IronPort Security Products

Transcription

1 IronPort Security Products PROTECTING OVER 350 MILLION BOXES WORLDWIDE Mirko Schneider, IronPort Systems Soft-Tronik Security Day, Bratislava June 6 th 2007 I need to say that the appliance is the best system that I ve been testing for our magazine since I need to find a way to bring it out objectively. Otherwise nobody will believe me... (an editor of a German IT magazine, Feb 2006)

2 Who is IronPort? Founded by pioneers from in 2000 from Hotmail, ListBot, Yahoo idea: building the fastest and strongest gateway appliance based in USA, California, Silicon Valley Investors: General Motors, Chevron-Texaco, NTT, Menlo Ventures, Allegis Capital raised over 90 million USD Worldwide 500+ employees 75 in Europe (UK, Germany, Sweden, France, Spain, Italy) revenue 2005: ~ 70m USD, 2006: ~125m USD With Soft-Tronik in CZ/SK since 2006

3 Hot News: CISCO acquires IronPort

4 The Principles of Industry Leadership Analyst Leadership Recognized as the leader by Gartner, Meta, Radicati, IDC, Forrester, Bloor Customer Leadership 52 of the World s Largest 100 Companies 20+% of Global of the 15 largest ISPs Technology Leadership First with custom, high performance MTA First with Reputation Filtering First with Virus Outbreak Filters Global Leadership Operations in 35 countries, 600+ partners IronPort infrastructure currently operating in 75+ countries

5

6 Success in Czech Republic Czech News Agency (ČTK) - customer since December a case study available soon! UPC Czech Republic - customer since December 2006 E.ON Czech Republic - customer since December 2006 EZPADA Czech Republic - customer since December 2006 Air Navigation Services (RLP) - customer since March 2007

7 IronPort: Technology Leadership Magic Quadrant for Security Boundary 2006 Source: Gartner RAS Core Research You need that competitive analysis? Mail me at

8 IronPort gets stronger! After PostX acquisition announcement Nov 06: Regard this acquisition as a positive enhancement that improves IronPort's competitive position... However, consider switching to IronPort at the next technology "refresh" to reduce administration overhead and costs... After CISCO acquisition announcement Jan 07: Place Cisco/IronPort at the top of your shortlists...

9 IronPort Gateway Security Products IronPort SenderBase Internet Security Appliance WEB Security Appliance Security MANAGEMENT Appliance

10 IronPort Security Appliances High Performance Security Appliances Stopping Spam, Viruses, and Enforcing Compliance IronPort X1050 IronPort C100 IronPort C350/C650

11 Product Consolidation at the Network Perimeter For Security, Reliability and Lower Maintenance Before IronPort After IronPort Internet Internet Firewall Firewall MTAs Anti-Spam Anti-Virus Policy Enforcement IronPort Security Appliance Mail Routing Groupware Groupware Users Users

12 IronPort Architecture for Multi-Layered Security MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM

13 IronPort AsyncOS Unmatched Scalability and Security MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM AsyncOS scalable and secure OS optimized for messaging Advanced Controls protect reputation and downstream systems Standards-based Integration replaces legacy systems with ease

14 IronPort AsyncOS Revolutionary Platform Traditional Gateways And Other Appliances IronPort Security Appliance 200 Incoming/Outgoing Connections Low Performance/ DoS Potential 10,000 Incoming/Outgoing Connections High Performance/ Sure Delivery Single Queue For all Destinations Queue Backup Delays All Mail Per-Destination Queues Fault-Tolerance and Custom Control

15 Advanced Controls Only Available from IronPort Destination Controls Virtual Gateway Technology? Internet New Company Bounces Internet Protect Your Groupware Servers Rate Limit Mail Sent Per Destination Enforce TLS Encryption Per- Destination Safeguard Your Reputation Send Different Types of Mail Via Separate IPs IronPort Patent Pending Technology

