Cisco IronPort Email & Web Security

1 2009 Cisco Systems, Inc. All rights ConfidentialPresentation_ID1 Cisco IronPortEmail & Web SecurityFr d ric HER, CISSPS ystems Engineer, AfricaCisco IronPort IronPort funded in 2000, acquired by Cisco in 2007 20,000+ customers globally 400 million users protected 40% of Fortune 100 companies 8 of the 10 largest Service Providers 7 of the 10 largest Banks 99%+ customer renewal ratesNamed IronPort the market share leader in the Email Security appliance marketIronPort is positioned as a leading player in the messaging Security appliance marketIronPort Positioned in the Leaders Quadrant in Magic Quadrant ReportCisco IronPortUnparalleled Market Leadership3 EMAILS ecurity GatewayThe Cisco IronPort StoryApplication-Specific Security GatewaysMANAGEMENTA pplianceInternetWEBS ecurity GatewaySensorBase(The Common Security Database)

2 APPLICATION-SPECIFICSECURITY GATEWAYSBLOCK Incoming Threats: Spam, Phishing/Fraud Viruses, Trojans, Worms Spyware, Adware Unauthorized Access 2009 Cisco Systems, Inc. All rights ConfidentialPresentation_ID4 Cisco IronPortEmail SecurityCisco IronPort Email Security Appliance5 Email ChallengesJunk MailVirusesRegulationsPrivacy & ControlStandard Email does not natively offer what is expected6 Cisco IronPort Consolidates the Network Perimeter For Security , Reliability and Lower MaintenanceAfter Cisco IronPortGroupwareFirewallCisco IronPort Email Security ApplianceInternetBefore Cisco IronPortAnti-SpamAnti-VirusPolicy EnforcementMail RoutingInternetFirewallGroupwareUsersEnc ryption PlatformMTADLP ScannerDLP Policy ManagerUsers7050100150200250300 Jan-08 Feb-08 Mar-08 Apr-08 May-08 Jun-08 Jul-08 Aug-08 Sep-08 Oct-08 Nov-08 Dec-08 Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Average Daily Spam Volume (billions)

3 MonthSpam Trends Record spam volumes and criminal botnet activity8 TEXT SPAMI mage SpamATTACHMENT SPAM (PDF, EXCEL, MP3)TARGETED ATTACKS Your Equitable Bank account is closed, call us now at (802)354-4250 Your Equitable Bank account is closed, call us now at (802)354-4250 Your Equitable Bank account is closed, call us now at (802)354-4250 IMAGE SPAMSpam Sophistication Increasing20052006200720089 Cisco IronPort SensorBase Statistics on more than 30% of the world s e-mail traffic New threats & alerts detection More than200 parametersto buildreputation scores Data Volume Message Structure Complaints Blacklists, whitelists Off-line dataReputation ScoreReputation Score URL blacklists & whitelists HTML Content Domain Info Known bad URLs Website Reputation FiltersWeb Reputation Filters10 ManagementEmail Security ArchitectureCisco IronPort Email Security ApplianceVirusDefenseCISCO IronPort ASYNCOSEMAIL PLATFORMData Loss PreventionSecure MessagingINBOUND SECURITYOUTBOUND CONTROLMAIL TRANSFERAGENTSpamDefense11 Cisco IronPort AsyncOSRevolutionary Email Delivery PlatformTraditional Email Gatewaysand Other AppliancesCisco IronPort Email Security Appliances200 ConnectionsLow Performance/Peak Delivery IssueDisk I/O BottlenecksUnable To Leverage Full Capability ComponentsCPU Limited Solely By CPU Capacity1K 10 KConnectionsHigh Performance/Sure Delivery12 Advanced Controls for Security and EfficiencyAnd to

