The Latest Internet Threats to Affect Your Organisation. Tom Gillis SVP Worldwide Marketing IronPort Systems, Inc.

Transcription

1 The Latest Internet Threats to Affect Your Organisation Tom Gillis SVP Worldwide Marketing IronPort Systems, Inc.

2 Agenda Spam Trends Staying Ahead Blended Threats

3 Spam Trends

4 What Do Dick Cheney & Bill Gates Have in Common? They both underestimated the enemy! The insurgency is in its last throes Dick Cheney May, 2005 Two years from now the spam problem will be solved Bill Gates January, 2004

5 Spammer s Launch A New Offensive

6 Trend #1: Spam Volumes Accelerate Monthly Spam Volume Est. Daily Spam Volume (Billions) Spam Volumes Spike in Q4 05 & Q Jul- 05 Aug- 05 Spt- 05 Oct- 05 Nov- 05 Dec- 05 Jan- 06 Feb- 06 Mar- 06 Apr- 06 May- 06 Jun- 06 Jul- 06

7 Trend #2: Image Spam Explodes % Spam with an Embedded Image Image Spam as % of Total Spam Jul- 05 Aug- 05 Spt- 05 Image spam is driving the spam increase Oct- 05 Nov- 05 Dec- 05 Jan- 06 Feb- 06 Mar- 06 Apr- 06 May- 06 Jun- 06 Jul- 06

8 Trend #2 (Cont d): Image Spam Gets Sneakier 1. Polka dots 2. Slice & Dice

9 Trend #3: URL Attacks Mutate More Rapidly A Trend Called Domain Kiting Is on the Rise Brings the cost of registering a domain to *zero* Domains are now advertised in spam for < 4hrs Makes URL Blacklists/whitelists ineffective * Source: IPWalk.com

10 Implications of Trends Spam is causing prospects renewed pain Existing solutions are falling short: 1. Unable to handle increasing mail volumes 2. Too slow to respond to new threats 3. Incapable of catching image spam

11 Staying Ahead of Spam

12 Advanced Spam Filter Design Preventive + Reactive = Defense in Depth Preventive Layer + Reactive Layer Immediate Reaction to Threats Extremely High Performance Coarse Outer Layer Blocks or Rate Limits Adapts Over Time Computationally Intensive Fine-grained Inner Layer Delete or Quarantine

13 Reputation Analysis Data Makes the Difference 150 Parameters Complaint Reports Threat Prevention in Realtime Spam Traps Message Composition Data Global Volume Data URL Lists Compromised Host Lists SenderBase Data Data Analysis/ Security Modeling SenderBase Reputation Scores -10 to +10 Web Crawlers IP Blacklists & Whitelists Additional Data

14 Reputation Filters Can Stop 80% of Hostile Mail at the Door. Known good is delivered Reputation Filtering Anti-Spam Engine Suspicious is throttled & spam filtered Incoming Mail Good, Bad, and Grey or Unknown Known bad is deleted/tagged Identity & reputation are used to apply policy Sophisticated response to sophisticated threats

15 Reputation Filters Dell Case Study Dell s challenge: Dell currently receives 26M messages per day Only 1.5M are legitimate messages 68 existing gateways running Spam Assassin were not accurate IronPort solution: Reputation Filters block over 19M messages per day 5.5M messages per day scanned by anti-spam engine Replaced 68 servers with 8 IronPort C60s Accuracy of spam filtering increased 10x Servers consolidated by 70% Operating costs reduced by 75% IronPort has increased the quality and reliability of our network operations, while reducing our costs. -- Tim Helmsetetter Manager, Global Collaborative Systems Engineering and Service Management, DELL CORPORATION

16 Broadening the Context with Web Reputation Effectiveness TODAY Where? Web Reputation Where does the call to action take you? Who? Reputation Who is sending you this message? How? Message Structure How was this message constructed? Time What? Message Content What content is included in this message? Content filtering techniques alone are inadequate reputation systems improved protection Combating new attacks demands Web reputation

17 Real Time Rule Generation IronPort Threat Operations Center SenderBase SECURITY MODELING SECURITY ANALYSTS Machine Generated Rules Threat Evidence Clustering Human Generated Rules 24 x 7, 32 languages Over 100,000 updates daily Context Adaptive Scanning Engine END-USERS

18 Customer Benefits Advantages Over Traditional Anti-spam Solutions Higher Employee Productivity 10X lower false-positive rate than competing solutions Eliminates need for quarantines or junk folders Lower Cost of Admin 100,000 rule updates per day Prevents admins from tweaking the filters to catch spam Low FP rate stops help desk calls; whitelist maintenance Enhanced Security Industry s first web reputation system Stops identity theft due to phishing & spyware Lower CapEx 2X higher throughput than any enterprise-class antispam solution Reduces ongoing hardware and maintenance costs

19 Image Spam Example Traditional Content Filters HOW? WHAT? No spam content found in message Doesn t match known signatures WHO? IP address not on any blacklists WHERE? Verdict UNKNOWN

20 Image Spam Example IronPort s CASE HOW? Message leaves trace of spamware tool WHAT? All text inside an image Random dots appear within the message Nearly identical color scheme in 100,000 s spamtrap msgs WHO? IP address recently started sending Message originated from dial-up IP address Sending IP address located in Russia WHERE? Verdict BLOCK

21 A Comparison of Spam Filter Technologies Catch Rate Heuristics Signatures OCR* IronPort CASE Performance False-positives Protection against future attacks Effective Not Effective * OCR = Optical Character Recognition

22 Blended Threats

23 The Root of All Evil

24 The New Battleground VIRUSES SPYWARE Jeremy Jaynes Convicted Spammer PHISHING SPAM

25 Malware Development & Distribution Well Funded & Devious Commercial Spyware Developer Free AV Program Download Covertly Installs Spyware

26 Today s Corporate Concerns: Malware Acceptable use issues eclipsed by malware-related security concerns Keyloggers Malware Distribution URLs Jump 400% in 2005 Total Reported Source: idefense Labs, November 2005 Source: 3 rd party Vendor Research, Q % of all enterprise desktop computers are infected (IDC) 25% of client s help desk time is spent dealing with spyware

27 Application-Specific Security Gateways With Common Security Database and Management Framework Internet SenderBase (the common security database) APPLICATION- SPECIFIC SECURITY GATEWAYS Security Gateway WEB Security Gateway INSTANT MESSAGING Security Gateway VOIP Security Gateway LAN/WAN MANAGEMENT Controller

28 IronPort: Comprehensive Gateway Security C-Series Security Appliance S-Series for Web Security Appliance M-Series Security Management Appliance SenderBase the world s first and biggest traffic monitoring network Comprehensive Protection