16 Multi-layer Spam Defense Best of Breed MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM IronPort Reputation Filters the outer layer defense IronPort Anti-Spam - stops the broadest array of threats spam, phishing, fraud

17 Spam volumes grow 70 Average Daily Spam Volume (billions msgs) % Okt 05 Nov 05 Dez 05 Jan 06 Feb 06 Mrz 06 Apr 06 Mai 06 Jun 06 Jul 06 Aug 06 Sep 06 Okt 06

18 Image Spam Explodes % Spam with an Embedded Image % % 0 Okt 05 Nov 05 Dez 05 Jan 06 Feb 06 Mrz 06 Apr 06 Mai 06 Jun 06 Jul 06 Aug 06 Sep 06 Okt 06

19 Spam Gets Sneakier Image Spam! 1. Polka dots 2. Slice & Dice

20 New Spam Attacks Spam Techniques Even More Difficult to Combat Image Spam 2.0 Attempts to mask itself as a legitimate picture by adding greeting card like border Inserts shapes such as rectangles and pies to spoof powerpoint / excel charts Wavy text more difficult for OCR technologies to decipher ASCII Art Based Spam uses a series of numbers to spell out a stock symbol numbers randomized in different order for each to evade signatures similar to image spam in that there are no actual words in the for anti-spam engines to key on

21

22 Multi-Layered Security Preventive + Reactive = Defense in Depth Preventive Layer + Reactive Layer blocks ~ 80% of spam Immediate Reaction to Threats Extremely High Performance Coarse Outer Layer Blocks or Rate Limits Adapts Over Time Computationally Intensive Fine-grained Inner Layer Delete or Quarantine

23 IronPort SenderBase Network Global Reach Yields Benchmark Accuracy The Dominant Force in Global and Web Traffic Monitoring Results in Accuracy and Advanced Protection Spam Caught by Reputation IronPort CipherTrust BorderWare 40% 50% 80% Network Reach (Contributing Networks) IronPort CipherTrust BorderWare 4,000 8, ,000 5B+ queries daily and Web parameters 25% of the World s Traffic Virus Protection Lead IronPort McAfee, Trend, Symantec, Sophos, CA, F-Secure 13 hours* * 6/2005 6/ outbreaks identified. Calculated as publicly published signatures from the listed vendors. Source: and August 6, 2006

24 IronPort SenderBase Data Makes the Difference 150 Parameters Complaint Reports Threat Prevention in Realtime Spam Traps Message Composition Data Global Volume Data URL Lists Compromised Host Lists A Broad Data Set Drives Accuracy SenderBase Data Data Analysis/ Security Modeling SenderBase Reputation Scores -10 to +10 Web Crawlers IP Blacklists & Whitelists Additional Data

25 IronPort Reputation Filters Stop 80% of Hostile Mail at the Door. Known good is delivered Reputation Filtering (preventive) Anti-Spam Engine (reactive) Suspicious is rate limited & spam filtered Incoming Mail Good, Bad, and Grey or Unknown Known bad is deleted/tagged Reputation Filters is a switch point IronPort uses identity & reputation to apply policy Sophisticated response to sophisticated threats

26 Reputation-Based Filtering: A Powerful Technique Beyond blacklisting a granular view of behavior Scores calculated in real-time Pre-configured policies applied dynamically

27 IronPort Reputation Filters Dell Case Study Dell s challenge: Dell currently receives 26M messages per day Only 1.5M are legitimate messages 68 existing gateways running Spam Assassin were not accurate IronPort solution: Reputation Filters block over 19M messages per day 5.5M messages per day scanned by anti-spam engine Replaced 68 servers with 8 IronPort C60s Accuracy of spam filtering increased 10x Servers consolidated by 70% Operating costs reduced by 75% IronPort has increased the quality and reliability of our network operations, while reducing our costs. -- Tim Helmsetetter Manager, Global Collaborative Systems Engineering and Service Management, DELL CORPORATION

