BH #2 - /dev/null

If something you've written or done has made it here, then gratz! You're a knob head lamer who doesn't know a dough nut hole from a hole in the ground. Doesn't it make you feel all warm and fuzzy that we thought of you!?!? Some of these responses to the lame e-mails may be real, some may be dramatizations. Your mileage may vary.

---

== The following is a security white paper I received via e-mail from Insight. This company sells various computer related products to their customers. Basically you call the rep, give him the name/part number of what you want, and they find it for ya and send you a quote. Generally their prices are a little higher than what you can easily find on your own, but you're paying to have the legwork done for you. They can be a real time saver in business when your pressed for time. I have used them before with good results. They have even offered to beat a competitors prices when they could, so I have no problem with using their services. However, I do have issues with the white paper they sent me.

It appears to be targeted to I.T. managers, instead of the bit-heads in the trenches who do the grunt work. I've broken down the text of the white paper as well as my responses to each one. Please note, my responses are my opinions based on actual work experience. Your mileage may vary.

---

EMAIL SECURITY: A HOLISTIC APPROACH FOR SMBSA
White Paper Prepared by Insight

INSIGHT
68s0 S. Harl Ave.
Tempe, Arizona 85283

Many people call email the 'killer app' driving the growth of computer use and increased productivity among organizations of all sizes.

== Are you kidding? With e-mail subject lines that read hlp plz, and all of the spelling errors in most e-mails, it's quite clear that the general public is clueless about sending e-mail. It even leads one to wonder if these people are literate. The web, now that's THE killer app. Any primate can point and click their way to low IQ digital happiness. When you mention the net to most users, they instantly think WEB, or Internet Explorer. Poor saps...

However, an escalating array of Internet viruses and email spammers are generating a continuous stream of security threats that could seriously cripple their operations. In fact, one email scanning company recently reported that 86.3% of the corporate email that it reviewed in June was spam, resulting in over 790 million messages being blocked.

== Actually it's virii, not viruses. However, at this point it's a lost cause. The uninformed grossly outnumber the informed and educated. As far as the e-mail company reports, thats also an idiotic point. Almost all so called spam filters will also filter legit e-mail. Ever wait for days expecting an important e-mail from someone only to realize it was sent but never received? Up above is your answer. It's one of those 790 million messages. Be sure to keep a list of the companies listed in this white paper, so that you too may send them your most sincere thanks. :-/

Small and mid-size businesses (SMBSs) are especially vulnerable to these attacks because of their heavy reliance on Microsoft operating systems and applications that are the targets of many viruses. SMBSs also have limited in-house security skills and resources to combat these threats.

== Oh joy, another senseless acronym. C'mon Insight. We've got more than enough of these. Why create another stupid buzz word for the corporate zombies to toss around blindly just to wow their bosses? You could have just used the word businesses after your first use of Small and mid-size businesses and avoid the use of an acronym. What about companies, or organizations, etc.? Go buy a thesaurus, they aren't that expensive ya know!

While many Internet service providers (ISPs) are responding to these email issues by adding a variety of anti-spam and virus features to their portfolios, these offerings haven't reduced the volume of spam for many end-users or created a fully effective firewall against the various viruses being launched on a daily basis.

== Hmm, interesting, first you mention the amount of blocked e-mails, then a bit later mention that these methods aren't reducing the volume of spam. It's obviously not working. However, it is certainly fattening the old portfolio of said companies, giving them more crap to cram down America's pie hole. As far as firewalls, that doesn't exactly fit. A firewalls use is to block unwanted internet traffic. It is not for filtering internet content. Yes a firewall can be used to prevent the spread of internet worms by blocking the ports that those worms like to use to spread, but it will not stop a virus. A virus does not understand what the internet is. A worm does. A worm crawls through the internet to infect. A virus does not. A virus spreads through files shared between computers, floppies, etc. Yes they both infect, but the method of delivery is different. I suggest you research virii, trojans, worms, etc. before writing another paper.

Compounding these challenges are new federal regulations that are setting higher privacy and corporate financial reporting and storage compliance standards for SMBs.

