The Network Box Anti-Spam Solution
|
|
- Cynthia Golden
- 8 years ago
- Views:
Transcription
1 NETWORK BOX TECHNICAL WHITE PAPER The Network Box Anti-Spam Solution Background More than 2,000 years ago, Sun Tzu wrote if you know yourself but not the enemy, for every victory gained you will also suffer a defeat. Before you can effectively protect against a threat, you must understand that threat. CONTENT Background...1 Terminology of Spam Detection...2 Technologies of Spam Detection..3 The Network Box Scanner..5 The Network Box Anti-Spam System...6 Network Box Option For Spam...8 Anti-Spam Configuration...9 Conclusion...9 AUGUST 2005 No part of this publication including text, examples, or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Network Box Corporation Limited. Network Box Corporation Limited, 2nd Floor Star House, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong Telephone: Fax: So, what is spam? The dictionary definition is unsolicited junk generally advertising some product sent wide-scale to a mailing list or newsgroup. But that is just a broad definition, open to interpretation; one man's spam is another man's newsletter. If you ask an end-user, they will often define spam as mail I don't want very precise from that particular user's point of view, but not implementable in a shared computerized system. If you ask a lawyer, they'll point to emerging legislation such as the USA's CAN-SPAM Act of 2003 which runs to 21 pages of legalese to try to define the act of sending spam (and will still have to rely on cases and precedents over the coming few years, to further clarify its scope of enforcement). However, over the past few years, a consensus has begun to be reached, internationally, over what can be defined as spam and users should be protected against. Spam should have all the following attributes: 1. The message is commercial in nature (note that even messages advertising non-commercial offerings, but sent by a commercial entity, are considered commercial in nature). 2. The message is sent without the addressee's consent. The sender of the message should obtain verified permission from the recipient prior to transmission. 3. The message does not contain clear and accurate identification of the sender (including messages that fail to provide a valid return, operational, address or the headers of the messages are altered to mask the identity of the sender). 4. The message does not include a functional unsubscribe facility that will prevent further correspondence with the recipient in a timely manner. 1 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
2 There are essentially two types of addressee consent: 1. The recipient has a pre-existing business relationship with the sender, and has consented to receive messages containing individualized content specific to the recipient's account with the sender. 2. The recipient has undertaken a confirmed opt-in to a mailing list prior to transmission of the message (a confirmed opt-in being defined as a opt-in joining of the mailing list, with an additional step to confirm the accuracy of the recipient's address). While executable files can usually be clearly defined as virus-infected or clean, there is a significant gray area concerning spam. It should be clear, from the above, that while executable files can usually be clearly defined as virus-infected or clean, there is a significant gray area concerning spam. The above definitions do, however, provide a working test for whether a message is spam or not, and lay the foundation for implementing effective protection against this nuisance. Terminology for Spam Detection Spam detection involves being given an message, and making a determination if that message is spam or not (in this paper, we refer to messages that are not spam as ham ). If an message is determined to be ham, when it is actually spam, we call this a false-negative (or a missed spam ). If an message is determined to be spam, when it is actually ham, we call this a false-positive. The goal of any spam detection system is to maximize the rate of successful detection of spam, while minimizing the false-positive rate. The false positive rate is defined as the percentage of ham messages incorrectly determined to be spam, and is often represented as a figure such as 1 in 10,000 or 1 in 100,000 (which correspond to false-positive rates of 0.01% and 0.001% respectively). The success rate is defined as the percentage of spam messages successfully determined to be spam, and is often represented as a figure such as 95% or 98% accuracy. The ratio of spam-to-ham for individual users varies tremendously; so it makes little sense to base your ratios on such a varied baseline. Note that the success rate is sometimes quoted as the percentage of all s successfully marked as spam, which leads to confusion in the marketplace and incomparable figures. The ratio of spam-to-ham for individual users varies tremendously; so it makes little sense to base your ratios on such a varied baseline. Putting this together into an example gives us the following: A company receives 10,000 messages. 6,000 of these are spam and 4,000 are ham. An anti-spam system correctly determines 5,850 of the spams to be spam (missing 150), but incorrectly determines 1 of the hams to be spam. The success rate is 5,850/6000 = 97.5% The false-positive rate is 1/4000 = 0.025% The spam ratio is 6000/10000 = 60% 2 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
