Webinar: Reputation Services The first line of defense. July 26, 2005

Transcription

1 Webinar: Reputation Services The first line of defense July 26, 2005

2 Speakers Richi Jennings - Moderator Richi Jennings Associates Dave Rand Chief Technologist, Internet Content Security Trend Micro John Maddison Sr. Director, Network Security Services Group Trend Micro 2

3 Agenda 1. State of Today 2. Sender Authorization 3. Reputation Today and Future 4. Network Reputation Services 5. Q&A 3

4 The Spam Threat is Evolving Spam continues to increase in volume Spammers are more dynamic and automated (botnets: networks of zombies) Current solutions are effective, but being pushed to their limits the arms race continues false positives limit filter accuracy Need a better way to identify the sender Vision: spam goes away (economics) Richi Jennings Associates 4

5 The Need for Sender Authorization Can t trust any part of the envelope Can t even trust inbound IP address any more Need to evolve how we look at and manage Sender authorization allows for Reputation Richi Jennings Associates 5

6 Analogy Credit Card Rating System Authorization a person holds a credit card in their hand Buyer X Store Credit Authority Richi Jennings Associates 6

7 Analogy Credit Card Rating System Authentication does the credit card belong to this person? does the signature match? does their ID match? Richi Jennings Associates Store Buyer X Credit Authority 7

8 Analogy Credit Card Rating System Reputation does this person have good or bad credit history? does this transaction fit the account s pattern? has the card been reported stolen? Richi Jennings Associates Store Buyer X Credit Authority 8

9 Sender Authorization What? Why? How? Who? Richi Jennings Associates 9

10 What? A stronger way to tell who is ing me Is that forged? Richi Jennings Associates 10

11 Why? Should anyone expect 1 st class delivery? in other words: do I have an equal right to someone who I don t know? no, not any more: spam has seen to that Authorization isn t a solution to spam, but provides a better basis for whitelists and blacklists we can extend simple lists into reputation services Richi Jennings Associates 11

12 Who? Jim Miller / Paul Vixie / David Green Hadmut Danisch (RMX) Gordon Fecyk (DMP) IETF (ASRG; MARID) Meng Wong of Pobox (SPF) Microsoft (Caller ID for ) Yahoo! (DomainKeys) Cisco (IIM) Richi Jennings Associates 12

13 How? Alphabet soup: SPF/CallerID/SenderID/DomainKeys/IIM/DKIM Simply, when receiving If the sender claims to be we want to know if this is true or a forgery So look up example.com to see if the sending server is authorized to transfer its mail Richi Jennings Associates 13

14 Summary Sender authorization isn t a solution to spam But it gives us a better idea of who s trying to send It provides a foundation for network reputation services Richi Jennings Associates 14

15 Webinar Reputation Services, the first line of defense Dave Rand Chief Technologist of Internet Content Security Trend Micro

16 Authorization is not Authentication Authorization Prevents the address from being forged Doesn t prevent PCs from being compromised Zombies can still send from authorized domains Doesn t prevent mis-applied reputations Honest high-volume senders can still be marked as spam by some reputation systems Human element is needed for checks and balances of the system A fully automated system will have false positives Existing Authentication proposals are really just Authorization There is no way to truly authenticate the sender Iris scanning, finger printing technologies are a step in that direction If your kid uses your credit card at the video store, is he authorized or authenticated? If he is able to use it, he wasn t authenticated. 16

17 Sender Authorization As we have heard Industry is committed to developing a standard Leading ISPs, MTA, Anti-spam/Messaging, ESPs Status: implementation & real-world testing Expect a 2-part solution IP for header/domain authorization CSV or Sender ID or SPF Cryptographic for content Domain Keys / IIM 17

18 Reputation A rating system that tells subscribers whether an authorized source of is a known good source, a known spammer, an unknown source, etc. Enables the receiver to make informed decisions 18

19 IP-Level Reputation Today s Reputation Systems are based on IP-address We do not have an accurate way to authorize the sender Blacklists/DNSBLs Receiver pays for critique Ex: Trend Micro Network Reputation Services, Spamhaus Whitelists/Accreditation Systems Sender pays for endorsement Ex: Habeas, Bonded Sender Sender Authorization will allow for the next step Domain-level (or individual) Reputation There will still be a need for IP Reputation to protect the Authorization System 19

