Unfortunately, the result is that fighting spam is a complex endeavor. Says Knowles, "You’re probably going to have to use multiple solutions from multiple sources. You’re going to have to keep a constant eye on things to make sure that, when they blow up, you find out as quickly as possible. And you [need] multiple layers of business continuity plans in place to handle the situation."

3. It’s a Continuous Battle. Budget Accordingly.
Spammers succeed only when they get messages to user inboxes, so they are motivated to counter any barrier between them and their intended recipient. As a result, your IT department will never be done implementing solutions.

Points out David Linn, computer systems analyst III at Vanderbilt, "Spam pushers update their tools as fast as the spam defenders work out a defense to yesterday’s attack type. This seems to be the thing that those who want to buy an off-the-shelf solution and then forget about it least understand and least want to understand. The very speed of innovation that makes ’Internet time’ so attractive in other contexts is the enemy here."

Cole describes spam as mail that evolves and adapts and thus requires an adaptive and evolutionary approach to defense. Spam cannot be handled as a discrete project with a list of deliverables and a three-month project plan. While you may initially have success by doing so, he says, "Expect to repeat the exercise again next year, and the year after that, and on infinitely."

This is a major nuisance to managers, because they have to pay a staff of high-skill people (either directly or indirectly) for ongoing open-ended work. As Cole notes, "Like many other areas of security, it is a potential bottomless pit for computing resources and the best technical staff and hence for money, so drawing the lines on it are a managerial challenge."

Martin Schuster, in charge of IT at CenterPoint, argues the business case for spam defense by extending spam fighting past technical and ethical issues (such as, say, forcing everyone to use PNG instead of GIF, not use special characters in file names, and so on). Schuster focuses on the financial cost and motivations, from the cost of sending spam to the cost of removing it (from infrastructure to manually deleting messages). He comments, "Fighting spam costs money. If your mail server administrator talks to you about fighting spam, and wants equipment and time to implement it, listen to him. His haircut may seem weird, but he’s talking about saving money."