3 Technologies for Spam Detection There are several technologies which can be used to detect whether a given message is spam or ham. A summary of these is given here: 1. Co-operative Spam Checksums This technique involved breaking apart a message, and taking cryptographic checksums of each component of the message. If the message is known to be spam, its components can be submitted to a centralized database with such an indication. To test a message, the database is queried to see if one or more checksums are already listed as spam. Such systems can return a confidence level (based upon the trustworthiness of individual contributors, and the number of contributors for a particular checksum). 2. Signatures and Spam Scoring Such systems use lists of signatures (often small strings of text, or regular expressions) which match aspects of spam messages. Each signature is given a score, and a total score kept for all matching signatures. The higher the total score, the more likely the message is to be spam. 3. White lists and Black lists A list of words/patterns which make a message ham can be maintained in a white list. Similarly, words/patterns which make a message spam can be maintained in a blacklist. If a message matches such lists, a determination can be made as to whether or not it is likely to be spam. 4. Heuristics By examining message structure, and recognizing certain known vulnerability exploits, tests can be designed to provide hints to a heuristic spam determination. 5. Real-Time IP Blacklists The headers contain a record of all the IP addresses of gateways that an message has passed through. These IP addresses can be tested against a realtime blacklists of gateways known to either (a) be known sources of spam, (b) be known open-relays (allowing third-party relating of messages), or (c) be known dial-up networks (which, some consider, should not be directly sending out s). Should the message originate, or pass through, such systems, it can be determined to be more likely to be spam. 6. Real-Time URL Blacklists A common technique used by spammers is to provide links to their websites inside messages. Such URLs can be extracted, and tested against a realtime blacklist of URLs known to be used by spammers. Should the message contain such a URL, it can be determined to be more likely to be spam. 7. URL to IP Mapping and Blacklists The list of URLs, from the message, can be processed through the Internet Domain Name System (DNS) to perform reverse-dns lookups and derive a list of IP addresses. These IP addresses can then be checked against a real time blacklist, to determine that the message is more likely to be spam. 3 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
4 8. URL Categorization Databases, such as Surf Control, have the ability to return a category for a particular URL. The list of URLs, from a message, can be processed through such databases, to determine a list of URL categories in the message. Scores can then be applied to certain categories, to determine a message as more likely to be spam (or to be blocked according to policy enforcement). 9. Domain Age Similar to realtime URL blacklists, spammers often register Internet domains, and then immediately use them, finally discarding them after a few weeks. Should the message contain a recently registered domain name, it can be determined to be more likely to be spam. 10. Bayesian Filtering Statistical (or Bayesian) filters can be used to automatically maintain word/ pattern white lists and blacklists, together with statistical probabilities as to whether the given word/pattern makes the message spam/ham; based on being taught from a collection of spam and ham. Subsequent messages can be tested against this database, to determine the probability that the message is spam. 11. Challenge/Response Systems Based on the premise that messages come from addresses that recipients have a pre-existing business relationship with, challenge-response systems enforce such a relationship. They maintain a database of sender+ IP address+ recipient tuples, to record who is permitted to send to each recipient. Should a message arrive from a previously unknown sender, that sender can be challenged (via or some other confirmation mechanism) to ensure that the address is not automated. Suchsystems typically quarantine a message until the sender confirms his identity. 12. Digital Signatures This technique is normally used to indicate that an message is ham, and is not used to determine spam, but it can be used to reduce the false-positive rate. The technique relies on the sender calculating a cryptographic digital signature of the entire message, and storing that signature in the headers. The receiver of the message can then determine if the digital signature matches the message itself, to authenticate the sender and message origin, and white list the message as ham. Individually, each of the above techniques is of limited value. But, taken together they form an effective anti-spam system. Individually, each of the above techniques is of limited value. But, taken together they form an effective anti-spam system. 4 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
5 The Network Box Scanner SCANNER Initialization Pre-Scan Analyze+Unpack Post-Unpack Anti-Virus Scan Anti-Spam Scan Policy Enforcement Scan Post-Scan Alerting The Network Box Internet Threat Protection system has the ability to comprehensively scan s for company policy conformance, viruses, intrusions, and spam. Let's examine the flow of through the scanner: 1. Initialization (preparation for the scan) 2. Pre-Scan (cleanup and selection of scanning system) 3. Analyze+Unpack (loop until message completely unpacked and analyzed) Analyze (analysis of message and embedded content sections) Unpack (unpacking of message structures and attached archive files) 4. Post-Unpack (cleanup of unpacking system) 5. Anti-Virus Scan (searching for viruses, by heuristics and signatures) Pre-Anti-Virus (preparation of anti-virus engines) Anti-Virus Scan on the Message (scan message body and headers) Anti-Virus Scan on Files (scan attach files) Anti-Virus Scan Content (scan attached content) Post-Anti-Virus (cleanup for anti-virus engines) 6. Anti-Spam Scan (searching for spam, by multiple engines and methods) Pre-Anti-Spam (preparation of anti-spam engines) Anti-Spam Scan on the Message (scan message body and headers) Anti-Spam Scan on Files (scan attached files) Anti-Spam Scan on Content (scan attached content) Post-Anti-Spam (cleanup for anti-spam engines) 7. Policy Enforcement Scan (enforcement of company policy) Pre-Policy (preparation of policy enforcement engines) Policy Scan on the Message (scan message body and headers) Policy Scan on Files (scan attached files) Policy Scan on Content (scan attached content) Post-Policy (cleanup for policy engines) 8. Post-Scan (cleanup for all engines) 9. Alerting (raising alerts) Pre-Alert (preparation for alerting) Alert (issuing of alert messages) Post-Alert (cleanup for alert engines) 10. Cleanup (final cleanup, reporting and logging) You can see that stage 6 of the scan provides for the anti-spam engines to hook into the scanning system and help decide if a message is spam or not. Cleanup 5 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
