percent of those enterprises with fewer than 300 staff could save money by outsourcing e-mail. The pros and cons
Before looking into outsourcing e-mail, it's important to be aware of both the benefits and the drawbacks of migrating to an outsourced model.

Organisations that have rejected the outsourcing model tend to cite questions of cost and data security as reasons enough to keep e-mail in-house.

The security, privacy, and integrity of an organisations' data is a major cause for concern--many IT managers and business executives would shudder at the prospect of handing over such vital data to an offsite entity.

These are legitimate concerns--the reality is that e-mail messages are stored, analysed, and then forwarded--providing several opportunities for a breach of security.

However, with a properly outfitted outsourcer, the messages can be analysed in real time and then forwarded, thus reducing the security threat to a large extent.

Also on the plus side, outsourcing the management of e-mail may actually result in reducing costs. Service providers cite the expenses involved in evaluating, purchasing, and managing security and anti-spam software.

They also cite the need to invest in infrastructure for archiving and storing e-mail in-house. Outsourcing these tasks can potentially lead to a reduction in infrastructure costs--as unnecessary messages are no longer stored.

More importantly, management overheads and system downtime costs can be eliminated--leaving the IT department to focus on strategic areas rather than spending time putting out fires.

"Companies do not need to invest in expensive hardware and software such as servers, high-end e-mail programs, licensing, and upgrades to licenses for software and security, network, server, and application administrators, certification, 24x7 internal staff, and so on," says IDC analyst Aprajita Sharman.

"E-mail outsourcing can offer economies of scale that would be difficult for organisations to get on their own. Companies are realising the importance of e-mail management as a managed service and vendors have succeeded in overcoming many of the barriers [that come with this]. It is important for organisations however to choose vendors who have security, ISO certifications and compliance," adds Sharman.

The cost of services provided vary depending on what features you need (spam-filtering, antivirus, and so on), and the number of e-mail boxes required. MailGuard, for example, charges a set-up fee of AU$199 (AU$1 is approximately US$0.8), and AU$1650 for up to 25 users--costing a small business a total of AU$1849 for the first year.

Who's out there?
MailGuard MessageLabs Webcentral
MailGuard is a non-invasive anti-virus and content filtering e-mail management service that also happens to be Australian-designed, managed, and owned.

MailGuard is supported by Sophos Anti-Virus, Norton Anti-Virus (Symantec) and McAfee (NAI).
MessageLabs provides managed e-mail security services for businesses. The company offers protection against threats such as spam, viruses, and other unwanted content before they reach customer's networks. ASX-listed service provider Webcentral offers a remotely-managed e-mail service (based on the Microsoft Exchange product) named Managed Exchange. It is designed to improve the reliability and accessibility of a business' e-mail system.
Features include:
  • no hardware, software or installation required
  • cost-effective
  • low maintenance
Features include:
  • e-mail threats (viruses, spam etc.) are intercepted and stored off the network
  • predictable cost -- requires no additional hardware, software or updates
  • easy and location-independent setup and administration
Features include:
  • inbuilt, comprehensive virus management
  • a range of access options for when staff are in or out of the office
  • daily backups to help prevent losing e-mail data to hardware and other failures
Phone: 1300 30 44 30
Web: mailguard.com.au
Phone: 02 9409 4360
Web: messagelabs.com
Phone: 1800 800 099
Web: webcentral.com.au
Evading spamsters
Outsourcing can reduce the additional costs associated with recieving and dealing with bandwidth-hogging, unnecessary spam e-mails. Spam has become such a problem that those organisations taking a proactive approach (such as using spam filtering technology) are not completely eradicating the unwanted e-mails. What is worse, the organisation is still paying for the bandwidth that comes with recieving the spam. Another advantage to the outsourcing model is having this cost passed on to the provider.

Using an outsourcing partner, staff can expect a lot less smut, a lot less offers for Viagra, and fewer e-mails asking if you need anything extended. While it might not completely eradicate the problem, it can potentially prevent the majority of spam from landing on your doorstep.

"One of our users did their own analysis on cost. They had an anti-virus, as well as anti-spam solution for 7000 users and it was costing them close to AU$5 million. Around 70 percent of their e-mails were spam," says Mike Bosch, managing director of e-mail security vendor Ironport Systems. "The newer systems have reduced administration and infrastructure costs. We can take six to nine servers and replace them with just one box, and cut down their ownership costs by around 75 percent.

"When it comes to small and medium businesses [using outsourcing], the main aspect they will save is time--and in this day and age that is one of the most important commodities of any business." One technique used by Ironport is preventative filtering. This method takes a look at any e-mail sender's IP address and cross-references it with a database, which has both a black and white list of senders.

"Someone you know who is a good sender will be put on the whitelist. The system doesn't even check it," says Bosch.

One of Ironport's customers, Dell Computer, used to recieve 26 million messages a day--only 1.5 million of which were legitimate, Bosch says.

"They had 68 gateways running Spam Assassin--but spam was still seeping through. We consolidated 68 down to eight boxes and thanks to our reputation filters managed to block 19 million messages. We didn't even open a connection to any of them, they were just blocked from even coming into the system. A further 5.5 million were scanned with Brightmail and blocked until [Dell] were left with their real mail."

Richard Moran, infrastructure manager at Australian services giant Theiss, says now that the company has started outsourcing its e-mail management system to e-mail outsourcing firm MessageLabs, he could never imagine going back to having an in-house system.

"Within days we were noticing a substantial drop in the number of spam e-mails we were receiving--saving us a fortune in bandwidth usage," says Moran.

"Anybody can drop onto the system and have a look to see if anything was captured and download anything that was relevant. But the system learns quickly and soon we were receiving mainly work e-mails. The other part of the system is the virus scanning aspect which as worked spectacularly. Our virus infection via e-mail is now virtually nil. I don't think we have had any virus by e-mail since installing the system. The savings involved there are astronomical.

"Savings of at least 20 percent on download traffic, as well as the time saved. Staff no longer have to wade through e-mails that aren't of use--that alone is worth the cost."

Note of caution
There are many questions to be asked of any third-party interested in handling your sensitive data--and charging you for the privilege. Before throwing yourself in the deep end, there are a lot of questions you will need to ask service providers to ensure that you choose the right provider, and the right service, for your needs.

One of your key priorities should be to find out where the data will be physically stored. Most reputable outsourcers would use data centres with high security and high availability, but certainly their offerings differ enough that some thorough research is required. Check, for example, that the hosting company is financially sound.

Be sure that the company providing the service has a proven track record--not just in hosting or application provision, but in providing a complete e-mail management service to customers of similar scope to your organisation.

Like any outsourcing agreement, you need to have clear goals in mind for what you expect to achieve--and these objectives need to be met under a service-level agreement with your service provider.

Most importantly, ask the big questions about what security measures that will be in place to protect the integrity of your data.

This article was first published in Technology & Business magazine. Click here for subscription information.