e even Corporate security Guide for CIO s, IT managers and administrators Executive summary Contents

Transcription

1 Corporate security Guide for CIO s, IT managers and administrators Contents 1. security challenges Requirements for integrated security Component 1: anti-spam solution Component 2: anti-virus solution Component 3: firewall Integrated security checklist Integrated security: the eleven concept.. 8 Executive summary The triumph of as the main method of business communication has also brought a rise in risks associated with this medium. Today, corporate IT infrastructures are threatened by spam, viruses sent in and denial-of-service attacks. A central challenge faced by all companies today is securing businessrelated delivery no matter what the circumstances. A reliable defence against these complex threats requires a company to have an integrated security strategy resting on three basic principles: spam protection, virus protection and protection against system congestion. A range of issues and criteria must first be considered in choosing the right solutions. Awareness of these factors will help you choose the right security package for effective protection of your infrastructure. The eleven security concept makes integrated security a reality.

2 2 1. security challenges has become the main method of business communication in recent years. At the same time, has become one of the main sources of threats to the IT infrastructures of companies of all sizes. Safeguarding business-related delivery around the clock is the main challenge facing security today and is at the heart of any IT security strategy. The volume of sent and received on a daily basis and the never-ending increase of activity mean increasing risks for companies. The surge in volume has been caused chiefly by the relentless and rapid increase of spam. Spam strains the corporate infrastructure and pushes it to the limits of its capacity. The result: business-related delivery is impaired or even prevented. Another danger is posed by the suspicious and dangerous s themselves. Here the chief culprit is spam whose enormous quantities strain IT systems and often lead to the loss of business-related . Next are viruses that infect company computers and damage IT infrastructures, phishing attempts to compromise important or sensitive data, and denial-of-service attacks that can very quickly overwhelm an entire corporate network with congestion. Loss of important messages, infected networks and waste of working time fending off attacks or repairing the damages are only three consequences of these dangers. The biggest threats: Rapid growth in volume due to increase of spam Extreme peaks in demand (e.g. due to waves of spam) Viruses and other malware delivered via Compromisation of the corporate IT system, for example due to Trojans System congestion due to denial-of-services attacks (DoS) The most important consequences: Threat to the delivery of business-related Temporary blackout of all communication due to extreme peaks in demand Economic costs to the company from loss or delay of business-related s due to a flawed spam filter Damage to reputation due to lost business-related s Reduction in processing power due to growth in volume resulting in delayed delivery of messages Purchase of new hardware to manage mail volume Waste of working time, for example weeding out spam s and looking for lost messages System damage due to viruses delivered via Capture of a corporate network in a botnet spam appearance normalized on Jul Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep The development of spam from 2005 to 2008 (in a leading German company), Source: eleven

3 3 The facts: volume has been rapidly increasing since The main cause is the relentless increase in the volume of spam. The level of legitimate, individual has remained constant. The volume of spam received by leading German companies between July 2005 and April 2008 increased more than 10,000 percent. In many companies, the average proportion of spam in 2007 was around 95 percent of the entire volume of . Since the beginning of 2006, the average volume of data of incoming spam has quintupled. In addition there are more and more extreme peaks in demand that exceed the average capacity many times over. At peak times, the volume of unwanted data received by an individual company is up to 60 gigabytes a day. 2. Requirements for integrated security The dangers listed above mean that corporate security must meet the following challenges: Safeguarding legitimate and business-related communication even in periods of peak demand Protection against ever increasing strain on infrastructures due to the rapid increase in volumes of spam Reliable protection against spam, viruses and other malware The various threat scenarios are extremely complex and present numerous interrelated problems. Spam creates rising long-term stress, can be exploited in DoS attacks and carries viruses. This means an integrated security solution is essential for any type of company a solution that protects not just part of the system such as individual servers, but the entire corporate IT infrastructure. Integrated security consists of component parts that fight effectively against each threat individually. But they also work together and exploit synergistic benefits based on the resemblance and similarity of the various sources of risk. For example, viruses and spam have in common that they both appear as bulk mail. A spam filter built on these principles can be used to identify new viruses just after they are released usually many hours before a classic, signature-based virus scanner can. Based on the points above, we can identify three essential components that any effective security concept should include: A reliable anti-spam solution with a high spam recognition rate and zero false positives An effective spam filter reduces strain on the system because most (currently up to 95 percent) of the daily received is rejected. The spam recognition rate should be at least 99 percent. The second main task for the spam filter is to ensure that no business-related s are mistakenly rejected as spam and go missing (zero false positives). That can cause more financial damage to a company than the level of spam itself.