28 Multi-Layered Security Preventive + Reactive = Defense in Depth Preventive Layer + Reactive Layer Immediate Reaction to Threats Extremely High Performance Coarse Outer Layer Blocks or Rate Limits Adapts Over Time Computationally Intensive Fine-grained Inner Layer Delete or Quarantine

29 IronPort AntiSpam Broadens the Context with Web Reputation Effectiveness TODAY Where? Web Reputation Where does the call to action take you? Who? Reputation Who is sending you this message? How? Message Structure How was this message constructed? Time What? Message Content What content is included in this message? Content filtering techniques alone are inadequate reputation systems improved protection Combating new attacks demands Web reputation

30 URL No attachment - Payload delivered via web

31 IronPort SenderBase Network Global Reach Yields Benchmark Accuracy The Dominant Force in Global and Web Traffic Monitoring Results in Accuracy and Advanced Protection Spam Caught by Reputation IronPort CipherTrust BorderWare 40% 50% 80% Network Reach (Contributing Networks) IronPort CipherTrust BorderWare 4,000 8, ,000 5B+ queries daily and Web parameters 25% of the World s Traffic Virus Protection Lead IronPort McAfee, Trend, Symantec, Sophos, CA, F-Secure 13 hours* * 6/2005 6/ outbreaks identified. Calculated as publicly published signatures from the listed vendors. Source: and August 6, 2006

32 Web Reputation Data Makes the Difference Parameters URL Blacklists URL Whitelists URL Categorization Data HTML Content Data URL Behavior Global Volume Data Domain Registrar Information Dynamic IP Addresses Compromised Host Lists Web Crawler Data Network Owners Known Threats URLs Offline data (F500, G2000 ) Web Site History SenderBase Data THREAT PREVENTION IN REALTIME Data Analysis/ Security Modeling Web Reputation Scores (WBRS) -10 to +10

33 IronPort Anti-Spam Customer Leadership Trusted Throughout the World Installed in over 20% of Fortune 100 Companies Deployed at over 2,000 customers in over 40 countries

34 IronPort Anti-Spam Press Reviews 2007 Technology of the Year: Best Anti-Spam Jan 2007 Competitors tested: Symantec, Microsoft, Mirapoint, ProofPoint easy setup excellent spam filtering no tuning necessary the fewest false positives of any solution tested Anti-Spam Bake-Off Winner Dec 2006 Competitors tested: CipherTrust, Borderware, Sophos, SonicWall The superiority of IronPort... seems abundantly clear We did not have to rescue a single legitimate message (IronPort) is the absolute must from this test

35 Multi-layer Virus Defense Best of Breed MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM IronPort Virus Outbreak Filters stop outbreaks 13 hours ahead of signatures Sophos Anti-Virus signature based solution with industry leading accuracy

36 IronPort Virus Outbreak Filters First Line of Defense Early Protection with IronPort Virus Outbreak Filters

37 Traditional AV Solutions Aren t Responding Quickly Enough... Mytob-HJ: Bagle-GT: Virus Volume First AV Signature Available Virus Volume First AV Signature Available :00 9:00 14:00 19:00 0:00 Tim e (GMT) 5:00 10:00 15:00 20:00 23:45 3:30 7:15 11:00 Tim e (GMT) 14:45 18:30 22:15 FeebsDI-Q: Kukudro-A: Virus Volume First AV Signature Available Virus Volume First AV Signature Available 19:00 22:45 2:30 6:15 10:00 Tim e (GMT) 13:45 17:30 21:15 9:30 10:20 11:10 12:00 12:50 Tim e (GMT) 13:40 14:30 15:20 Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer Associates, F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used.