== Oh yea, that's gonna work well, just like it already has. Next time you open an e-mail in Outlook with the subject: I love you, politely inform the worm that there are federal laws that prohibit it from infecting your computer. I'm sure it will be happy to comply with federal law. The people sending the spam and writing the virii, trojans, etc. don't give a flying piranha about federal law. They only care about making money, intellectual challenge, fame, etc. That's why they do these things. Federal regs will only make it legal to prosecute these people, and allow law enforcement to throw them in jail. Others of their kind will see this, rebel, and redouble their efforts. In effect, you are turning it into a cause for them to fight for. Here's a thought, pass laws forcing companies that sell software for profit to secure their software. Allow those companies to be held liable for damages caused by poor security methods implemented in their software. Sure you'll see fewer releases of software, but they'll be of outstanding quality.

These regulations, along with the inability of ISPs to fully address the growing number and complexity of email issues, have convinced many SMBs it is time to take greater responsibility for protecting their information technology (IT) and business operations.

== They should have implemented security when they first designed and installed their networks. Why rely on another company to secure your company? They don't care if you make money! They only care if they make money!

This white paper is intended to serve as a guide for SMBs seeking to improve their safeguards against today's email security threats. It will show how to acquire the right security technologies, and implement the right organizational policies, procedures and practices to strengthen your defense against external and internal attacks on valuable business data.

== Translation, this paper is something for your boss to read over, scratch his head, learn a few acronyms and buzz words to throw around to impress his boss, then come and worry the crap out of you about all the stuff you take care of already that he's clueless about.

TODAY'S EMAIL SECURITY THREATS - HOW SERIOUS ARE THEY?

SMBs are increasingly reliant on email and the Internet to serve their customers, communicate with partners and meet their business objectives. Unfortunately, Gartner -- a leading IT researcher -- predicts 40% of SMBs that manage their own network security and use the Internet for more than email will experience a harmful IT security attack through 2005. And more than half of the affected SMBs won't even know they were attacked and will pass the viruses along to their customers, partners, and others.

== Oooh goody, we now have internet psychics predicting that we'll be attacked. Maybe they're the ones doing the attacking? (might as well jump on the paranoia internet terrorists bandwagon and look like idiots ourselves right?) Actually, upper management should talk to their IT experts. You know, the workers in the trenches that are already fending off internet attacks, and defending the networks for the guys sitting in the cushy offices playing the latest release of Doom. Show em a little appreciation on their next paycheck eh? Or invite em to one of your Doom matches with the other execs, unless of course you're afraid of the geek wiping the floor with ya!?!? (look out if he brings his own gamepad hehe)

Email spam, or unsolicited commercial email, consumes a SMB's valuable network bandwidth and wastes precious employee time. The sheer volume of spam -- now estimated to be over half of many people's daily email traffic -- can be overwhelming. But it is more than just a hassle. It is also a vehicle for transporting computer viruses.

== Wastes employee time? Oh now that's funny, less than a second to delete an e-mail with the subject line that says "get Viagra now!" What about all the time we have to waste teaching someone how to click the mouse, fixing a "messed up printer" by filling up the paper tray when it's empty, plugging cables back into the computer after the user fidgets incessantly and kicks them out, etc. Sure e-mail can transport virii, but that's what automatic virus/e-mail scan is for.

MessageLabs scans email on behalf of 8,500 customers. In June 2004, 86.3% of all inbound corporate email scanned by MessageLabs was spam. The company says it stopped nearly 792 million spam emails in one month, translating to 1 out of every 1.16 emails being categorized as spam. This spam figure is up dramatically from a year ago, when 38.5% of email was categorized as spam.

== Oh that's nice. Giving the world the number of clients you service. Why don't you just hold up a sign that says, "Attack here for sensitive corporate info about many corporations."

Indeed, spam volumes have grown steadily in the first four months of 2004. MessageLabs data shows that spam rose from representing 52.8% of all email in March to 67.6% in April, 76.1% in May and 86.3% in June. Also in June, MessageLabs stopped 97 million viruses. That figure means that 9.3% of all email - or 1 out of every 10.7 emails - contains a virus. The virus figure is also up from June 2003, when 1 in 125 email was infected with a virus. MessageLabs recorded 1 in every 10.58 emails was infected in April, 1 in 10.96 emails was infected in May and 1 in 10.7 emails was infected in June.

== *snore* We already know spam and virii are problems.

Another indication of the growing email threats comes from anti-spam vendor Postini Inc. which recently reported is now rejecting more than half (53 percent) of all attempts to send email to its customers, due to increased activity from home computers that have been turned into "zombies" that unknowingly send spam email to others.