6 ANTI-SPAM SYSTEM 1. Crypto Sign Box The Network Box Anti-Spam System The Network Box anti-spam system currently (August 2005) consists of 21 anti-spam engines, and 175,000 signatures, covering all 12 anti-spam techniques explained in this white paper. The kernel of the anti-spam system maintains an overall spam score, a spam threshold (scores above which will be treated as a spam result), a whitelist and a blacklist flag. 2. Crypto Sign Out The anti-spam system hooks into the scanning process at several events, and works as follows: 3. Challenge-Response Whitelisting 4. Senders, Headers, Words Whitelisting 5. Senders, Headers, Words Blacklisting 6. Spammer URL Analysis 7. Spammer Checksum Analysis 8. Spam Assassin 1. Messages originating from Network Boxes are cryptographically signed. This confirms that the message was (a) sent from a Network Box, and (b) authenticates the sending Network Box identity. The Network Box as_whitehamsignbox anti-spam engine can automatically whitelist such messages. 2. Messages passing outbound through Network Boxes are cryptographically signed. This confirms that the message was (a) sent outbound via a Network Box, and (b) authenticates the gateway Network Box identity. The Network box as_whitehamsignout anti-spam engine can automatically white list such messages. 3. The Network Box as_spamcrwhitelist anti-spam engine recognizes messages from senders who have previously successfully passed a challenge-response challenge, and can automatically whitelist such messages. 4. The Network Box as_spamwhitelist anti-spam engine supports whitelists for senders, headers and words. If an message is found to match these whitelists, the message is whitelisted. 5. The Network Box as_spamblacklist anti-spam engine supports blacklists for senders, headers and words. If an message is found to match these blacklists, the message is blacklisted. 6. The analyse and unpack engines can extract a basic list of URLs found in both text and html sections of messages. These URLs are added to a list stored in the scanning system kernel. The Network Box as_spamhinturl engine compares these URLs against several blacklists (domain, url and IP based), and will raise a score indicating the message as likely to be spam, if found. This is run fairly early on in the scan process, to improve performance by easily blocking messages with known spammer URLs (without having to pass through later, CPU and network intensive, scanning engines). 9. URL IP Conversion 7. Each component section of the message is cryptographically checksummed, and the Network Box as_spammd5 engine checks such checksums against a known blacklist of spam checksums. If a component of the message matches, the Network Box can be configured to raise a score indicating the message as likely to be spam. 6 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
7 10. Phising, Hoax, Virus URL Analysis 8. The as_spamassassin engine uses the industry standard spamassassin engine to analyze the message. This engine performs heuristic, signature, realtime blacklist, co-operative checksum and Bayesian analysis, and produces scores which are added to the overall Network Box anti-spam score. Additional URLs found by spamassassin are also added to the list of URLs maintained by Network Box. 11. Spammer URL Analysis (Full) 12. Spammer New Domains 13. SurfControl URL Categorisation 14. Spammer URLs By Category 15. Porn URLs By Category 16. Hoax URLS By Category 17. Virus URLs By Category 18. Blank Detection 19. Aggressive Scoring 9. The Network Box as_url2ip engine uses the Internet Domain Name System (DNS) to convert the list of URLs found in the message into IP addresses. This list is stored in the kernel for later use. 10. The Network Box as_spamurl engine examines the URLs and IP addresses found in the message, and compares this against blacklists for phishing, hoax and viruses. If a match is found, the message is blocked as malicious. 11. The Network Box as_spamhinturl engine is then run again (this time based on the most comprehensive list of url and IP built up so far in the scanning process). The engine compares these URLs against several blacklists (domain, url and IP based), and will raise a score indicating the message as likely to be spam, if found. 12. The Network Box as_spamnewdomains engine runs, to check the registration records of domains in URLs mentioned in the message. Any domains registered more recently than a pre-defined threshold will raise a score indicating the message as likely to be spam. 13. In co-operation with Surf Control, the Network Box as_categorisepolicy engine then runs to categorize each URL mentioned in the message. The resulting list of categories is maintained in the scanning system kernel. 14. The Network Box as_spamcategories engine is run the check the category list, and raise spam scores, for each category, as defined in the configuration. 15. The Network Box as_porncategories engine is run the check the category list, and raise pornographic spam scores, as defined in the configuration. 16. The Network Box as_hoaxcategories engine is run the check the category list, and raise hoax spam scores, as defined in the configuration. 17. The Network Box as_viruscategories engine is run the check the category list, and raise virus spam scores, as defined in the configuration. 18. A recent problem is fragmented, blank messages (contain no subject or body). The Network Box as_spamblank engine detects such messages and will raise a score indicating the message as likely to be spam, if found. 19. The Network Box as_aggressive engine runs late in the scan process, and can raise the scores (by a configurable factor) to tune the anti-spam system to be more (or less) aggressive for certain types of spam. 7 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
