IronPort Security Products

Transcription

1 IronPort Security Products PROTECTING OVER 300 MILLION BOXES WORLDWIDE Mirko Schneider, IronPort Systems I need to say that the appliance is the best system that I ve tested for our magazine since I need to find a way to bring it out objectively. Otherwise nobody will believe me... (an editor of a German IT magazine, Feb 2006)

2 Who is IronPort? Founded by pioneers from in 2000 from Hotmail and Yahoo idea: building the fastest and strongest gateway appliance based in USA, California, Silicon Valley Investors: General Motors, Chevron-Texaco, NTT, Menlo Ventures, Allegis Capital raised over 90 million USD Worldwide 400+ employees 45 in Europe (UK, Germany, Sweden, France, Spain, Italy)

3 The Principles of Industry Leadership Analyst Leadership Recognized as the leader by Gartner, Meta, Radicati, IDC, Forrester, Bloor Customer Leadership 38 of the World s Largest 100 Companies 8 of the 10 largest ISPs US Armed Forces Technology Leadership First with custom, high performance MTA First with Reputation Filtering First with Virus Outbreak Filters Global Leadership Operations in 25 countries 600+ partners IronPort infrastructure currently operating in 75+ countries

4 IronPort: Technology Leadership Magic Quadrant for Security Boundary 2005 Source: Gartner RAS Core Research You need that competitive analysis? Mail me at

5 IronPort Security Appliances High Performance Security Appliances Stopping Spam, Viruses, and Enforcing Compliance IronPort X1000 IronPort C10 IronPort C300/C600

6 IronPort SenderBase Network Global Reach Yields Benchmark Accuracy The Dominant Force in Global and Web Traffic Monitoring Results in Accuracy and Advanced Protection Spam Caught by Reputation IronPort CipherTrust BorderWare 40% 50% 80% Network Reach (Contributing Networks) IronPort CipherTrust BorderWare 4,000 8, ,000 5B+ queries daily and Web parameters 25% of the World s Traffic Virus Protection Lead IronPort McAfee, Trend, Symantec, Sophos, CA, F-Secure 13 hours* * 6/2005 6/ outbreaks identified. Calculated as publicly published signatures from the listed vendors. Source: and August 6, 2006

7 Leading Edge Technology Reputation Filtering Sets off Industry Scramble February 16, 2003 IronPort SenderBase July 21, 2003 IronPort Reputation Filters November 9, 2004 Proofpoint MLX Dynamic Reputation May 23, 2005 Tumbleweed Recurrent Pattern Detection June 4, 2004 CipherTrust TrustedSource June 28, 2004 Symantec Brightmail Reputation Service June 14, 2005 Trend Micro Acquires Kelkea Reputation Product

8 Product Consolidation at the Network Perimeter For Security, Reliability and Lower Maintenance Before IronPort After IronPort Internet Internet Firewall Firewall MTAs Anti-Spam Anti-Virus Policy Enforcement IronPort Security Appliance Mail Routing Groupware Groupware Users Users

9 IronPort Architecture for Multi-Layered Security MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM

10 IronPort AsyncOS Unmatched Scalability and Security MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM AsyncOS scalable and secure OS optimized for messaging Advanced Controls protect reputation and downstream systems Standards-based Integration replaces legacy systems with ease

11 IronPort AsyncOS Revolutionary Platform Traditional Gateways And Other Appliances IronPort Security Appliance 200 Incoming/Outgoing Connections Low Performance/ DoS Potential 10,000 Incoming/Outgoing Connections High Performance/ Sure Delivery Single Queue For all Destinations Queue Backup Delays All Mail Per-Destination Queues Fault-Tolerance and Custom Control

12 Advanced Controls Only Available from IronPort Destination Controls Virtual Gateway Technology? Internet New Company Bounces Internet Protect Your Groupware Servers Rate Limit Mail Sent Per Destination Enforce TLS Encryption Per- Destination Safeguard Your Reputation Send Different Types of Mail Via Separate IPs IronPort Patent Pending Technology

13 Multi-layer Spam Defense Best of Breed MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM IronPort Reputation Filters the outer layer defense IronPort Anti-Spam - stops the broadest array of threats spam, phishing, fraud

14 Multi-Layered Security Preventive + Reactive = Defense in Depth Preventive Layer + Reactive Layer Immediate Reaction to Threats Extremely High Performance Coarse Outer Layer Blocks or Rate Limits Adapts Over Time Computationally Intensive Fine-grained Inner Layer Delete or Quarantine

15 IronPort SenderBase Network First, Biggest, Best Reputation System Global and Web Traffic Monitoring Over 120,000 contributing networks Over 20M IP addresses tracked globally View into 25-30% of traffic Over 110 parameters tracked