== That would be the result of internet worms.

In recent months, many new viruses have been hidden in spam messages that include ZIP files to fool anti-virus software. The ZIP files compress the viruses to evade the anti-virus software and deceive the email recipients into "unzipping" the attachments and infecting their computer systems.

== C'mon, ever since the late 90's, and possibly before then, anti-virus software has been able to scan the files withing compressed archives. Whatever brand you're using, it needs a quick trip to file 13, and you need a trip to the software vendor, or perhaps college to learn a bit more about information technology.

For instance, a new version of the Bagle email worm, called Bagle.AG, was detected as it began to spread through standard file folders and in email messages. Email messages created by the new Bagle worm used forged or "spoofed" sender addresses and odd subject lines such as "Re:", "Lovely animals" and "Screen." These messages also included worm-infected file attachments in ZIP, EXE, SCR and other common formats with names such as "More info," "Details" and "Readme." When opened, Bagle.AG harvests the recipient's email addresses stored on the infected computer's hard drive and installs its own SMTP (Simple Mail Transfer Protocol) engine, which is used to send out large volumes of infected email messages to other computers.

== Forging e-mail isn't that difficult. E-mail is insecure by design Anyone dumb enough to be using unencrypted e-mail for important corporate information should be fired and denied welfare. As for more accurate information on the Bagle.AG worm, take a look at
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=39846

OTHER COMMON INTERNET AND EMAIL SECURITY THREATS

Spoofing

There are varying forms of spoofing. Email spoofing is when email is forged so the "From" address conceals the true address of the sender and permits the transmission of illicit messages. Protocol (IP) spoofing is when a hacker creates packets that look as though they have come from an acceptable IP address to permit viruses to pass through firewall security and initiate an attack on a computer or local area network (LAN). IP spoofing attacks can be difficult to detect and often require specialized skills and systems to monitor and analyze IP traffic.

== Typically you forge e-mail, you spoof packets. Again, learn your terminology before you attempt to write a white paper. As for detecting these, view all headers in your e-mail software, and use tcpdump on your incoming internet packets. (your company's network admin should already possess these skills)

Denial of Service (DOS) Attacks

These are systematic attacks intended to overload and disrupt a network service, Web or file server, or other computing devices. These programs probe IP addresses looking for unprotected systems to take control of address books and set off mass email transmissions.

== Ok, I call BS on this one. Denial of Service attacks do not probe your network. These attacks only have one purpose. To swamp your servers with connection requests so that legitimate users are unable to connect. This denies them of service, hence the name. Denial of Service attacks do not include stealing your address book. Internet worms, virii, and trojans take care of that quite well. Usually Denial of Service attacks are used on web servers, or on people who earn the wrath of specific groups on IRC. They are very childish, and retain the stigma of "script kiddie".

Phishing

Hackers use email to troll for email addresses that they can replicate, or forge, to direct other email user to illegitimate Web sites or compromised sites where the hackers can obtain personal information to commit identity fraud.

== Hackers do not steal anything. Criminals do. I see the mainstream media has gotten to these people as well. They don't troll either. Trolling is when you post comments on a message board for the sole purpose of angering people, which usually starts a flame war. Collecting e-mail addresses for spamming purposes is called *drum roll please* data mining, or harvesting.

Although most of the IT security threats that are gaining attention today are associated with external email spam and internet viruses, Gartner estimates 70% of all attacks that cause more than $50,000 in damage involve a person working within an organization. Disgruntled employees intentionally trigger some of these attacks, but most are caused unintentionally by loyal workers.

== Why don't you hire competent network admins, educate your employees on the proper use of technology, and use a secure operating system. Your damage dollar amount will drop considerably. (Unless of course you enjoy inflating that number for court cases like certain other companies that we won't mention here)

The business costs to a SMB if an email spammer forges its web domain or a hacker uses its domain name to phish for email addresses can be enormous. Not only is its corporate reputation harmed, but new government regulations could make companies liable for not properly securing their email and Internet systems. In addition, employees can sue their employers if they believe the organization intentionally ignored offensive email.