38 IronPort SenderBase Network First, Biggest, Best Reputation System Global and Web Traffic Monitoring What is going on RIGHT NOW? Over 100,000 contributing networks Over 20M IP addresses tracked globally View into over 25% of traffic Over 150 parameters tracked

39 Introducing Virus Outbreak Filters Mytob-HJ: 32 hrs 57 mins Lead Time! Bagle-GT: 18 hrs 28 mins Lead Time! Virus Volume VOF Protection Starts First AV Signature Available Virus Volume VOF Protection Starts First AV Signature Available 4:00 9:00 14:00 19:00 0:00 Tim e (GMT) 5:00 10:00 15:00 20:00 23:45 3:30 7:15 11:00 Tim e (GMT) 14:45 18:30 22:15 FeebsDI-Q: 21 hrs 59 mins Lead Time! Kukudro-A: 3 hrs 38 mins Lead Time! Virus Volume VOF Protection Starts First AV Signature Available Virus Volume VOF Protection Starts First AV Signature Available 19:00 22:45 2:30 6:15 10:00 Tim e (GMT) 13:45 17:30 21:15 9:30 10:20 11:10 12:00 12:50 Tim e (GMT) 13:40 14:30 15:20 Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer Associates, F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used.

40 How IronPort Virus Outbreak Filters Work Dynamic Quarantine In Action Messages Scanned & Deleted T = 0 T = 5 mins T = 10 mins T = 8 hours zip (exe) files -zip (exe) files -Size 50 to 55 KB. zip (exe) files Size 50 to 55KB Price in the name file Release messages if signature update is in place preventive protection reactive protection

41 IronPort Virus Outbreak Filters Advantage Virus Name Date Virus Description Lead Time (hh:mm) Kukudro-A 6/27/06 Virus that spreads via zipped word document. 3:38 Feebs.AG 6/21/06 Arrives as an attachment claiming to be sent via "Protected service. 17:46 Troj/Stinx-W 6/15/06 IRC backdoor Trojan. 11:12 Yabe.G 5/16/06 Trojan that attempts to download further malicious code. 13:09 Bagle-GT 4/21/06 Installs backdoor and communicates via HTTP, thus bypassing firewall filters. Mytob-HJ 4/19/06 Turns off anti-virus applications of infected PC to avoid detection. 18:28 32:57 Nyxem-D (Kama Sutra) 1/16/06 Deletes most documents on third day of every month. 1:27 Looksky.G 1/6/06 Installs keystroke loggers onto infected PCs. 35:40 Average lead time* over 13 hours Outbreaks blocked * 175 outbreaks Total incremental protection*.over 94 days *June 2005 July Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer * June Associates, 2005 July F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used.

42 IronPort Outbreak Filters Protect G2000 Company From MyDoom.BB MyDoom Variant MyDoom.BB (February 15, 2005) G2000 Company Protected By IronPort s Virus Outbreak Filters IronPort Threat Level Raised to 3 And Protection Starts 18:08 GMT First Anti-virus Signature Published 22:54 GMT (Next Day) 28 hours 46 minutes 6503 files quarantined 17:00 18:00 19:00 20:00 21:00 22:00 23:00 24:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00 9:00 10:00 11:00 12:00 13:00 14:00 20:00 21:00 22:00 23:00 24:00 February 15, 2005 February 16, 2005 Note: All times shown are in GMT $65K $200/desktop, 5% infected

43 IronPort Policy Enforcement Inbound/Outbound Content Filtering for Compliance MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM Flexible Policy Engine from Blocking Attachments to Enforcing Regulatory Compliance Compliance Solutions and Encryption keep communications private and secure

44 Flexible Policy Engine From Blocking Attachments to Enforcing Compliance Graphical Representation of Per-Recipient Policies LDAP Integration Reduces Need for Repetitive Modifications Customizable Notification Templates Robust Conditions and Actions

45 Compliance Solutions Next Generation Compliance Filters Pre-Packaged Policies and Lexicons for Common Regulations Multi-Category Pattern Matching Significantly Reduces False Positives High Performance TLS Encryption Configured Keeps Business Communications Private PRE-PACKAGED LEXICONS