8 20. Virus Spam Detection 21. Hoax Spam Detection 20. The Network Box as_spamvirus engine runs to check if the message has had any spam scores raised related to viruses. If found, the engine blocks the message as a virus spam. 21. The Network Box as_spamhoax engine runs to check if the message has had any spam scores raised related to hoaxes. If found, the engine blocks the message as a hoax spam. 22. Porn Spam Detection 22. The Network Box as_spamporn engine runs to check if the message has had any spam scores raised related to pornography. If found, the engine blocks the message as a pornographic spam. After the message has passed through all anti-spam modules, the system will make its spam determination based on the following rules: If the whitelist flag is set, the message is ham. Finish analysis. If the blacklist flag is set, the message is spam. Finish analysis. If the final score is greater than or equal to the threshold, the message is spam, otherwise the message is ham. The Network Box Anti-Spam System messages detected as spam can be treated in several ways (depending on protocol): PROTOCOL FUNCTION Standard POP3 Accelerated POP3 Standard IMAP4 Intercepted SMTP Transparent SMTP Add an X-Spam-Status header to the message Add an Spam-Check- Result header to the message Add a prefix to the subject line of the message Quarantine the message (on the Network Box hard disk Drop (silently discard) the message Redirect (change the recipient) the message Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes No Yes Yes No Yes No Yes Yes No No No Yes Yes For those spam s quarantined on the Network Box, the Network Box system can be configured to send daily/weekly summary reports to end-users, and can permit administrator or end-user release of spams from quarantine. 8 NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
9 Anti-Spam Configuration The Network Box system is extremely configurable. Individual engines can be enabled/disabled based on tests, including: Direction of the message (inbound or outbound) Whether the message is being filtered (eg; POP3, IMAP4) Whether the message is redirectable (eg; SMTP) Globally (ie; for everything) Based on the content of a message headers Based on the proxy handling the message (eg; SMTP, POP3) Based on a single recipient of the message Based on a recipient being one of the recipients of the message Based on the sender of the messages Based on the sender IP address Individual engine parameters can be set to adjust scores and weightings to suit end-user requirements. Conclusion The Network Box anti-spam solution is the most comprehensive and effective gateway anti-spam solution in the market today The Network Box anti-spam solution is the most comprehensive and effective gateway anti-spam solution in the market today. It provides 21 anti-spam engines, combining 11 different techniques and is backed by a database of over 175,000 signatures. It provides true defense-in-depth, in a single managed gateway appliance. Network Box Security Response, August NETWORK BOX CORPORATION LIMITED, 2ND FLOOR STAR HOUSE, 3 SALISBURY ROAD, TSIM SHA TSUI, KOWLOON, HONG KONG
The Network Box Anti-Spam Solution
The Network Box Anti-Spam Solution Background More than 2,000 years ago, Sun Tzu wrote: If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. Before you can effectively
Government of Canada Managed Security Service (GCMSS) Annex A-5: Statement of Work - Antispam
Government of Canada Managed Security Service (GCMSS) Date: June 8, 2012 TABLE OF CONTENTS 1 ANTISPAM... 1 1.1 QUALITY OF SERVICE...1 1.2 DETECTION AND RESPONSE...1 1.3 MESSAGE HANDLING...2 1.4 CONFIGURATION...2
eprism Email Security Appliance 6.0 Intercept Anti-Spam Quick Start Guide
eprism Email Security Appliance 6.0 Intercept Anti-Spam Quick Start Guide This guide is designed to help the administrator configure the eprism Intercept Anti-Spam engine to provide a strong spam protection
Intercept Anti-Spam Quick Start Guide
Intercept Anti-Spam Quick Start Guide Software Version: 6.5.2 Date: 5/24/07 PREFACE...3 PRODUCT DOCUMENTATION...3 CONVENTIONS...3 CONTACTING TECHNICAL SUPPORT...4 COPYRIGHT INFORMATION...4 OVERVIEW...5
Objective This howto demonstrates and explains the different mechanisms for fending off unwanted spam e-mail.
Collax Spam Filter Howto This howto describes the configuration of the spam filter on a Collax server. Requirements Collax Business Server Collax Groupware Suite Collax Security Gateway Collax Platform
FortiMail Email Filtering Course 221-v2.2 Course Overview
FortiMail Email Filtering Course 221-v2.2 Course Overview FortiMail Email Filtering is a 2-day instructor-led course with comprehensive hands-on labs to provide you with the skills needed to design, configure,
FortiMail Email Filtering Course 221-v2.0. Course Overview. Course Objectives
FortiMail Email Filtering Course 221-v2.0 Course Overview FortiMail Email Filtering is a 2-day instructor-led course with comprehensive hands-on labs to provide you with the skills needed to configure,
Analysis of Spam Filter Methods on SMTP Servers Category: Trends in Anti-Spam Development
Analysis of Spam Filter Methods on SMTP Servers Category: Trends in Anti-Spam Development Author André Tschentscher Address Fachhochschule Erfurt - University of Applied Sciences Applied Computer Science
Cloud Services. Email Anti-Spam. Admin Guide
Cloud Services Email Anti-Spam Admin Guide 10/23/2014 CONTENTS Introduction to Anti- Spam... 4 About Anti- Spam... 4 Locating the Anti- Spam Pages in the Portal... 5 Anti- Spam Best Practice Settings...
SPAM FILTER Service Data Sheet
Content 1 Spam detection problem 1.1 What is spam? 1.2 How is spam detected? 2 Infomail 3 EveryCloud Spam Filter features 3.1 Cloud architecture 3.2 Incoming email traffic protection 3.2.1 Mail traffic
www.pandasecurity.com 100% Malware-Free E-mail: A Guaranteed Approach
100% Malware-Free E-mail: A Guaranteed Approach 2 100% Malware-Free E-mail: A Guaranteed Approach Panda Security's Mail Filtering Managed Service Guarantees Clean E-mail Table of Contents Table of Contents...
eprism Email Security Suite
FAQ V8.3 eprism Email Security Suite 800-782-3762 www.edgewave.com 2001 2012 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks
Do you need to... Do you need to...
TM Guards your Email. Kills Spam and Viruses. Do you need to... Do you need to... Scan your e-mail traffic for Viruses? Scan your e-mail traffic for Viruses? Reduce time wasted dealing with Spam? Reduce
Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
2001 2014 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks are hereby acknowledged. Microsoft and Windows are either registered
Copyright 2011 Sophos Ltd. Copyright strictly reserved. These materials are not to be reproduced, either in whole or in part, without permissions.