== Again with the attack on hackers.. blech. I bet the guy who wrote this was kicked out of the #hackers channel on IRC for claiming he ph0wned a Gibson and copied a garbage file. Someone copying your entire website rarely happens. You generally have to make someone extremely angry. These attempts almost always fail. Regularly search for your site in the search engines if you worry about this happening. If they jack your domain name, that's your fault for using simple passwords. Most registrars also provide security procedures to prevent this. As for your employees getting offended from e-mail, tell them to grow up or find another job. They didn't have to open that e-mail. The sender is clearly marked. If you don't recognize who it's from, delete it. If it has a fishy subject line, delete it. If you're offended that easily, then you probably don't watch T.V. either. Prime Time is generally on par with most of the e-mails you receive. Hey, how about we sue the television networks for airing offensive content? *grin*

WHY ARE SMBS PARTICULARLY VULNERABLE?

Microsoft's operating systems and applications have become a primary target for hackers and virus perpetrators because they have numerous vulnerabilities and command the greatest market share. SMBs are disproportionately affected by these attacks on Microsoft operating systems because:

== of course, Microsoft has been providing shoddy security for the masses since the early DOS days. As long as you keep buying the crap, they'll keep making the crap. Upgrade to a real OS like FreeBSD or Linux.

90% of SMBs are running Microsoft Windows on their desktops, laptops and servers

== True (Mindless point and click for the lusers) Ok yea I know everyone who uses some flavor of windows isn't brainless. You can get the same functionality out of some form of *nix with XFree86 and a slew of window manager choices that are way more secure than any Microsoft product will ever be.

80% of SMBs are using Microsoft Outlook and Exchange for email

== True (for the Outlook part, however Exchange is the worst e-mail server software ever written. It has more holes than swiss cheese)

70% of SMBs are using Microsoft SQL databases

== False (mySQL is cheaper, more secure, and provides better performance)

SMBs also lack the technology skills and experience to keep pace with the continuous stream of new viruses and hacking techniques that threaten their operations.

== Part of this is in the hiring process, the other part is in the clueless management that doesn't understand the technology, and either ties the hands of the guy who actually secures the server in the name of usability, something comfortable management is familure with vs. something that is more secure, and in some cases it's just an ego issue, depending on your
boss your mileage may vary)

SMBs are being compelled to combat spam not only because of its potential harm to their computer systems, but also because the explicit sexual content of many spam messages can be offensive to many people. Therefore, SMBs that fail to implement anti-spam measures can be seen as promoting a poor working environment that could be liable for potential sexual
harassment suits.

== Again, prime time T.V. is much worse. Just delete the crap without reading it if it gets past your spam filters. Honestly, if you get offended that easily, join a convent.

Implementing the latest anti-virus software and security protection systems can prevent many internal and external threats. But, these security solutions have to be updated regularly to keep up with new viruses and spam threats. This requires strong technical skills and stringent organizational processes governed by comprehensive security policies that reflect a SMB's business priorities.

== AV software requires no skills to update. Just renew the subscription and leave auto-update enabled. Firewalls and software patches aren't that much more challenging for Windows based computers. Alternate OS's are still rather easy to update, depending on the admin IQ level.

TECHNICAL SAFEGUARDS AGAINST EMAIL SECURITY THREATS

There are a number of technologies that can be acquired to protect SMBs from email spam and Internet viruses. The following are some of the most important technologies.

Firewalls

Firewalls are aimed at establishing a protective shield around the perimeter of your corporate network or to partition portions of the network for security reasons. Firewalls hide the identities of computers within your network to make it harder for criminal hackers to targetindividual machines. A firewall is a system designed to prevent unauthorized access to or from a corporate network via the Internet. Some firewalls examine and filter information packets that flow in and out of the network to make sure they are legitimate.

== Firewalls do not block spam, they block connection attempts and malformed packets. They can also be used to prevent your users from using instant messaging services, or force them to go through a web proxy so management can monitor their browsing habits. (Big Brother anyone?)

Firewalls can be implemented using hardware or software, and can vary in price from less than $100 to over $10,000, depending on the size and complexity. SMBs can also outsource their firewall perimeter security to an outside-managed security service provider.

== Why anyone would want to outsource a firewall is beyond me. If your company is that strapped for cash, turn a desktop into a linux firewall. Your only cost is the hardware, and paying the employee for setup, configuration, and upkeep of the system.