4 Protect against the risk of being the reputation of a on different IP addresses for sending internal per destination domainInternet? Virtual GatewaysDestination ControlsEmail Authentication (DomainKeys, DKIM, SPF, SIDF)13 ManagementEmail Security ArchitectureCisco IronPort Email Security ApplianceCISCO IronPort ASYNCOSEMAIL PLATFORMData Loss PreventionSecure MessagingINBOUND SECURITYOUTBOUND CONTROLMAIL TRANSFERAGENTSpamDefenseVirusDefense14 Spam Blocked Before Entering Network> 99% Catch Rate< 1 in 1 millionFalse PositivesIronPort Anti-SpamSensorBaseReputation FilteringVerdictAnti-Spam Defense in Depth15 Known good is delivered Suspicious is rate limited & spam filtered Known bad is blockedIronPort Anti-SpamIncoming MailGood, Bad, and Unknown EmailReputationFilteringCisco s Internal Email Experience.

5 Message Category%MessagesStopped by Reputation ,876,217 Stopped as Invalid ,280,104 Spam ,617,700 Virus ,144,793 Stopped by Content ,878,312 Total Threat ,797,126 Clean ,102,874 Total Attempted Messages:752,900,000 SensorBase Reputation FilteringReal Time Threat Prevention16 ManagementEmail Security ArchitectureCisco IronPort Email Security ApplianceVirusDefenseCISCO IronPort ASYNCOSEMAIL PLATFORMData Loss PreventionSecure MessagingINBOUND SECURITYOUTBOUND CONTROLMAIL TRANSFERAGENTSpamDefense17 Cisco IronPort Virus Outbreak FiltersThe First Line of DefenseEarly Protectionwith IronPort Virus Outbreak Filters18 Multi-Layer Virus DefenseZero Hour Malware Prevention and AV ScanningVirus Outbreak FiltersAnti-VirusT = 0-zip (exe) filesT = 5 mins-zip (exe) files-Size 50 to 55 KBT = 15 mins-zip (exe) files-Size 50 to 55KB- Price in the filenameAn analysis over one year:Average lead time.

6 Over 13 hoursOutbreaks blocked ..291 outbreaksTotal incremental protection .. over 157 days19 ManagementEmail Security ArchitectureCisco IronPort Email Security ApplianceCISCO IronPort ASYNCOSEMAIL PLATFORMData Loss PreventionSecure MessagingINBOUND SECURITYOUTBOUND CONTROLMAIL TRANSFERAGENTSpamDefenseVirusDefense20 Risks for the OrganizationTop Risk: EmployeesBiggest Impact: Customer Data12%10%5%4%7%Personal client information44%21%4%8%4%Intellectual PropertyPersonnel InformationInformation marked ConfidentialTop Data Loss Types21 Data Loss PreventionComprehensive, Accurate, EasyComprehensive 100+ Pre-defined templates Regulatory compliance Multiple parameters Key words, proximity, One-click activation Policy enable/disableEasy22 Email EncryptionInstant Deployment, Zero Management Cost Automated key management No desktop software requirements No new hardware requiredGateway encrypts messageMessage pushed to recipientCisco Registered Envelope ServiceUser opens secured message in browserUser authenticates and receives message keyKey is storedDecryptedmessage is displayed23 ManagementEmail Security ArchitectureCisco IronPort Email Security ApplianceCISCO IronPort ASYNCOSEMAIL PLATFORMData Loss PreventionSecure MessagingINBOUND SECURITYOUTBOUND CONTROLMAIL TRANSFERAGENTSpamDefenseVirusDefense24 Cisco IronPort Email Security ManagerSingle view of policies for the entire organization Mark and Deliver Spam Delete Executables Archive all mail Virus Outbreak Filters disabled for.

