Test Report June Trend Micro Interscan Gateway Security Appliance. Anti-Spam Technology Report

Transcription

1 Test Report June 2007 Trend Micro Interscan Gateway Security Appliance Anti-Spam Technology Report

2 Vendor Details Name: Trend Micro Address: Trend Micro Inc N. De Anza Blvd, Cupertino, CA , USA Telephone: + 1 (800) / + 1 (408) Website: Product: IGSA Version 1.0 Build 1272 Test Laboratory Details Name: West Coast Labs Address: William Knox House, Britannic Way, Llandarcy, Swansea, UK, SA10 9EL Telephone: +44 (0) Date: June 2007 Issue 1.0 Author: G. Samuel Contact Point Contact name: M. Garrard Contact telephone number: +44 (0) Test Report

3 Contents Introduction 4 Test Network 6 Test Methodology 7 Product Test Reporting 8 Checkmark Certification 9 The Product 10 Test Report 11 Test Results 19 West Coast Labs Conclusion 20 Security Features Buyers Guide 21 Test Report 3

4 Introduction The ever evolving spam threat Two years from now, spam will be solved. Bill Gates Jan At the beginning of 2004, Bill Gates was addressing the World Economic Forum in Switzerland and confidently predicted that Two years from now, spam will be solved. Sadly his prophecy has proved somewhat wide of the mark as reports continue to emerge about the size of the problem. The latter half of 2006 saw an unprecedented rise in spam volumes with SurfControl reporting a 50% increase in spam over the previous half year, and spam now accounting for almost 90% of all traffic on the Internet. The nature of spam has also changed. In 2004 spam content was dominated by pornography, Viagra sales and the infamous Nigerian scam advance-fee fraud spam. Those types of spam are very much still with us but have been added to by phishing attacks, Pump-and-Dump scams (which involve artificially inflating the price of a stock in order to make a quick profit on stock previously purchased cheaply) and spam that tricks users into following URL links to web sites that download malicious code that will compromise their machines. The methods used by spammers to launch their attacks have also transformed over time. The vast majority of unsolicited is now being sent via vast armies of infected PCs known as botnets often these are the machines of home users who are unaware that they are part of the problem. This distributed system approach is making it more difficult to separate out spam s based upon simple network-based criteria, and so companies providing anti-spam technologies are having to provide more intelligent filtering solutions. 4 Test Report

5 In a recent interview, Dr Richard Cullen, distinguished engineer at SurfControl said, The threat landscape has changed dramatically over the past couple of years. Malware attacks are now commercial ventures, with well organized cybercrime gangs harnessing the power of vast botnet armies to launch spam, phishing, DDOS and malware attacks. The spammers are also always trying to find new ways of bypassing antispam defenses. One such technique that is on the increase is image spam s with images containing the spammer s messages within random text designed to foil less sophisticated spam filters. Peter Firstbrook, security research director for Gartner, has reported that image spam went from 6 percent of all spam in Q3 of 2006 to 30 percent by Q4, and it is now thought to make up almost 40% of all spam. Apart from being harder to block, image spam also causes knock-on problems because the spam messages are actually larger than simple text messages. According to some reports, the average size of a spam message has increased by 77% since September last year, from 6.62Kbytes to 11.76K) and continues steadily to grow. This adds to the cost of managing , it wastes bandwidth and also consumes storage if a company needs to archive all incoming mail. And according to the New York Times security columnist John Markoff, one recent botnet outbreak managed to consume 15% of Yahoo s resources while searching for random pieces of text to pad out such image-based messages. As a result, anti-spam vendors are now having to adapt to this new threat by both enhancing existing techniques such as heuristics rules to analyze the characteristics of image-based spam, and by adding new technology layers, such as optical character recognition technologies. Where will it all end? Test Report 5

6 Test Network WCL has a number of domains that collect genuine spam. These domains receive varying levels of spam and are consistent with different environments. To reflect the usage within a corporate environment, within each domain are a number of designated user accounts with a variety of practices and needs including some that are subscribed to a variety of newsgroups and mailing lists. Some user accounts actively contribute to mailing lists. The multiple domains designated for testing purposes were those that, between them, receive spam at a level consistent with the defined requirements of testing. Software solutions included in the test program were installed on servers that meet the minimum specifications required by the vendor. Appliance-based solutions were installed on the network according to the vendor s recommended placing. For hosted services, WCL testes through identified domains and changed the MX records to divert the mail stream through the hosted service. 6 Test Report