Anti-Virus Software

Anti-virus software is also necessary to protect against infectious files moving within a corporate network and disrupting business operations, corrupting computer files or destroying valuable data. Most of the popular anti-virus software include update services to ensure organizations can combat the latest viruses. However, these software packages require continuous updating to be effective.

== Again, auto update, mark when you need to renew on the calander, and act accordingly. It's really a no-brainer.

And, although many of the anti-virus software packages can be relatively inexpensive, they can also be complicated to use. For instance, when the software identifies a potential problem it may not be clear about how an organization should resolve the issue. Therefore, many organizations rely on their ISPs or independent email hosting services to handle their security requirements.

== Complicated? Repair, quaranteen, delete, those are your three options. Those are always your options. Flip a coin if it's that difficult for you! Autoscan will prevent your files from becoming infected, and e-mail scan will give you your three options when it finds something.

Email Services

Since most SMBs rely on their ISPs to supply them Internet access and email service, they have also become reliant on the ISPs' spam control and anti-virus capabilities.

Nearly every major ISP has implemented anti-spam technologies to block unwanted messages from their networks before they reach users. They have also recently taken measures to limit spam from originating within their networks. ISPs have discovered that one of the important methods of cutting down the volume of outgoing spam is to filter email sent via Port 25, a gateway that pumps internet email past an ISPs server. This approach forces users to send email through the ISP's mail server, allowing the ISP to monitor traffic flowing over its network.

== Oh yea that's a lovely fix, block port 25. And if your company ever wants to setup their own e-mail server, they're stuffed until that port is unblocked. Your company should be the one that holds that power through their firewall, not another company you pay.

New government regulations are placing more of the responsibility of controlling spam on ISPs. This regulatory movement may help to reduce unwanted spam or dangerous viruses, but they may also restrict email traffic as ISPs create filters that may block harmless messages that look
suspicious.

== While I don't agree with more government regulation, I do agree with the last part of that statement. A lot of these filters are poorly designed, and block legitimate e-mails. Even without government regulation, ISP's will want to filter out this unwanted traffic to make more bandwidth available for potential customers. Capitalism works. Regulation robs
freedoms.


ORGANIZATIONAL SAFEGUARDS AGAINST SECURITY THREATS

Most IT security experts agree that implementing firewalls and anti-virus software is just a starting point. Another essential ingredient in combating spam and viruses is educating computer users about how to properly use email and avoid the various traps created by hackers on the Internet. This education process needs to be supported by a set of security policies that clearly state an organization's rules for utilizing email and Internet access.

== Agreed. Education is key. However, hackers do not create these traps. Criminals do. There is a clear distinction between the two.

Yet, according to Gartner less than half of small enterprises and approximately a third of mid-size enterprises have a written security policy. This is generally due to a lack of in-house skills and experience establishing security goals, objectives, budgets and execution plans. Many SMBs don't know how to develop security policies that define the rules and responsibilities of staff when it comes to safeguarding against email or Internet threats.

== Again, part of the problem is in the hiring process, the other portion is upper management making decisions that they are clueless about. Ask the guy hunched over the keyboard with bloodshot eyes, and stacks of *insert favorite caffeinated beverage here* beside them. They'll tell you what needs to be done policy wise to secure the network.

In order to effectively combat these threats, SMBs must set policies to prevent their computer users from accepting email with potentially dangerous attachments or downloading dangerous files from the Internet. These policies should be re-enforced by properly configuring company email servers and security software.

== Agreed

Finally, the security policy should include a thorough education program to make employees aware of the organization's security goals and objectives, the business benefits of maintaining a secure IT environment, the potential cost of IT disruptions, proper email behavior and computer techniques, and employee penalties for security infractions.

== Fire the idiot who clicks yes on every popup they run across. You know, Joe Dimwit who doesn't have any business even looking at a computer cross eyed. I'm not talking about the users who are willing to learn either. I'm talking about the idiots who "know it all" yet always break everything. Every company has had at least one at some point.

LEVERAGING OUTSIDE EXPERTS IS THE BEST PROTECTION

As we've seen, establishing and maintaining a secure IT environment is both a technical and organizational challenge. Having the right security skills and resources is as important as having the right security systems and software. It is for these reasons that many SMBs turn outside IT security experts for help. But it takes more than periodic visits from an IT contractor to combat the continuous threat and distraction of email spam and Internet viruses.