PureMessage for Microsoft Exchange protects Microsoft Exchange servers and Windows gateways against email borne threats such as from spam, phishing, viruses, spyware. In addition, it controls information
Quarantined Messages 5 What are quarantined messages? 5 What username and password do I use to access my quarantined messages? 5
Contents Paul Bunyan Net Email Filter 1 What is the Paul Bunyan Net Email Filter? 1 How do I get to the Email Filter? 1 How do I release a message from the Email Filter? 1 How do I delete messages listed
Antispam Security Best Practices
Antispam Security Best Practices First, the bad news. In the war between spammers and legitimate mail users, spammers are winning, and will continue to do so for the foreseeable future. The cost for spammers
E-MAIL FILTERING FAQ
V8.3 E-MAIL FILTERING FAQ COLTON.COM Why? Why are we switching from Postini? The Postini product and service was acquired by Google in 2007. In 2011 Google announced it would discontinue Postini. Replacement:
escan Anti-Spam White Paper
escan Anti-Spam White Paper Document Version (esnas 14.0.0.1) Creation Date: 19 th Feb, 2013 Preface The purpose of this document is to discuss issues and problems associated with spam email, describe
eprism Email Security Appliance 6.0 Release Notes What's New in 6.0
eprism Email Security Appliance 6.0 Release Notes St. Bernard is pleased to announce the release of version 6.0 of the eprism Email Security Appliance. This release adds several new features while considerably
eprism Email Security Suite
FAQ V8.3 eprism Email Security Suite 800-782-3762 www.edgewave.com 2001 2012 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks
Anti-SPAM Solutions as a Component of Digital Communications Management
Anti-SPAM Solutions as a Component of Digital Communications Management Ron Shuck CISSP, GCIA, CCSE Agenda What is Spam & what can you do? What is the cost of Spam E-mail E to organizations? How do we
Trend Micro Hosted Email Security Stop Spam. Save Time.
Trend Micro Hosted Email Security Stop Spam. Save Time. How Hosted Email Security Inbound Filtering Adds Value to Your Existing Environment A Trend Micro White Paper l March 2010 1 Table of Contents Introduction...3
MDaemon configuration recommendations for dealing with spam related issues
Web: Introduction MDaemon configuration recommendations for dealing with spam related issues Without a doubt, our most common support queries these days fall into one of the following groups:- 1. Why did
Spam DNA Filtering System
The Excedent Spam DNA Filtering System provides webmail.us customers with premium and effective junk email protection. Threats to email services are rising rapidly. A Growing Problem As of November 2002,
Admin Guide Boundary Defense for Email Email Anti-Virus & Anti-Spam
Admin Guide Boundary Defense for Email Email Anti-Virus & Anti-Spam DOCUMENT REVISION DATE: October, 2010 Boundary Defense for Email Admin Guide / Table of Contents Page 2 of 34 Table of Contents 1 INTRODUCTION...
Reliable & Secure Email. Professional, Dependable, Complete Easy to Learn, Use and Grow
Reliable & Secure Email Professional, Dependable, Complete Easy to Learn, Use and Grow About this Presentation Summarizes primary purposes of email, plus the needs of email providers and users. Introduces
ANTI-SPAM SOLUTIONS TECHNOLOGY REPORT FEBRUARY 2006. SurfControl Email Filter. www.westcoastlabs.org
ANTI-SPAM SOLUTIONS TECHNOLOGY REPORT FEBRUARY 2006 SurfControl Email Filter 2 ANTI-SPAM SOLUTIONS TECHNOLOGY REPORT Contents SurfControl Email Filter Test objectives and scenario...3 Test network...4
The Leading Email Security Suites
The Leading Email Security Suites What is SpamSniper? The Leading Email Security Suites for Your Secure Messaging SpamSniper is the leading email security solution which locates in front of mail server
How to Use Red Condor Spam Filtering
What is Spam Filtering? Spam filtering is used to detect unsolicited and unwanted email. By looking for certain words in an email's subject line, or through suspicious word patterns or word frequencies
Technical Information www.jovian.ca
Technical Information www.jovian.ca Europa is a fully integrated Anti Spam & Email Appliance that offers 4 feature rich Services: > Anti Spam / Anti Virus > Email Redundancy > Email Service > Personalized
D3 TECHNOLOGIES SPAM FILTER
D3 TECHNOLOGIES SPAM FILTER The D3 Technologies spam filtering provides virus, attachment, and spam filtering services for email. We check all emails for viruses and malicious content, since we feel these
Email Migration Project Plan for Cisco Cloud Email Security
Sales Tool Email Migration Project Plan for Cisco Cloud Email Security 2014 Cisco and/or its affiliates. All rights reserv ed. This document is Cisco Conf idential. For Channel Partner use only. Not f
Solution Brief FortiMail for Service Providers. Nathalie Rivat
Solution Brief FortiMail for Service Providers Nathalie Rivat Agenda FortiMail for Internet Service Providers Outbound antispam to prevent blacklisting MMS routing for Mobile Operators Inbound antispam
Anti Spam Best Practices
39 Anti Spam Best Practices Anti Spam Engine: Time-Tested Scanning An IceWarp White Paper October 2008 www.icewarp.com 40 Background The proliferation of spam will increase. That is a fact. Secure Computing
Email Services Deployment. Administrator Guide
Email Services Deployment Administrator Guide Email Services Deployment Guide Documentation version: 1.0 Legal Notice Legal Notice Copyright 2013 Symantec Corporation. All rights reserved. Symantec, the
GFI Product Comparison. GFI MailEssentials vs Barracuda Spam Firewall
GFI Product Comparison GFI MailEssentials vs Barracuda Spam Firewall GFI MailEssentials Barracuda Spam Firewall Integrates closely with Microsoft Exchange Server 2003/2007/2010 Integrates closely with
Email Marketing Glossary of Terms
Email Marketing Glossary of Terms A/B Testing: A method of testing in which a small, random sample of an email list is split in two. One email is sent to the list A and another modified email is sent to
Email AntiSpam. Administrator Guide and Spam Manager Deployment Guide
Email AntiSpam Administrator Guide and Spam Manager Deployment Guide AntiSpam Administration and Spam Manager Deployment Guide Documentation version: 1.0 Legal Notice Legal Notice Copyright 2013 Symantec
Comprehensive Anti-Spam Service
Comprehensive Anti-Spam Service Chapter 1: Document Scope This document describes how to implement and manage the Comprehensive Anti-Spam Service. This document contains the following sections: Comprehensive
COMBATING SPAM. Best Practices OVERVIEW. White Paper. March 2007
COMBATING SPAM Best Practices March 2007 OVERVIEW Spam, Spam, More Spam and Now Spyware, Fraud and Forgery Spam used to be just annoying, but today its impact on an organization can be costly in many different
Symantec Hosted Mail Security Getting Started Guide
Symantec Hosted Mail Security Getting Started Guide Redirecting Your MX Record You have successfully activated your domain within the Symantec Hosted Mail Security Console. In order to begin the filtration
Is Spam Bad For Your Mailbox?