4 4 Reliable protection against viruses and other malware including early recognition of new virus outbreaks Viruses still pose a grave threat to corporate IT systems. A total anti-virus solution should reliably recognise known viruses and identify new viruses immediately after an outbreak. Here a combination of various scan techniques and early recognition of viruses by identifying new kinds of viruses during an outbreak (virus outbreak detection) is key. It s the only approach that can effectively limit the time delay between the first appearance of a virus and its recognition using a conventional virus scanner, which is usually several hours. firewall for safeguarding legitimate communication even in periods of peak demand In view of the constantly increasing levels of , an firewall is absolutely essential when it comes to safeguarding legitimate business-related communication around the clock and preventing the delay or even loss of important messages. It also ensures the safeguarding of business-related communication in periods of peak demand. At times of high strain, only messages classified as important are allowed through while less important but still legitimate s are temporarily delayed. Managed security services / SaaS: Outsourcing security services to specialised providers using SaaS (software as a service) or a managed services solution provides additional security. This kind of outsourcing ensures that spam, viruses and other malware never even reach the company server. infrastructure congestion and damage caused by possible gaps in security measures are completely eliminated. In addition, such solutions entail neither additional hardware nor costs for configuration of the company s IT, and require little administrative and maintenance effort. 3. Component 1: anti-spam solution Anti-spam solutions today have to do more than just filter out unwanted advertising s. Their job also entails: Safeguarding business-related communication by eliminating false positives Protecting the infrastructure from the ever increasing volume of caused by spam Complementing traditional anti-virus measures, since viruses are often spread through spam mails This complex challenge defines the essential criteria for an effective and reliable anti-spam solution. Spam filter check list: False positive rate The most important deciding factor regarding antispam solutions today is the false positive rate. This reflects how many legitimate s are wrongly rejected as spam. Business-critical s that are lost because of a faulty spam filter can cause a company considerable economic damage and hurt its reputation, or in the worst case, cause the loss of orders or clients. The false positive rate should therefore be as low as possible and not exceed percent (1:10 million). And the rate should be zero for individual, businesscritical mails. To compare: even assuming a low percent false positive rate, in a large corporation that receives a million s a day that would result in the loss of ten possibly business-related s daily. Spam recognition rate (false negative rate) A good spam filter shouldn t have a spam recognition rate below 99 percent or a false negative rate (unidentified spam mails) of under 1 percent. A high recognition rate guarantees that the user doesn t need to carry out significant amounts of additional work, the amount of spam manually weeded out by the user is limited, the risk of overlooking important messages is low, the infrastructure is not under strain from high spam levels.

5 5 Administration It is important that a spam filter require no maintenance by either the administrators or the user. A solution should be chosen that requires no regular updates and no complicated manual maintenance. Certain solutions should be avoided: those that the staff have to train themselves, those requiring constant maintenance of blacklists and whitelists and those that require lost s (false positives) be constantly fished back out. D. Scanning speed/mail processing rate Anti-spam solutions should prevent communication from being reduced or delayed even in periods of peak demand. What s more, a high processing rate must be guaranteed even when systems are strained. The faster the inspection process, the lower the risk of an impairment of communication. E. Straining resources The inspection process should take up as little processing capacity as possible. This avoids placing more strain on an infrastructure already dealing with high spam levels, which in turn avoids slowing down or impairing the infrastructure. F. Data protection Spam filters must comply with the strictest data protection guidelines. They should guarantee that unauthorised access to the content of s during the inspection process is impossible. The best solutions are those that disregard content during inspection. Encoding options should also be available to safeguard transmissions, for example during data exchange necessary to check spam. Common inspection methods: The anti-spam solutions available nowadays use a variety of procedures to recognise and filter out spam. Some solutions combine a number of different methods in order to maximise the spam filter s efficiency. Content-based solutions Content-based spam filters search content for words and phrases typical for spam. Some solutions use lists of suspect words or phrases, while others employ Bayesian filters that use the content to calculate the risk of it being spam. Content-based filters achieve high false positive rates and call for comprehensive databases that are constantly updated. Spammers get round filters like these by using different variations on words or by hiding the advertising message in images or attachments. Blacklisting IP-based blacklisting uses lists of addresses from which spam is known to be sent. The rise of botnets that use IP addresses usually active only for a short time has made this procedure more or less obsolete. Reputation-based filters The basic premise of these filters is to only accept s that come from trustworthy sources. The most common method is known as whitelisting, which uses lists of accepted communication partners (usually IP addresses). This procedure requires constant updating, is extremely error-prone and generates a high false positive rate. D. Filters with a checksum algorithm An alternative to is offered by filters that check s for the one characteristic common to all spam that they are sent out as bulk mail. A checksum algorithm is used to reduce each to a code made up of just a few bytes, which is then compared to the codes of other s. Used in tandem with other procedures (e.g. determining the number of IP senders) this means that spam is not only successfully identified as such, but can also be distinguished from legitimate bulk (e.g. newsletters). The bulk mail criterion also ensures reliable elimination of false positives.