7 Doc files Allow all media files Quarantine executablesCategories: by Domain, Username, or LDAPITSALESLEGAL IronPort Email Security Manager serves as a single,versatile dashboard to manage all theservices on the appliance. PC Magazine25 Email VolumesSpam CountersPolicy ViolationsVirus ReportsOutgoing Email DataReputation ServiceSystem Health View Single view across the organization Real Time insight into Email traffic and Security threats Actionable drill down reportsMultiple data pointsConsolidated ReportsComprehensive InsightUnified Business Reporting26 Visibility Into Email MessagesMessage TrackingWhat happened to the Email I sent 2 hours ago?9 Track IndividualEmail MessagesWho else received similar emails?9 Forensics toEnsure Compliance 2009 Cisco Systems, Inc. All rights ConfidentialPresentation_ID27 Email SecurityHosted OfferingsCisco IronPort Hosted Email Security28 Choice Maximizes FlexibilityFull Continuum of Deployment OptionsFully Managedon PremisesManagedAward-Winning TechnologyAppliancesBacked by Service Level AgreementsDedicated SaaSInfrastructureHostedBest of Both WorldsHybrid Hosted 2009 Cisco Systems, Inc.

8 All rights ConfidentialPresentation_ID29 Cisco IronPort Web SecurityOverviewCisco IronPort Web Security Appliance30 Malware Threat DistributionMalware infection vectors are shifting from Email to WebMalware InfectionsTimeEmail Vector Web Vector31# of SitesTraffic VolumeBigHeadLong TailHundreds of millions of sitesThousands of new sites per hourPredictable,easy to classifySignatures are reactive and CANNOT keep upURL classification is reactive, has low coverageMalware Evades Legacy Defenses32 Exploited WebsitesAn Invisible Threat33 Drive-By Scareware-Full-screen pop-up simulates real AV software, asks you to buy full version to clean machine. -Fakes scan of c:\ drive and pretends to find viruses even on Linux or Mac OS X!34 The limits of legacy solutions Low Performance not suitable for current usage of Web High Latency Low Security : often only URL filtering.

9 Or only Antivirus and no efficient protection against Malware35 UsersFirewallNext Generation Secure Web GatewayInternetAfter Cisco IronPortCisco IronPort WSAI nternetFirewallUsersBefore Cisco IronPortWeb Proxy & CachingAnti-SpywareAnti-VirusAnti-Phishi ngURL FilteringPolicy ManagementAll web Security components in a single integrated platform36 ManagementWeb Security ArchitectureCisco IronPort Web Security ApplianceURL FiltersCISCO IronPort ASYNCOSWEB PLATFORMWeb Reputation FiltersAnti-MalwareSystemPROXY CACHEL4 TrafficMonitor37 Maintain pool of persistent TCP connections (client and server side)Maintain pool of persistent TCP connections (client and server side)Co-related object storage and high-performance caching Co-related object storage and high-performance caching Handle extremely high traffic volumesHandle extremely high traffic volumesSignificantly improved response timesSignificantly improved response timesHigh-Performance Web ProxyConnection Management & Optimized StorageFacts & Figures: 100,000 simultaneous duplex TCP connections to easily handle traffic spikes Average latency introduced to end user.

10 5-15 milliseconds38 ManagementWeb Security ArchitectureCisco IronPort Web Security ApplianceURL FiltersCISCO IronPort ASYNCOSWEB PLATFORMWeb Reputation FiltersAnti-MalwareSystemPROXY CACHEL4 TrafficMonitor39 Detecting Existing Client Infections Cisco IronPort Layer 4 Traffic Monitor Scans all traffic, all ports, all protocols Detects malware bypassing Port 80 Prevents botnet traffic Powerful anti-malware data Automatically updated rules Real-time rule generation using Dynamic Discovery InternetUsersNetwork Layer AnalysisCisco IronPort S-SeriesPacket and Header Inspection40 ManagementWeb Security ArchitectureCisco IronPort Web Security ApplianceURL FiltersCISCO IronPort ASYNCOSWEB PLATFORMWeb Reputation FiltersAnti-MalwareSystemPROXY CACHEL4 TrafficMonitor41 Web: Huge, Growing and TransientNumber of WebpagesStatic WebTraditional Content PublishersLegacy URL Filtering FocusDynamic WebUser Generated & Web Content1998 28 Million webpages20001 Billion webpages20081 Trillion webpages2005: Web tipping pointSource.