Whitepaper Spam and Ham Spam and Ham A Simple Guide Fauzi Yunos 12 Page2 Executive Summary People tend to be much less bothered by spam slipping through filters into their mail box (false negatives), than
Protect Your Enterprise With the Leader in Secure Email Boundary Services
Postini Perimeter Manager Enterprise Edition Protect Your Enterprise With the Leader in Email Boundary Services The Most Comprehensive, Flexible And Trusted Email Security Solution Perimeter Manager Enterprise
MailFoundry Users Manual. MailFoundry User Manual Revision: MF2005071100 Copyright 2005, Solinus Inc. All Rights Reserved
MailFoundry User Manual Revision: MF2005071100 Copyright 2005, Solinus Inc. All Rights Reserved Page 1 of 91 Chapter 1: Introduction... 4 What are Spam Profiles?... 4 Models Covered In This Manual... 4
Anti-Spam Measures Survey 2009. Pascal Manzano ENISA
Anti-Spam Measures Survey 2009 Pascal Manzano ENISA Do you remember what happen on June 25 th? Methodology Online questionnaire open from May until July 2009 Questionnaire used providers best practices
ESET Mobile Security Business Edition for Windows Mobile
ESET Mobile Security Business Edition for Windows Mobile Installation Manual and User Guide Click here to download the most recent version of this document Contents 1. Installation...3 of ESET Mobile Security
BARRACUDA. N e t w o r k s SPAM FIREWALL 600
BARRACUDA N e t w o r k s SPAM FIREWALL 600 Contents: I. What is Barracuda?...1 II. III. IV. How does Barracuda Work?...1 Quarantine Summary Notification...2 Quarantine Inbox...4 V. Sort the Quarantine
FireEye Email Threat Prevention Cloud Evaluation
Evaluation Prepared for FireEye June 9, 2015 Tested by ICSA Labs 1000 Bent Creek Blvd., Suite 200 Mechanicsburg, PA 17050 www.icsalabs.com Table of Contents Executive Summary... 1 Introduction... 1 About
Comprehensive Email Filtering. Whitepaper
Comprehensive Email Filtering Whitepaper Email has undoubtedly become a valued communications tool among organizations worldwide. With frequent virus attacks and the alarming influx of spam, email loses
Configuration Information
This chapter describes some basic Email Security Gateway configuration settings, some of which can be set in the first-time Configuration Wizard. Other topics covered include Email Security interface navigation,
Barracuda Spam Firewall
Barracuda Spam Firewall Overview The Barracuda Spam Firewall is a network appliance that scans every piece of email our organization receives. Its main purposes are to reduce the amount of spam we receive
Technical Note. FORTIMAIL Configuration For Enterprise Deployment. Rev 2.1
Technical Note FORTIMAIL Configuration For Enterprise Deployment Rev 2.1 April 7, 2009 Table of Contents 1 Introduction... 3 1.1 Objective... 3 1.2 Network deployment... 3 1.3 Convention... 3 2 System
Spam Filtering Methods for Email Filtering
Spam Filtering Methods for Email Filtering Akshay P. Gulhane Final year B.E. (CSE) E-mail: akshaygulhane91@gmail.com Sakshi Gudadhe Third year B.E. (CSE) E-mail: gudadhe.sakshi25@gmail.com Shraddha A.