6 6 4. Component 2: anti-virus solution Viruses are still considered the most threatening -borne pests. Companies are therefore urged to set up integrated anti-virus solutions to provide seamless protection against viruses, both old and new. An effective anti-virus solution consists of three basic components: Signature-based virus scanner A signature-based virus scanner is central to most antivirus solutions. Known viruses are assigned signatures that are recognised with every new appearance. To create a signature the viruses are searched for patterns and regularities characteristic of their virus type. Signature-based scanners are excellent for recognising known viruses, but operate on a reactive basis and need constant updating. For new kinds of viruses these updates usually take several hours to complete. Code-based virus protection Code-based methods make use of the crucial similarity in the way viruses and spam are spread the fact that they are sent in bulk. The process of checking for bulk mail criteria means viruses can be reliably identified and, in connection with other inspection methods, be distinguished from harmless spam. Virus outbreak detection The virus outbreak detection function recognises new viruses that have just been released as soon as they first appear. This eliminates the critical time gap between virus outbreak and scanner updating. Virus outbreak detection is a key addition to conventional virus scanners and completes the virus protection. 5. Component 3: firewall firewalls are essential to every security system. Their principal task is to safeguard businessrelated communication even in periods of peak demand. This is of particular importance in the face of targeted spam and denial-of-service attacks that break down unprotected infrastructures in no time at all. The following main risks should be considered: Denial-of-service attacks (DOS) Denial-of-service attacks attempt to break down infrastructures using targeted congestion. One way of doing this is to flood the targeted system with a huge number of s all at once. Mail bombing Mail bombing is one of the most common DOS methods. Mailbomb is the term used to describe a scenario where a huge amount of s are sent to a particular individual or system. s are sent on a massive scale so that space on the server is no longer sufficient to cache them all, or so that the server is overloaded and breaks down. Classic mail bombing is where an individual is bombarded with a huge number of identical s. Spam waves With the exponential rise in spam levels, new spam waves now have the same effect as targeted DOS attacks such as mail bombings, and can jeopardise the integrity of infrastructures as well. Mail loops Employees often set up their personal s to be forwarded to their company account, or vice-versa. Combined with out-of-office replies when staff are on holiday that may cause s to be sent back and forth automatically between accounts, the volume of s can go sky high and jeopardise the company s entire infrastructure.

7 7 Effective firewalls guarantee the safeguarding of legitimate communication when systems are under strain, while temporarily refusing less important s until later on. An firewall allows you to define how many s are accepted for a specific account or from a specific address. It is also possible to specify that in extreme peaks in demand only individual s are accepted while all others are delivered later. This solution uses, for example, a frequent partner list specifying the most frequent and important communication partners with whom communication must be safeguarded at all times. Combined with a spam filter and virus scanner, an firewall guarantees all-round, effective protection for corporate infrastructures. 6. Integrated security checklist When developing an security strategy and choosing security solutions for a company, the following criteria should always be taken into account. The aim should be to find a security package that fulfils all the criteria in equal measure. The three pillars of security Every security solution should cover the following three areas: an anti-spam solution, an anti-virus solution and an firewall. Safeguarding business-related communication Every solution should safeguard the secure and reliable delivery of incoming and outgoing businessrelated communication in any situation, even in times of peak strain. Seamless protection Different components should be well coordinated to provide seamless protection and to exploit synergistic benefits. An example of this is the implementation of anti-spam technology for detecting virus outbreaks. D. Zero false positives The most important and decisive criterion for spam filters is their ability to avoid losing business-related s. A good filter shouldn t exceed a false positive rate of percent. A recognition rate of at least 99 percent is assumed. E. Low strain on systems security solutions should need little processing capacity, operate at high speeds and guarantee a high mail processing rate. F. Little administration work A company s IT department should not be spending more than an hour a week on administration, maintenance and updating.