7 Test Methodology WCL initially performed the testing with an out-of-the-box configuration, changing only those settings on the solution needed to ensure correct operation inline with the vendors recommended installation and configuration procedures. Further testing was then be performed at following the vendor s advice for the tuning or training of the solution under test. WCL finetuned the solution each day of the test, spending no more than half an hour per day undertaking such work. Throughout the course of testing, a mixture of was be sent to the test domains from other addresses and domains controlled by WCL to mirror genuine activity common in business, for example requesting meetings, sending notifications to groups and non-business related social s. s were also be sent from web-based accounts such as Hotmail and Google s Gmail in order to simulate external users sending nonbusiness related social s, and home workers. Thus, during the testing period the domains received some spam, some list/newsgroup mailings and genuine individual s. Test Report 7

8 Product Test Reporting Product evaluation addresses three specific areas* - Management/ Administration, Functionality, Performance plus Additional Feature Testing. 1. Management/Administration Ease of Setup/Installation Ease of Use Logging and reporting function Rule creation Customization Content Categories 2. Functionality Processing Steps Allow/Blocking of Quarantine Area Additional functionality reporting Steps to Process Block Addresses Blacklist/Whitelist Allow Addresses 3. Performance Volume or Percentage of spam detected False positive rate Spam incorrectly passed through Legitimate mail blocked Legitimate subscription mail blocked 8 Test Report

9 Checkmark Certification Upon completion of the testing, individual product results are analyzed, resulting in accreditation to one of the two Checkmark Certifications for Anti-Spam subject to achieving the following catch rates:- Checkmark Anti-Spam Certification Premium 97% and over Catch Rate Checkmark Anti-Spam Certification Standard 90% and over Catch Rate Test Report 9

10 The Product Introduction Trend Micro s InterScan Gateway (IGSA) M-Series is designed to provide comprehensive protection from security threats for small to medium sized businesses. It achieves this by blocking threats at the Internet gateway to prevent them from entering the network and subsequently causing potential damage. The appliance includes numerous features for monitoring and protecting a network from services such as SMTP, HTTP, FTP and POP3. All testing for this Technology Report was carried out over the SMTP protocol. IGSA utilises the multi-layered antispam protection components incorporated into the device to significantly reduce the amount of Spam received. Specifically, they include the main Trend Micro Anti-Spam engine, Spam pattern file, Approved and Blocked senders lists and Network Reputation Services (RBL+ and QIL), which works in conjunction with IGSA to scan for and filter Spam. The initial protection provided by the Network Reputation Services (RBL+ and QIL), prevents many threats before the engine is invoked to filter Spam and s at the gateway. 10 Test Report

11 Installation and Configuration The in-line, rackmountable, hardware device has an LCD console on the front for initial navigation and configuration. At the rear, there is a power switch and connections available for Power, USB ports, a Serial Connection and gigabit Ethernet ports. There is also a further Ethernet 10/100 port interface available for configuration and management. Initial configuration consists of deciding whether to use a static or dynamic IP Address, and then setting up (if appropriate) the subnet mask, Gateway and primary and secondary DNS Server details. No alterations need to be made to the existing mail server, which means that there is no need to shut it down. This is a great benefit to any Administrator needing to avoid any potential downtime. Test Report 11

12 Interface Once the configuration values are entered, the product s SSL encrypted web-based console can be further used to configure the solution without any difficulty. The Administrator is initially presented with a screen that requires valid authentication details before a successful logon can occur. Upon a successful validation of credentials, there is complete access to the options that relate to the appliance s supported protocols and services, together with the appliance s logging, reporting and other administration features. Licensing is carried out via the webbased console and is a simple process merely consisting of entering the appropriate key. After the licence key validates, individual components and pattern files may be updated to ensure the latest and most current protection for the device. IGSA can protect and update without intervention. From the Update menu an Administrator may choose to configure and customise the different update settings provided with the update service. An Administrator may also choose to download updates manually if required. The navigation menu provides access to the various different categories and services supported such as summary statistics, logging, configuration settings for the various protocols supported, and device configuration. Each menu item expands to sub-categories that relate to the option selected. 12 Test Report

