Although attacking spam on multiple fronts may seem like overkill, Walter Smith can attest that it’s necessary. As director of the global IT infrastructure services group at Advanced Micro Devices (AMD), he calculated that spam was costing the computer chip manufacturer more than $1.5 million a year in lost employee productivity. He first took a crack at handling the problem internally. "Our initial approach was to use fairly simple rules to identify spam and tag junk mail," he says. "We quickly found out that simple rules and spam don’t go together." Before long, two full-time employees were consumed with tweaking the rules to account for all of the variations in spam, and even then, they couldn’t keep up with the spammers. Only about 30 percent of spam was getting tagged, and some legitimate e-mail was wrongly identified as spam.

So when AMD’s e-mail firewall vendor announced an antispam product in May, the decision to use it was more or less a no-brainer, says Smith. AMD already used Tumbleweed both to scan all incoming e-mail for viruses and to prevent confidential competitive information from leaving the company. With the Tumbleweed infrastructure already in place, AMD could plug in the vendor’s new spam component for an annual per-user cost of about $5, an investment that paid for itself in less than a month. Today, 90 percent to 95 percent of all incoming spam is tagged as such. And no more than a quarter of a single IT employee’s time is needed for ongoing maintenance.

"Having a combination of rules, heuristics and blacklists is really key because of the creativity of spammers," says Smith. "Simple, obvious solutions don’t work today. We quickly realized that stopping junk mail is not a core competency of our company. And we needed to get out of that business as soon as we could."

In attacking AMD’s spam problem, the last thing Smith wanted to do was to take on the role of corporate censor. "We didn’t want to be perceived as content filterers," he says. In the interest of providing a nonhostile work environment, however, AMD does delete all spam with a high probability of containing adult content. But all other spammy mail gets sent along to users, marked as suspected spam. Users then decide for themselves whether to have Outlook filter all spam, put it in a spam folder, or keep it in their inboxes for manual scanning and deletion.