Scora by Tiki Technologies Corp.

v1.4 2/16/2004

Product Overview & Description of Key Features For release 4.9.2, 2/2004

Purpose of this Document
This document presents key features of the Scora system to System Administrators and IT Managers implementing Scora. Scora is an email filtering service built to address the growing problem of email intrusion, including blocking unwanted emails ("spam") and email-borne computer viruses. Businesses and organizations with their own domain names for email can purchase the Scora service for effective and flexible control of this growing problem. An extensive user help manual about how to use the features described below can be found online as part of the Scora graphical user interface (GUI). This overview is meant to give you background on what the features are, so that you can make an informed decision about how and when to use them (or not).

ROLES
The Administrator: The Scora service is set up and maintained by an "administrator"-the person(s) who configures and maintains your email server(s). This person is in charge of the domain-related settings required to direct your domain name's email to the Scora service. The administrator also configures the Scora system, (including filtering strength), responds to end-user requests for white list entries, releases email from quarantine, and adds or deletes end-users.

The end-users: End-users are the recipients of the email filtered by Scora. End-users do play an important role in the effectiveness of the Scora service. End-users are asked to (as desired): report to Scora headquarters any missed spam (false negatives) that made it through the filters. End-users will also ask the administrators to retrieve and deliver valid messages misidentified as spam (false positives), which show up in their optional quarantine reports, or request white list entries so that emails from trusted parties (be they email addresses, domains and/or IP addresses) can be delivered regardless of their spam probability scores.

ABOUT THE Scora SERVICE
Scora is in a class of filtering technologies known as a "Gateway Service"-the customer uses Scora as a barrier between their email server and the Internet. All mail that arrives from the Internet destined for an address at the protected domain name is subjected to a rigorous set of tests and scoring. The emails are then handled according to the preferences set for the domain name by the administrator (or by the system default settings, whichever are used). Scora was built to improve on the "one size fits all" approach of most filtering software. By allowing the administrator to customize the right thresholds and the right email delivery dispositions for his or her organization, Scora responds with ease to diverse and demanding customer requirements.

Acting as a protective barrier between your domain email and the Internet, systems like Scora are far more effective than desktop filtering (where all email is sent to the end user and filtered by their workstation). By delivering only valid email to the user desktop, the load on the mail server and/or end user workstations is greatly reduced, the chance of infection from viruses is diminished, and the efficiency of the people reading email is greatly increased.all of which goes right back to the bottom line for any business or organization.

The heart of Scora is a set of tests ("rulesets") that help the system determine the likelihood that a given email message is intrusive. Scora uses a combination of open source and proprietary software and rulesets. Using proprietary methods developed by Tiki Technologies, the system combines the conditional probability of each of the individual tests and arrives at an overall estimate that the message is intrusive (spam or a virus). The resulting probability is expressed as a percentage between 0% and 100%. Using this probability, administrators can set tolerance thresholds for the disposition of email.

KEY FEATURES

General Settings

• what the feature does: Used to set the basic parameters of a single domain profile on Scora.
  
• when it may be useful: This is the first step in the setup process. Without this section being filled out correctly, the Scora service cannot filter email for the domain!
  
• when it is probably not needed: If a "default configuration" option is applied, these fields will be set to the default settings. If no adjustments are needed to the default configuration, that is the only time this section may be skipped entirely.
  

Pre-Filter Blocking

• what the feature does: Uses a set of "domain blacklists" (DNSBLs) to reject email from known spam sources without filtering or delivery.
  
• what it doesn't do: Does not keep a record of what was rejected, nor guarantees against missing valid emails sent from domains listed in a DNSBL (they are erroneously listed from time to time).
  
• when it may be useful: A highly useful and widely employed method for limiting the network impact of spam. If you get a very large volume of unwanted email, we do recommend turning this feature on.
  
• when it is probably not needed: If your organization cannot tolerate the possibility of a rejected and undelivered valid email, do not use this feature.
  

User List

• what the feature does: Tells the Scora system the email names of your valid users, allowing the system to protect these addresses. Email arriving for any email address not specified here will be rejected.
  
• what it doesn't do: The user list cannot accept "catchall" addresses ( a single email for any unspecified addresses for a valid domain name), or accept email for any address that is not present, or misspelled.
  
• when it may be useful/not needed: A valid and accurate user list is always needed for the Scora
  

Filtering Options

• Spam filtering: This feature allows the administrator to set a probability threshold based on anti-spam rule sets that will trigger any of five different email dispositions. The preset, "System Default", can be customized by the administrator. This filtering option can also be turned off completely.
• Explicit content filtering: This feature allows the administrator to set a probability threshold based on "explicit content" (racy language) rule sets that will trigger any of five different email dispositions. The preset, "System Default", can be customized by the administrator. This filtering option can also be turned off completely.
• Virus filtering: This feature allows the administrator to set a probability threshold based on "anti-virus" rule sets that will trigger any of five different email dispositions. The preset, "System Default", can be customized by the administrator. This filtering option can also be turned off completely.
• Disposition options: There are five dispositions for email available to the administrator. These can be set differently for spam, explicit content, and virus protection.
  
  • Deliver: Email meeting the defined probability is delivered.
    
  • Tag and Deliver: Email meeting the defined probability is flagged as potential spam, and delivered to the end-users' mailbox.
    
  • Quarantine: Email meeting the defined probability is sidelined into a holding pen. Any email in the quarantine can be retrieved by the administrator within specified expiration time.
    
  • Silently delete: Email meeting the defined probability is destroyed. This is to be used to handle extremely high probabilities that a message is spam or carries a virus. We advise this to be used cautiously as destroyed email is irretrievable!
    

White lists

• what the feature does: By specifying a legitimate sender (whether it's an IP address, email address, domain name) users can cause Scora to completely ignore certain emails for spam filtering. This is used to prevent on-going false positive situations.
  
• what it doesn't do: Whitelist does not apply to virus filtering, because many email viruses make it appear that they were sent from trusted correspondents.
  
• when it may be useful: Useful when a certain sender (for whatever reason) is consistently marked by the Scora system as spam. Helps circumvent ongoing false positives.
  
• when it is probably not needed: if you do not get significant or recurring false positives, this is not likely to be needed.
  

Reports

• what the feature does: There are three types of reports that the administrator can generate:
  
  • a per-user report
    
  • an administrator report
    
  • a summary report
    
  These reports are in HTML format (and can also be read by text-only clients). They are used to allow the administrator to get an overall view of how the system is operating. This can be with a detailed index of all email quarantined (the administrator report) or with aggregate data only (summary report). The per user reports allow individual users to see what was caught by Scora and placed in quarantine on a daily basis. Using the Scora ID embedded in the report, the end-user can request that emails be retrieved from the quarantine for the domain name.
  
• when it may be useful: Use of reports is not required, but is strongly recommended. For Administrators that do adjust and tune the filtering settings, pulling a report can give fast feedback on the results of those changes. If the quarantine disposition is enabled, per user reports are greatly welcomed by the end users.
  
• when it is probably not needed: If the quarantine is not enabled, the per-user and administrator reports are not needed. The summary report for the Administrator is always recommended.
  

Exempt Users

• what the feature does: email for end-users identified as exempt users will not be scanned by the Scora system.
  
• what it doesn't do: Does not protect these users from spam, viruses or explicit content.
  
• when it may be useful: for certain jobs (like Human Resources, for instance) there may be industry best practices and/or requirements that email not be filtered in any way.