13 The web-based console is simple to navigate and descriptions are concise but helpful. This approach ensures that there is a short learning curve, which means that the Administrator is getting the most from the options, features and services provided by IGSA in a short period of time. Management options are sub-divided into self-explanatory menus with lots of on screen help available to aid less confident Administrators. Test Report 13

14 Configuration and Customisation The Content Scanning and Network Reputation Services menu items found under the Anti-Spam menu are key elements in the protection offered by IGSA - these enable an Administrator to control how IGSA should examine any potential Spam, and to determine the action that the solution should subsequentially take if Spam is detected. From these pages, scanning methods and actions for Spam may be configured to filter Spam against DNS blacklists, signature databases, and linguistic heuristics. Specifically, these include the main Trend Micro Anti-Spam engine, several Keyword Exceptions lists, an IP Profiler filter, an Approved and Blocked senders list that can be built by the company themselves, and Network Reputation Services (including the RBL+ and QIL databases). Configuring the Content Scanning on IGSA to scan SMTP traffic for unsolicited is a two-part process. A Spam detection rate level (Low, Medium, or High) needs to be selected and an appropriate action upon a trigger at this rate needs to be set. There are also optional settings that may be configured by the Administrator including the Approved Senders, Blocked Senders and Keyword Exception lists. 14 Test Report

15 The Low Spam detection level is the most unrestricted and default level of Spam detection that means IGSA will filter only the most obvious and common Spam messages but it is highly unlikely that it will filter false positives. The Medium Spam detection level is utilised by IGSA to monitor at a high level of Spam detection with a moderate chance of filtering false positives. The High Spam detection level is the most rigorous level of Spam detection and IGSA monitors all messages for suspicious files or text but this brings greater chance of false positives. Network Reputation Services also has low and high settings that utilise the Trend Micro Network Anti-Spam Services (RBL+ and QIL), to block Spam at the source. It accomplishes this by validating the IP address of the SMTP server sending the inbound mail to a list of known IP addresses. Both the Real-Time Black List and the QIL service are databases that contain the IP addresses of SMTP servers that originate Spam or are considered to be Spam open relay hosts. The QIL service also provides highly dynamic, real-time detection and blocking of currently active sources that may not yet have a history of sending Spam. For the duration of the training period and test concerned, each detection rate level for Low, Medium and High were individually selected to measure results for each of the settings over differing time periods. For IGSA to achieve optimum performance and best results, both the composite Spam scanning engine and the High setting in the Network Reputation Services screen need to be enabled. To aid statistical analysis, West Coast Labs engineers customised how the appliance handled mail regarded as Spam by setting the device to Pass all messages and prepend the subject line with an Test Report 15

16 Administrator defined string, for example (***SPAM***). This option enabled the engineers to quickly group together and analyse large amounts of and also to check for any messages incorrectly labelled as Spam. Other options available for each of the messages include Quarantine (that allows the device to deliver Spam to the user s Spam Mail folder), and Delete ( the appliance will entirely delete the message and any attachments). 16 Test Report

17 Reporting The Logs menu contains three links for Query, Settings and Maintenance that allow an Administrator to query logs based on certain criteria such as log type, protocol, time period and the number of entries displayed per page. These logs can be filtered for each of the various services supported by the device. Administrators can use many of these incorporated reporting utilities to generate useful status reports that summarise the overall performance of the device. A company may configure IGSA to notify users about Spam messages via , and the solution is also able to perform maintenance on logs, backup logs, or export logs to various alternative formats such as.csv. The Summary screen provides statistical information collected by the device for mail traffic that has been processed. This information may be filtered to make it simple to monitor the status of the device and the network over different periods of time including Today, Previous, Seven Days or Previous Thirty Days. Other useful data displayed on the Summary screen includes statistics for virus and malware detection, spyware/greyware detections, malicious code and various other reports about the common types of traffic (SMTP/POP3/HTTP/FTP). Test Report 17

