1. www.softscan.dk · info@softscan.dk SoftScan Solna Strandväg 78 171 54 Solna Sweden www.softscan.se The less you hear from us the better Shhh… The less you hear from us the better Shhh…

2. www.softscan.dk · info@softscan.dk Spam & virus trends - is the problem getting bigger? Thursday, 1st of June 2006 Presented by: Diego d’Ambra, SoftScan

3. www.softscan.dk · info@softscan.dk Agenda Is malware/spam an increasing problem? - Some facts - New types of attack How can we stay safe? - 10 suggestions

4. www.softscan.dk · info@softscan.dk Is the problem increasing? Facts: - E-mail trends -Virus 0,5 ~ 10 % -Spam 80 ~ 90 % - Sweden is not behind… - Once you’re bitten… -Spyware -Adware -Backdoor proxies -Password stealers/crackers -Downloaders -Spam tools -Defense blockers

5. www.softscan.dk · info@softscan.dk Is the problem increasing? New types of attack -Instant messenger services (IM) -Compromised websites (recipient notified though IM, email or poisoned DNS) -Client / Server networks (Faster and intelligent spread) -Phishing (E-bay, Paypal, credit card, online banking systems) -Mobile phones (PDA)

6. www.softscan.dk · info@softscan.dk How can we stay safe? 10 suggestions 1) Know your anti-virus product – Cleanup – ”Panic-button” – Beta signatures 2) Security-sites/services – AVIEN, Bugtrack, ISC, Secunia – Check/report suspicious files Virustotal (http://www.virustotal.com) Jotti (http://virusscan.jotti.org)

7. www.softscan.dk · info@softscan.dk How can we stay safe? 10 suggestions 3) Software updates (and ensure they are implemented) – Microsoft® SUS/WUSP – Routers / Gate servers 4) IDS – Listen for suspicious traffic TCP port 25, 135-139, 445 IRC traffic P2P applications 5) Filter outgoing traffic – Proxy service – Block unneeded ports

8. www.softscan.dk · info@softscan.dk How can we stay safe? 10 suggestions 6) Install an anti-spam system – Probably best to detect Phishing emails 7) Security policy (and implement it) – Email, IM, P2P etc. 8) Install an easy to understand email scanning solution – Own signatures – Check MIME type 9) Train users – They are your last defense 10) Check your systems (again and again)

9. www.softscan.dk · info@softscan.dk BREAK…

10. www.softscan.dk · info@softscan.dk SoftScan Solna Strandväg 78 171 54 Solna Sweden www.softscan.se The less you hear from us the better Shhh… The less you hear from us the better Shhh…

11. www.softscan.dk · info@softscan.dk Newest development - how to stay safe? Thursday, 1st of June 2006 Presented by: Diego d’Ambra, SoftScan

12. www.softscan.dk · info@softscan.dk SoftScan suggestions 5 things you should/must do! 1)Deny emails with executable attachments [exe] -Binary check -detects every executable binary 2)Enable [Virus Probability Analyze] (VPA) -Recommended setting: 90 % -Use Paranoid IQS to receive notification 3)Valid email addresses -SPF record 4)TLS 5)Filter SMTP traffic -Delete A records such as mail, smtp etc.

13. www.softscan.dk · info@softscan.dk SoftScan suggestions 5 things you should not do! 1)Create MX records, not pointing at SoftScan 2)Allow MX record changes without your agreement/knowledge 3)Remove locally installed anti-virus -Clients / email servers -(Except perimeter email scanning services) 4)RBL lookup 5)Graylisting / tarpitting

14. www.softscan.dk · info@softscan.dk SoftScan suggestions 5 suggestions regarding the SoftScan system! 1)LDAP -MS AD / Lotus Domino integrated -SSL encrypted connection to SoftScan 2)TLS certificate check -Protects against man-in-the-middle-attacks 3)SMTP rules -Your e-mails, your choice… 4)Report spam 5)Black’n’white -When SoftScan is wrong…

15. www.softscan.dk · info@softscan.dk New features… Archive your emails - Optional service that allows you to save a copy of sent/received emails POP3 proxy - Private e-mail accounts Per user quarantine zone - Less work for the administrator(s) Compliance - Rules and regulations requires companies to meet standards