Spam Testing Methodology Opus One, Inc. March, 2007
Spam Testing Methodology Opus One, Inc. March, 2007 This document describes Opus One s testing methodology for anti-spam products. This methodology has been used, largely unchanged, for four tests published
ContentCatcher. Voyant Strategies. Best Practice for E-Mail Gateway Security and Enterprise-class Spam Filtering
Voyant Strategies ContentCatcher Best Practice for E-Mail Gateway Security and Enterprise-class Spam Filtering tm No one can argue that E-mail has become one of the most important tools for the successful
Overview An Evolution. Improving Trust, Confidence & Safety working together to fight the e-mail beast. Microsoft's online safety strategy
Overview An Evolution Improving Trust, Confidence & Safety working together to fight the e-mail beast Holistic strategy Prescriptive guidance and user education, collaboration & technology Evolution of
Configuring MDaemon for Centralized Spam Blocking and Filtering
Configuring MDaemon for Centralized Spam Blocking and Filtering Alt-N Technologies, Ltd 2201 East Lamar Blvd, Suite 270 Arlington, TX 76006 (817) 525-2005 http://www.altn.com July 26, 2004 Contents A Centralized
Manual Spamfilter Version: 1.1 Date: 20-02-2014
Manual Spamfilter Version: 1.1 Date: 20-02-2014 Table of contents Introduction... 2 Quick guide... 3 Quarantine reports...3 What to do if a message is blocked inadvertently...4 What to do if a spam has
Groundbreaking Technology Redefines Spam Prevention. Analysis of a New High-Accuracy Method for Catching Spam
Groundbreaking Technology Redefines Spam Prevention Analysis of a New High-Accuracy Method for Catching Spam October 2007 Introduction Today, numerous companies offer anti-spam solutions. Most techniques
Purchase College Barracuda Anti-Spam Firewall User s Guide
Purchase College Barracuda Anti-Spam Firewall User s Guide What is a Barracuda Anti-Spam Firewall? Computing and Telecommunications Services (CTS) has implemented a new Barracuda Anti-Spam Firewall to
Symantec Hosted Mail Security Administration Guide
Symantec Hosted Mail Security Administration Guide Symantec Hosted Mail Security Administration Guide Copyright 2006 Symantec Corporation. All rights reserved. Federal acquisitions: Commercial Software
Spam Filter Message Center. User Guide
Spam Filter Message Center User Guide Powered by MX Resources, LLC 10573 W. Pico Blvd., #343 Los Angeles, CA 90064 (888) 556-7788 support@mxresources.com Introduction Introduction to the Postini Message
A D M I N I S T R A T O R V 1. 0
A D M I N I S T R A T O R F A Q V 1. 0 2011 Fastnet SA, St-Sulpice, Switzerland. All rights reserved. Reproduction in whole or in part in any form of this manual without written permission of Fastnet SA
An Overview of Spam Blocking Techniques
An Overview of Spam Blocking Techniques Recent analyst estimates indicate that over 60 percent of the world s email is unsolicited email, or spam. Spam is no longer just a simple annoyance. Spam has now
REPUTATION-BASED MAIL FLOW CONTROL
WHITE PAPER REPUTATION-BASED MAIL FLOW CONTROL Blocking Extreme Spam and Reducing False Positives Blocking unsolicited commercial email or spam is an increasingly important but difficult task for IT staff.
USER S MANUAL Cloud Email Firewall 4.3.2.4 1. Cloud Email & Web Security
USER S MANUAL Cloud Email Firewall 4.3.2.4 1 Contents 1. INTRODUCTION TO CLOUD EMAIL FIREWALL... 4 1.1. WHAT IS CLOUD EMAIL FIREWALL?... 4 1.1.1. What makes Cloud Email Firewall different?... 4 1.1.2.
Eiteasy s Enterprise Email Filter
Eiteasy s Enterprise Email Filter Eiteasy s Enterprise Email Filter acts as a shield for companies, small and large, who are being inundated with Spam, viruses and other malevolent outside threats. Spammer
IBM Express Managed Security Services for Email Security. Anti-Spam Administrator s Guide. Version 5.32
IBM Express Managed Security Services for Email Security Anti-Spam Administrator s Guide Version 5.32 Table of Contents 1. Service overview... 3 1.1 Welcome... 3 1.2 Anti-Spam (AS) features... 3 1.3 How
SurfControl EmailFilter for SMTP
ANTI SPAM SOLUTIONS TECHNOLOGY REPORT SurfControl EmailFilter for SMTP JANUARY 2007 www.westcoastlabs.org 2 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT CONTENTS SurfControl EmailFilter for SMTP SurfControl,
Email Quick Reference. Administrator Guide
Email Quick Reference Administrator Guide Email Services Quick Reference Documentation version: 1.0 Legal Notice Legal Notice Copyright 2015 Symantec Corporation. All rights reserved. Symantec, the Symantec
SPAM, VIRUSES AND PHISHING, OH MY! Michael Starks, CISSP, CISA ISSA Fellow 10/08/2015
SPAM, VIRUSES AND PHISHING, OH MY! Michael Starks, CISSP, CISA ISSA Fellow 10/08/2015 The Usual Players Indebtedness for driving on toll road Transaction receipts Notice to appear Major and Emerging Trends
1.1.1. What makes Panda Cloud Email Protection different?... 4. 1.1.2. Is it secure?... 4. 1.2.1. How messages are classified... 5
Contents 1. INTRODUCTION TO PANDA CLOUD EMAIL PROTECTION... 4 1.1. WHAT IS PANDA CLOUD EMAIL PROTECTION?... 4 1.1.1. What makes Panda Cloud Email Protection different?... 4 1.1.2. Is it secure?... 4 1.2.
Access Webmail, Collaboration Tools, and Sync Mobile Devices from Anywhere
P a g e 1 Steadfast email Steadfast email delivers Exchange-level mail server features at a lower cost. With lower end user requirements, superior stability, and reduced maintenance costs Steadfast email
Web. Anti- Spam. Disk. Mail DNS. Server. Backup
Email Server Appliance N ew generation of Server Appliance, AirLive, is designed for the SMB or enterprise that needs to install an easy maintained and fully functional mail server. It not only preserves
Spam Configuration/Training Guide
Spam Configuration/Training Guide GWAVA4 Copyright 2007. Beginfinite, Inc. All rights reserved. Content may not be reproduced without permission. http://www.gwava.com CONTENTS OVERVIEW... 4 SECTION OVERVIEW...
Implementing MDaemon as an Email Security Gateway to Exchange Server
Implementing MDaemon as an Email Security Gateway to Exchange Server Introduction MDaemon is widely deployed as a very effective antispam/antivirus gateway to Exchange. For optimum performance, we recommend
Why Content Filters Can t Eradicate spam
WHITEPAPER Why Content Filters Can t Eradicate spam About Mimecast Mimecast () delivers cloud-based email management for Microsoft Exchange, including archiving, continuity and security. By unifying disparate
Collateral Damage. Consequences of Spam and Virus Filtering for the E-Mail System. Peter Eisentraut 22C3. credativ GmbH.