8 8 G. Data protection Every security solution should guarantee the maximum in data protection. This applies, for instance, to data being transmitted to external databases located with providers. Encoding should be available if the customer requires it for data transmission as well as for the inspection procedure itself, which ideally speaking should not require access to the content of the s being checked. 7. Integrated security: the eleven concept eleven is a leading security specialist based in Germany. It has developed an integrated security concept that safeguards companies businessrelated communication at all times, provides seamless protection against all the threats listed above and still is flexible enough to be adapted to every customer s individual requirements. The core components of eleven s security concept: expurgate spam filter and categorisation service expurgate checks incoming s using a checksum algorithm that reduces every to a code of just a few bytes, making it quick and easy to compare it against other s. The most important criterion for checking is an s bulk-mail characteristics. In conjunction with other inspection procedures, expurgate not only reliably filters out spam s (recognition rate > 99 percent), it also categorises all incoming s as, for example, legitimate and clean or viruses or newsletters. This bulk-mail criterion enables expurgate to prevent individual s from being wrongly rejected as spam (zero false positives). Virus protection eleven offers optimum protection against viruses by combining three virus protection components: The AntiVir signature-based virus scanner from eleven s technology partner Avira AntiVir recognises known viruses by their assigned signatures. When updated regularly, this solution provides reliable virus protection. Code-based virus protection The code-based scanning process is a useful complement to the signature-based virus scanner, and enhances the all-round detection capacity offered by the eleven virus protection package. The core of this inspection procedure is the bulk-mail criterion.

9 9 Virus outbreak detection The virus outbreak detection function uses expurgate technology to recognise new viruses that have just been released as soon as they first appear. This process takes advantage of the fact that at the beginning of their existence new viruses spread themselves in the same manner as a spam wave. The virus outbreak detection serves as a buffer upstream of conventional anti-virus solutions. The ensurance firewall The ensurance firewall reliably safeguards infrastructures from congestion caused by targeted denial-of-service attacks, for example. ensurance secures important, business-related communication around the clock, even at times of peak strain. Further options: ASP and in-house eleven solutions are available as ASP or in-house services. If the in-house solution is selected, all software is installed at the customer s offices, and only data exchange with the eleven database is otherwise required. If the ASP solution is selected, the protection and inspection procedures are carried out on eleven s own servers. The customer s incoming s are first routed to eleven s servers where they are checked and only then sent to the customer. This involves no noticeable delay. TLS encoding Encoding via standard transport layer security (TLS) offers secured data transfer as well as certification and clear identification of trustworthy communication partners; particularly useful for companies with heightened security needs, e.g. in the financial industry or in the health sector. Outbound check The mail relay function with outbound check searches outgoing traffic for spam and viruses, and reliably protects companies from unintentionally becoming a source of spam. Quarantine Unwanted s are in the first instance stored temporarily on eleven s quarantine servers. Users are informed of the s that have been stored for them in a digest, and can then determine which s they wish to receive from quarantine. Software development kit (SDK) eleven can supply expurgate in the form of a software development kit (SDK) for software development companies, ISPs and integrators. This allows expurgate categorisation technology to be integrated into proprietary software and solutions (for example mail servers). Freezing The freezing option enables suspicious-seeming s that cannot be clearly categorised as spam when first checked to be temporarily frozen. These mails are then checked a second time after a defined interval. This further enhances spam detection rates.

10 eleven SICHERHEIT MADE IN GERMANY eleven is Germany s leading security provider. expurgate is the unique spam filter and categorisation service that offers reliable protection against spam and phishing mails, recognises potentially dangerous s and differentiates between individual mails and any kind of bulk mail. What s more, expurgate also offers a powerful firewall and a comprehensive range of options for protecting against viruses. The expurgate service is used by more than 30,000 companies across the globe. An average of one billion s are checked and categorised by expurgate every day. Customers include large internet service providers like T-Online and freenet as well as numerous well-known businesses and organisations, among them the BMW Group, the Association of German Banks, RTL, Tobit Software AG and Wall AG. Further information can be found at eleven Gesellschaft zur Entwicklung und Vermarktung von Netzwerktechnologien mbh. All rights reserved. Distribution and reproduction even in excerpts without prior written consent by eleven are prohibited. Status: 05. January 2009