20 Reputation Flow IP number of sending server not authentic or known bad Unknown source Categorically Block IP Reputation Known Spamming Behavior Sender Authorization - Authenticated Mail Sender Domain Reputation - Known Behavior Reputation as spammer Questionable spam reputation, or anomalous behavior Filter Spam clean reputation and normal behavior Categorically Pass 1. IP Reputation clears out the obvious spam 2. Sender Authorization confirms the sender s domain 3. Domain Reputation applies knowledge to the sender Can decide to block, filter or pass 4. Content Filtering removes the gray/questionable messages 20

21 Domain-level Reputation With sender authorization, can now apply domain-level Reputation Comprehensive profile of the domain Length of DNS registration Outbound mail volume Inclusion on block lists Affiliation with Accreditation services Reputation of network and registrar Provide information and methodology to tailor to meet the individual organization s needs 21

22 Reputation more than just spam Protects the Network BGP poisoning BGP hi-jacking and network overrides Compromised PCs and hosts Protects Online Transactions Passwords Confidential/Personal information ecommerce (B2B, B2C) Banking and payment processing 22

23 Summary IP Reputation protects the network edge today, but a more accurate method is needed to protect the domain Sender Authorization will allow for application of Domain Reputation A multi-level end-to-end solution will be the most effective against spam in the years to come Domain Reputation can protect more than just ; this opens the door to greater online security and protection services 23

24 Webinar Reputation Services, the first line of defense John Maddison Senior Director, Network Security Services Trend Micro

25 Need for Greater Security at the Network Level To combat the speed of new threats and vector, increased protection at the network layer is required. Threats Vectors Defense Botnets (RPC) IM Vulnerabilities PHARMING Web TPN 25

26 Anti-Spam Building Blocks Spam Caught Today Spam Caught Future Who Are You? Are you Good? Probability of Being Good or Bad Quarantine Authorization Authentication Reputation Heuristic & Signature Filters Mail Servers End Users SPF Domain Keys DKIM CSV 26

27 Trend Micro Network Reputation Services 1. Trend Micro Network Anti-Spam Service A real-time dynamic database of currently active spam sources; e.g. Zombies Continually updates the database as new attacks emerge and only blocks sources as long as they are actively sending spam Utilizes advanced algorithms, heuristics, and real-time monitoring to identify suspect behavior Employs dynamic rating technology to identify spam sources that are not already in the RBL+ database 2. Trend Micro RBL+ Service A comprehensive database of IP addresses of known Spam sources, including open relays and open proxies Powered by Trend Micro Threat Prevention Network 27

28 Threat Prevention Network Managed by the Threat Analysis team (formerly MAPS) who research, collect, process, and distribute reputation ratings Utilizes strict policies and procedures for managing the addition and removal of IP addresses to the databases: A high-speed (OC3), high-availability network for the acquisition and dissemination of reputation information Global Access Network Global Spam Tracking

29 Trend Micro Network Reputation Services Blocks spam at the network edge, protecting the security of the infrastructure. 29

30 The Effectiveness of Network-centric Spam Control Assumptions: - 80% of incoming mail is spam - content filters stop 95% of spam Reputation/ Network Blocking Spam Filter Control by Filtering Incoming Mail 800 spam, 200 good All spam passed 800 spam, 200 good 39 spam, 200 good 20% of inbox is spam Control by Reputation Incoming Mail 800 spam, 200 good 75% of spam blocked 200 spam, 200 good 10 spam, 200 good 5% of inbox is spam 30

31 The Shift to Network Security Customer since April 2001 Network Anti-Spam Service Introduced Jan. 24, 2004 Before IP Blocking: - Filtering system overloaded - Messages are dropped/delayed After IP Blocking: - 85% of total spam blocked at the Gateway - 15% stopped by content filter (50% drop in processing) - Content filtering now more effective - All messages now being processed Snapshot from Monday, February 7, 2004 Source: - see current statistics! 31

32 Summary Spam fighting is moving to the Network Edge with Reputation Services Content filtering is being overwhelmed by the levels of spam today Content filtering will be necessary to review the gray-area messages Expanded Reputation Services will include more network information than just the IP A multi-level end-to-end reputation solution will be the most effective against network borne threats in the years to come For a 30-day trial of Trend Micro s Network Anti-Spam Service: 32

33 In Conclusion Sender authorization isn t a solution to spam But it provides a foundation for network reputation Imagine a world where spammers can t hide behind forged addresses send bulk mail from newly-minted domains take over your PC and send bulk mail pretend to be ebay or your bank That s what network reputation services promise Richi Jennings Associates 33

34 34

35 Contact Richi Jennings Richi Jennings Associates or John Maddison Dave Rand 35