Consequences of Spam and Virus Filtering for the E-Mail System 22C3 Introduction 12 years of spam... 24 years of SMTP... Things have changed: SMTP is no longer enough. Spam filters, virus filters are part
Why Spamhaus is Your Best Approach to Fighting Spam
Page 1 of 10 Executive Summary The spam problem is evolving and while overall spam volumes are down, the problems are getting worse. No longer just a nuisance wasting resources and time, spam is now a
the barricademx end user interface documentation for barricademx users
the barricademx end user interface documentation for barricademx users BarricadeMX Plus The End User Interface This short document will show you how to use the end user web interface for the BarricadeMX
Mod 08: Exchange Online FOPE
Office 365 for SMB Jump Start Mod 08: Exchange Online FOPE Chris Oakman Managing Partner Infrastructure Team Eastridge Technology Stephen Hall Owner & IT Consultant District Computers 1 Jump Start Schedule
Configuring Your Gateman Email Server
Configuring Your Gateman Email Server Your Gateman Lifestyle Server includes an Email Server that provides users access to email via an email client and via your web browser using your laptop and mobile
1 Accessing E-mail accounts on the Axxess Mail Server
1 Accessing E-mail accounts on the Axxess Mail Server The Axxess Mail Server provides users with access to their e-mail folders through POP3, and IMAP protocols, or OpenWebMail browser interface. The server
ExchangeDefender. Understanding the tool that can save and secure your business
ExchangeDefender Understanding the tool that can save and secure your business OVERVIEW The purpose of this Startup Guide is to familiarize you with ExchangeDefender's Exchange and SharePoint Hosting.
SPAMfighter SMTP Anti Spam Server
SPAMfighter SMTP Anti Spam Server Users Manual Copyright SPAMfighter ApS 2005 Revised 4/27/2006 1 Table of Contents 2 Terminology...3 3 Technology...4 3.1 Tunneling and Interception...4 3.2 Content Classification...5
Spam Filtering at CERN Emmanuel Ormancey - 23 October 2002
Spam Filtering at CERN Emmanuel Ormancey - 23 October 2002 23 October 2002 Emmanuel Ormancey 1 Topics Statistics Current Spam filtering at CERN Products overview Selected solution How it works Exchange
The Guardian Digital Control and Policy Enforcement Center
Protects Against The Guardian Digital Control and Policy Enforcement Center P R O T E C T S A G A I N S T : Viruses Unsolicited Junk Email Malicious Code Internet Fraud & Phishing Hazardous File Attachments
When Reputation is Not Enough: Barracuda Spam & Virus Firewall Predictive Sender Profiling
When Reputation is Not Enough: Barracuda Spam & Virus Firewall Predictive Sender Profiling As spam continues to evolve, Barracuda Networks remains committed to providing the highest level of protection
How To Protect Your Email From Spam On A Barracuda Spam And Virus Firewall
Comprehensive Email Filtering: Barracuda Spam & Virus Firewall Safeguards Legitimate Email Email has undoubtedly become a valued communications tool among organizations worldwide. With frequent virus attacks
Spam blocking methods and experiences
Spam blocking methods and experiences Linuxdays Luxembourg 2003 christian mock http://www.tahina.priv.at/~cm/talks/spamblocking.{sxi,pdf} version 1.3 contents how spam is sent
EFFECTIVE SPAM FILTERING WITH MDAEMON
EFFECTIVE SPAM FILTERING WITH MDAEMON Introduction The following guide provides a recommended method for increasing the overall effectiveness of MDaemon s spam filter to reduce the level of spam received
Global Reputation Monitoring The FortiGuard Security Intelligence Database WHITE PAPER
Global Reputation Monitoring The FortiGuard Security Intelligence Database WHITE PAPER FORTINET Global Reputation Monitoring PAGE 2 Overview Fortinet s FortiGuard Security Services delivers two essential
AntiSpam QuickStart Guide
IceWarp Server AntiSpam QuickStart Guide Version 10 Printed on 28 September, 2009 i Contents IceWarp Server AntiSpam Quick Start 3 Introduction... 3 How it works... 3 AntiSpam Templates... 4 General...
Solutions IT Ltd Virus and Antispam filtering solutions 01324 877183 Info@solutions-it.co.uk
Contents Reduce Spam & Viruses... 2 Start a free 14 day free trial to separate the wheat from the chaff... 2 Emails with Viruses... 2 Spam Bourne Emails... 3 Legitimate Emails... 3 Filtering Options...
MailScanner Tips for NOCO Hosting Clients
MailScanner Tips for NOCO Hosting Clients March 2014 1) cpanel MailScanner Configuration With the MailScanner service you can control what happens to spam and viruses by changing the configuration in your
Software Engineering 4C03 SPAM
Software Engineering 4C03 SPAM Introduction As the commercialization of the Internet continues, unsolicited bulk email has reached epidemic proportions as more and more marketers turn to bulk email as
FortiMail Email Filtering. Course 221 - for FortiMail v4.0. Course Overview
FortiMail Email Filtering Course 221 - for FortiMail v4.0 Course Overview FortiMail Email Filtering is a 3-day instructor-led course with comprehensive hands-on labs to provide you with the skills needed
FTA Computer Security Workshop. Secure Email
FTA Computer Security Workshop Secure Email March 8, 2007 Stan Wiechert, KDOR IS Security Officer Outline of Presentation The Risks associated with Email Business Constraints Secure Email Features Some