== I totally disagree here. Turning to an outside company to secure your network is a bad idea. Why don't you just give them the keys to the building, or hand over your customer info. Although, it may be helpful to hire an outside company to "test" your network from the outside, then give you a report of their findings. This will let your IT department know what needs work.

In addition to providing specialized security skills, IT security experts can also provide an independent, objective opinion regarding the right combination of security technology and policies to fit a SMB's business requirements. For instance, single-office SMBs with limited electronic interaction with their customers and business partners will have different security requirements than SMBs with multiple offices regular communications with outsiders.

== Yes, every company will have different needs. Your mileage may vary.

SMBs must also identify the right combination of outside security resources. It may be impractical for some SMBs to contract with individual security consultants, purchase various security products from multiple vendors and rely on separate ISPs to satisfy their email and Internet access needs. Therefore, many SMBs are establishing strategic sourcing agreements with solution providers that offer a combination of consulting skills, technology products and Internet services.

== Another way to look at the big picture, the company that hosts your website and database on their servers will generally provide good security because they don't want their network broken into. However, the guy you pay to come in from another company to work on your systems, and secure your network only cares about that paycheck when he's done. What's to stop him from installing back doors? What about that company's hirng policy? Do they hire convicted criminals? Just something to think about.

AN EMAIL SECURITY CHECKLIST

The following steps can help a SMB establish an effective security program and select the right set of security products and services to satisfy their business needs.

- Evaluate corporate email and Internet access requirements
- Determine business impact of current level of spam and virus disruption
- Measure the business benefits of reducing spam volume and virus threats

= there are always benefits to virus prevention and fighting spam. Duh!

- Assess existing in-house security policies, skills and technology
- Evaluate security capabilities of current technology suppliers and ISPs
- Develop strategic sourcing approach for addressing ongoing security requirements

== Again, depends on the type of sourcing. But for the most part, the list is pretty good, if a bit wordy.

FINAL THOUGHTS

Email security has become a serious concern for SMB executives, end users and IT managers. As the volume of email spam and Internet viruses escalates, it is nearly impossible for most SMBs to keep pace with today's IT security threats.

== Impossible only to those who treat their employees like crap, tie the hands of their network admins, and pay poor wages.

Implementing the latest security products alone to protect against these threats will not overcome this challenge. In fact, just keeping this technology current is an increasingly daunting task. In order to combat today's security threats on their own, SMBs must have dedicated and specialized staff with the right security expertise and business awareness to select, implement and fully utilize the security products and services. Few SMBs can afford to hire this kind of staff on a full-time basis and contracting with individual security consultants won't ensure the continuity of security necessary to safeguard against email spam and Internet viruses on an ongoing basis.

== The last portion of the above paragraph seems to agree with my previous statements in a round about way, which also contradicts his own previous paragraphs referring to outsourcing. Guess the writer was getting tired at this point. Me, I can go for hours yet. *looks over at the stacks of Mt. Dew cans and grins*

The best approach is to develop a strategic sourcing arrangement with an IT solution provider with in-depth security expertise and the ability to implement the latest end-to-end security products to ensure that a SMB's entire set of IT security requirements are covered.

== Looks like he finally broke out the thesaurus for that last paragraph. Very wordy. Buzz words and potential buzz words. The execs will eat that up!

For more information about implementing the right security policies and technologies in your organization to achieve your business objectives, contract Insight at www.insight.com or 800.INSIGHT.

== Ah, the company that wrote this white paper conveniently sells "solutions". Another one of those fun little buzz words that upper management loves to throw around to impress each other. After reading this, I think I'm gonna puke...

Insight and the Insight logo are registered trademarks of Insight Direct USA, Inc. All other trademarks, registered trademarks, photos, logos and illustrations are the property of their respective owners. (c) 2004, Insight Direct USA, Inc. All Rights Reserved.

== In short, this white paper reads more like a FUD campaign to drum up business. C'mon insight. You can do a lot better than this. Just stick to the facts and do your best to sell at the lowest price possible while still making money. The market will vote with it's dollars. Heck, you could even do better with sending e-mail specials to customers based on their past orders. That will certainly get you a lot further than this tripe. Oh, and just a little hint, IT people tend to use word of mouth and e-mail each other as to who has the better deals. Pass that along to your marketing department.

-=databat=-