16 IronPort SenderBase Data Makes the Difference 150 Parameters Complaint Reports Threat Prevention in Realtime Spam Traps Message Composition Data Global Volume Data URL Lists Compromised Host Lists SenderBase Data Data Analysis/ Security Modeling SenderBase Reputation Scores -10 to +10 Web Crawlers IP Blacklists & Whitelists Additional Data

17 A Broad Data Set Drives Accuracy

18 IronPort Reputation Filters Stop 80% of Hostile Mail at the Door. Known good is delivered Reputation Filtering Anti-Spam Engine Suspicious is rate limited & spam filtered Incoming Mail Good, Bad, and Grey or Unknown Known bad is deleted/tagged Reputation Filters is a switch point IronPort uses identity & reputation to apply policy Sophisticated response to sophisticated threats

19 Reputation-Based Filtering: A Powerful Technique Beyond blacklisting a granular view of behavior Scores calculated in real-time Pre-configured policies applied dynamically

20 IronPort Reputation Filters Dell Case Study Dell s challenge: Dell currently receives 26M messages per day Only 1.5M are legitimate messages 68 existing gateways running Spam Assassin were not accurate IronPort solution: Reputation Filters block over 19M messages per day 5.5M messages per day scanned by anti-spam engine Replaced 68 servers with 8 IronPort C60s Accuracy of spam filtering increased 10x Servers consolidated by 70% Operating costs reduced by 75% IronPort has increased the quality and reliability of our network operations, while reducing our costs. -- Tim Helmsetetter Manager, Global Collaborative Systems Engineering and Service Management, DELL CORPORATION

21 IronPort AntiSpam Broadens the Context with Web Reputation Effectiveness TODAY Where? Web Reputation Where does the call to action take you? Who? Reputation Who is sending you this message? How? Message Structure How was this message constructed? Time What? Message Content What content is included in this message? Content filtering techniques alone are inadequate reputation systems improved protection Combating new attacks demands Web reputation

22 Customer Benefits Advantages Over Traditional Anti-spam Solutions Higher Employee Productivity 10X lower false-positive rate than competing solutions Eliminates need for quarantines or junk folders Lower Cost of Admin 100,000 rule updates per day Prevents admins from tweaking the filters to catch spam Low FP rate stops help desk calls; whitelist maintenance Enhanced Security Industry s first web reputation system Stops identity theft due to phishing & spyware Lower CapEx 2X higher throughput than any enterprise-class antispam solution Reduces ongoing hardware and maintenance costs

23 Multi-layer Virus Defense Best of Breed MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM IronPort Virus Outbreak Filters stop outbreaks 13 hours ahead of signatures Sophos Anti-Virus signature based solution with industry leading accuracy

24 IronPort Virus Outbreak Filters First Line of Defense Early Protection with IronPort Virus Outbreak Filters

25 IronPort SenderBase Network First, Biggest, Best Reputation System Global and Web Traffic Monitoring What is going on RIGHT NOW? Over 100,000 contributing networks Over 20M IP addresses tracked globally View into over 25% of traffic Over 110 parameters tracked

26 How IronPort Virus Outbreak Filters Work Dynamic Quarantine In Action Messages Scanned & Deleted T = 0 T = 5 mins T = 10 mins T = 8 hours zip (exe) files -zip (exe) files -Size 50 to 55 KB. zip (exe) files Size 50 to 55KB Price in the name file Release messages if signature update is in place

27 IronPort Virus Outbreak Filters Advantage Virus Name Date Virus Description Lead Time (hh:mm) Kukudro-A 6/27/06 Virus that spreads via zipped word document. 3:38 Feebs.AG 6/21/06 Arrives as an attachment claiming to be sent via "Protected service. 17:46 Troj/Stinx-W 6/15/06 IRC backdoor Trojan. 11:12 Yabe.G 5/16/06 Trojan that attempts to download further malicious code. 13:09 Bagle-GT 4/21/06 Installs backdoor and communicates via HTTP, thus bypassing firewall filters. 18:28 Mytob-HJ 4/19/06 Turns off anti-virus applications of infected PC to avoid detection. 32:57 Nyxem-D (Kama Sutra) 1/16/06 Deletes most documents on third day of every month. 1:27 Looksky.G 1/6/06 Installs keystroke loggers onto infected PCs. 35:40 Average lead time* over 13 hours Outbreaks blocked * 175 outbreaks Total incremental protection*.over 94 days *June 2005 July Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer * June Associates, 2005 July F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used.