46 Hot news: Teaming Up To Fix

47 IronPort Acquires PostX Global Reach And Innovative Technology The Dominant Force in Global and Web Security Combined with the leader in Encryption 8/10 of the world s largest ISPs 42/100 of the world s largest corporations 25% of the World s Traffic 450 employees #1 World s Largest Bank #1 F500 Largest Insurance Company #1 World s Largest Credit Card Company 60 employees

48 Encryption References

49 Authentication Superior Security and Identity Protection MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM DomainKey Signing - establishes and protects your identity on the Internet IronPort Bounce Verification protects from misdirected bounce attacks Directory Harvest Attack Prevention blocks attempts to steal directory information

50 The Misdirected Bounce Threat Makes Up 9% of all Internet * Misdirected Bounces Not Discernible From Legitimate Bounces Misdirected Bounces Not Discernible From End User Confusion: Legitimate Bounces Why did I receive this message? *Source: IronPort Threat Operations Center, INTERNET TRAFFIC EMERGENCY: SPAM BOUNCE MESSAGES ARE COMPROMISING NETWORKS, April 2006.

51 The Misdirected Bounce Threat Makes Up 9% of all Internet * Zombies Recipients: joe1@enterprise.com, jane88@enterprise.com Incoming Gateway Sender: billing@yourcompany.com RETURN TO SENDER yourcompany.com Millions of Misdirected Bounces Outgoing Gateway More than 55% of of F500s have experienced disruption of of service or or a total denial of of service due to to misdirected bounces *Source: IronPort Threat Operations Center, INTERNET TRAFFIC EMERGENCY: SPAM BOUNCE MESSAGES ARE COMPROMISING NETWORKS, April 2006.

52 IronPort Bounce Verification Protects Against Misdirected Bounce Attacks BV Internet BV + All Outgoing Mail Stamped Allowing Legitimate Bounces to be Identified on Return Transparent to End Users, No Industry Adoption Required Eliminates Help Desk Calls and End User Confusion Another IronPort Technical First"

53 Management for the Largest Enterprises MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM Security Manager unified policy management Security Monitor enterprise-class reporting system Management Interfaces simple integration and increased productivity

54 IronPort Security Manager Single view of policies for the entire organization Categories: by Domain, Username, or LDAP Allow all media files Quarantine executables IT Mark and Deliver Spam Delete Executables SALES Archive all mail Virus Outbreak Filters disabled for.doc files LEGAL Security Manager serves as a single, versatile dashboard to manage all the services on the appliance. -- PC Magazine 2/22/05

55 IronPort Centralized Management Log in anywhere, control everywhere Interface assures configuration consistency Apply changes to a machine, group, or cluster Test on single system, promote to cluster SJ1 Machine SJ2 Machine D1 Machine D2 Machine T1 Machine T2 Machine SJ3 Machine Bratislava Group D3 Machine Prague Group IRONPORT CLUSTER T3 Machine Berlin Group

56 IronPort Security Monitor Advanced Reporting System Integrated Real-Time Graphical Reports CSV Export Scheduled Delivery Search by Domain Security Monitor

57 System Monitoring Easy Integration with Existing Processes Alert Center Log Subscriptions Alert Subscriptions per Admin Distinct Areas of Management SNMP Exclusive IronPort MIB Integrates with any SNMP-compatible tools 20+ Log Types Supported Transfer via FTP, SCP, Syslog

58 IronPort Evaluation Policy Free evaluation for 30 days starts with activation of keys on unit can be extended on request any size and any way you get the right unit for your individual needs different ways of testing (life/ stealth, parallel, offline) full support, full functionality About 85% of users who evaluate become happy customers!

59 Get In Contact Mirko Schneider Channel Manager Eastern Europe & Russia IronPort Systems Munich / Germany Tel: Fax: Mobile: Web: mschneider@ironport.com