18 If Spam logging is enabled, IGSA records Spam detections to the Anti- Spam: Content Scanning log or to the Anti-Spam: Network Reputation Services log. An Administrator also can export the contents of the Anti- Spam logs to alternative formats such as.csv for inclusion in external reports, or for further analysis in a spreadsheet application. 18 Test Report

19 Results Type of Mail Detected as Genuine Detected as Spam GENUINE 100% 0% SPAM 2% 98% Trend Micro s IGSA performed well, by delivering 100% of the genuine mail accurately and by rightly classifying 98% of the Spam mail. It is also worth noting that the service delivers a sizeable proportion of grey and list mail as genuine, which offers an organisation the flexibility and opportunity to define policies without missing mail that could potentially be business critical. West Coast Labs is pleased to announce that the Trend Micro s IGSA has reached the required standard for the Premium Anti-Spam Checkmark. Test Report 19

20 Conclusion The appliance is very straightforward to install, and can be quickly customised and configured with ease in a short period of time. The capability of IGSA of transparent functionality will be appreciated by company administrators, and both the administrators and the users alike will welcome the multi-layered protection against Spam that brings less interruptions to the busy working day. Configuration and management of the solution is easily achieved using the SSL encrypted web-based console. The interface for IGSA aids this greatly as it is sub-divided into self-explanatory menus with concise help dialogs. This ensures that administrators of the device do not have to have any specialist knowledge in order to get the device to function at the highest level of capability. The monitoring options available ensure that IGSA can be kept running at optimum performance at all times. The integration of the comprehensive protection and reporting utilities ensures that IGSA will certainly be a valuable asset to any small to medium sized business wanting to increase workplace productivity and to protect against unsolicited 20 Test Report

21 Security Features Buyers Guide IGSA deploys quickly to deliver the most complete, all-in-one defense from viruses, spyware, spam and other threats, before they can damage your network.igsa is designed for medium-sized businesses with between users, with an installed firewall/vpn solution, an IT staff with limited security expertise, and values simplicity and is cost conscious. Benefits to IT staff as stated by Trend Micro Fast, easy installation of appliance with a hardened operating system, pre-installed Secure Content Management software running on performance-optimized hardware One vendor to call saves you save time and money if you have a question Simplifies cleanup of spyware and malware from client desktops Add additional layer of security without impacting existing firewall/vpn Maximizes network uptime ensuring business continuity Updates automatically reducing your management time Reduces storage requirements by blocking more spam Increases network bandwidth by controlling employee Internet activity Enable end-user self-help for sorting spam from work and cleanup of spyware Test Report 21

22 Benefits to the Business Owner as stated by Trend Micro Saves you money - Quickens return on investment Protects information assets - Helps achieve regulatory compliance Helps ensure business continuity - Appliance will fail open if a problem occurs Limits legal liability - Helps with URL Filtering, limit access to objectionable sites Increases employee productivity - Improves employee satisfaction and therefore retention 22 Test Report

23 Security Features Buyers Guide IGSA Top Noteworthy Features All-in-one Internet Gateway Solution protecting both mail and Web with hardware, software, and support packaged together Award-winning Anti-virus and Spyware protection with automated desktop cleanup (Damage Cleanup Services) Multi-layered Spam Blocking with Reputation (AKA Network Reputation Service) removing the majority (up to 80%)of your spam burden, and an optimized spam scanning engine to handle the remainder Remote, Hosted Scanning Services for Spam and URL Filtering - Stop threats at the source, for better security and scanning detection - Offload processor-intensive features, for better appliance performance (blocking spam before it reaches your network gateway) Prevents Data leakage (personal information and confidential company data) through Inbound and Outbound Scanning Intuitive Web UI makes seriously powerful security-simple to live with and requires much less administration Ideal Branch Office Gateway Security solution with centralized management from TMCM (Trend Micro Control Manager) Hardware Flexibility and Scalability, license key upgrades mean no hardware-upgrade needed in the future Support of TrendLabs with 24/7 phone and online service, 2-hour virus support, and all backed by a global team of security experts working tirelessly on your behalf Test Report 23

24 US SALES T EUROPE SALES T GLOBAL HEADQUARTERS West Coast Labs William Knox House Britannic Way Llandarcy Swansea SA10 6EL, UK