28 IronPort Outbreak Filters Protect G2000 Company From MyDoom.BB MyDoom Variant MyDoom.BB (February 15, 2005) G2000 Company Protected By IronPort s Virus Outbreak Filters IronPort Threat Level Raised to 3 And Protection Starts 18:08 GMT First Anti-virus Signature Published 22:54 GMT (Next Day) 28 hours 46 minutes 6503 files quarantined 17:00 18:00 19:00 20:00 21:00 22:00 23:00 24:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00 9:00 10:00 11:00 12:00 13:00 14:00 20:00 21:00 22:00 23:00 24:00 February 15, 2005 February 16, 2005 Note: All times shown are in GMT $65K $200/desktop, 5% infected

29 Sophos Anti-Virus Signatures Second Line of Defense Integrated Sophos anti-virus engine High performance in-line scanning Easy to deploy and manage Intuitive user interface Single view with Mail Flow Monitor Auto updates Lower TCO with integrated solution

30 IronPort Policy Enforcement Inbound/Outbound Content Filtering for Compliance MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM Flexible Policy Engine from Blocking Attachments to Enforcing Regulatory Compliance Compliance Solutions and Encryption keep communications private and secure

31 Flexible Policy Engine From Blocking Attachments to Enforcing Compliance Graphical Representation of Per-Recipient Policies LDAP Integration Reduces Need for Repetitive Modifications Customizable Notification Templates Robust Conditions and Actions

32 Authentication Superior Security and Identity Protection MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM DomainKey Signing - establishes and protects your identity on the Internet IronPort Bounce Verification protects from misdirected bounce attacks Directory Harvest Attack Prevention blocks attempts to steal directory information

33 The Misdirected Bounce Threat Makes Up 9% of all Internet * Zombies Recipients: joe1@enterprise.com, jane88@enterprise.com Incoming Gateway Sender: billing@yourcompany.com RETURN TO SENDER yourcompany.com Millions of Misdirected Bounces Outgoing Gateway More than 55% of of F500s have experienced disruption of of service or or a total denial of of service due to to misdirected bounces *Source: IronPort Threat Operations Center, INTERNET TRAFFIC EMERGENCY: SPAM BOUNCE MESSAGES ARE COMPROMISING NETWORKS, April 2006.

34 IronPort Bounce Verification Protects Against Misdirected Bounce Attacks BV Internet BV + All Outgoing Mail Stamped Allowing Legitimate Bounces to be Identified on Return Transparent to End Users, No Industry Adoption Required Eliminates Help Desk Calls and End User Confusion Another IronPort Technical First"

35 Integrated DomainKeys Protects Your Brand and Your Customers Internet private ISPs DNS public 300M+ Accounts Use DomainKeys to Authenticate the Sender Deploys in Five Minutes No CA Issued Key Required Every enterprise needs to protect their brand with authentication

36 Management for the Largest Enterprises MANAGEMENT TOOLS SPAM DEFENSE VIRUS DEFENSE POLICY ENFORCEMENT AUTHENTICATION THE IRONPORT ASYNCOS PLATFORM Security Manager unified policy management Security Monitor enterprise-class reporting system Management Interfaces simple integration and increased productivity

37 IronPort Security Manager Single view of policies for the entire organization Categories: by Domain, Username, or LDAP Allow all media files Quarantine executables IT Mark and Deliver Spam Delete Executables SALES Archive all mail Virus Outbreak Filters disabled for.doc files LEGAL Security Manager serves as a single, versatile dashboard to manage all the services on the appliance. -- PC Magazine 2/22/05

38 IronPort Centralized Management Log in anywhere, control everywhere Interface assures configuration consistency Apply changes to a machine, group, or cluster Test on single system, promote to cluster SJ1 Machine SJ2 Machine D1 Machine D2 Machine T1 Machine T2 Machine SJ3 Machine Sofia Group D3 Machine Plovdiv Group IRONPORT CLUSTER T3 Machine Varna Group

39 IronPort Security Monitor Advanced Reporting System Integrated Real-Time Graphical Reports CSV Export Scheduled Delivery Search by Domain Security Monitor

40 System Monitoring Easy Integration with Existing Processes Alert Center Log Subscriptions Alert Subscriptions per Admin Distinct Areas of Management SNMP Exclusive IronPort MIB Integrates with any SNMP-compatible tools 20+ Log Types Supported Transfer via FTP, SCP, Syslog

41 Enterprise Management Cisco Case Study Cisco s challenge 34,000 worldwide employees Unique filtering requirements Egress points in 8 places globally IronPort solution security manager keeps track of filtering policies Clustering allows all systems to be administered from San Jose Mail Flow Central provides a global view IronPort has significantly reduced our administrative burden, and increased our network security. -- Bailey Szeto Manager, Messaging Systems, CISCO SYSTEMS

42 IronPort Evaluation Policy Free evaluation for 30 days starts with activation of keys on unit can be extended on request any size and any way you get the right unit for your individual needs different ways of testing (life/ stealth, parallel, offline) full support, full functionality About 75% of users who evaluate become happy customers!

43 Get In Contact Mirko Schneider IronPort Systems Channel Manager Bretonischer Ring 13 Eastern Europe & Russia D Grasbrunn/ Munich Germany Tel: Fax: Mobile: Web: mschneider@ironport.com languages: German Russian English