1. Invent the Future

2. Some information about VT ~28,000 students; 83% UG/17% Graduate Most users publish/utilize a single e-mail address such as xyz@vt.edu even if their messages are forwarded to departmental/college serversxyz@vt.edu Central I.T. offers virus protection to these other servers as well E-mail inboxes resident on centrally maintained server: 130,000+ (includes retirees, alumni, in addition to students, faculty, and staff) Avg. 2-3 million SMTP connections from external hosts per day

3. Obligatory Copyright Statement Copyright © 2006 William Dougherty This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

4. What caused VT to choose Mirapoint? In 1999-2000, VT was spending inordinate amounts of time at the Help Desk on virus cleanup of users’ computers At that time, enterprise-wide virus scanning was rare; desktop A/V software was common SENDMAIL based systems had solutions for the server, but we were (are) running a proprietary solution (from Sun) We needed something vendor “neutral”

5. What caused VT to choose Mirapoint? VT had made a decision to restrict “plain-text” logins; no user IDs or passwords sent without encryption Many users forward their accounts to the central MS Exchange service We also employ an outbound mail server to offload some of the e-mail traffic Mirapoint devices fit perfectly into the architecture deployed; only required standard interface with all devices Also allows use of CLI or GUI

6. How VT uses Mirapoint devices Load Balancing devices Incoming E-mail & Messages Sent out MD450 All Messages From Public Internet & internal users (including forwarded messages) VIA private network to the Sun ONE Server VIA “Public Internet” to VT Exchange server; VT outbound SENDMAIL based server; VT departmental or college owned servers; external SMTP servers MD450

7. Can we live without anti-virus devices? “Client software and vendor provided services have advanced over the last few years.” “Benefits derived from running central A/V services do not always outweigh the costs.” “Restoring and rebuilding users’ computers isn’t that time consuming.”

8. A few numbers to think over……. At Virginia Tech we’ve captured  1,151,954 viruses in FY 2002 2,127,387 viruses in FY 2003 31,712,418 viruses in FY2004

9. Since bringing the Mirapoint devices online in August of 2001…… Total Viruses Caught To Date: 47,088,822 Total Savings at 1:100 ratio: $14,126,646.00 Total Savings at 1:10 ratio: $141,266,466.00 Based on an average of 3-4 hours for cleanup at $8.00 per hour (snapshot taken April 3 rd, 2006)

10. What has been happening lately? An overview of current operations.

11. Sample report generated from stats logged by MD-450s: Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40 Total Email Received: 2,494,457 Virus Summary--Total Viruses: 926 nyxem 368 mytob 331 netsky 18 zafi 19 mydoom 81* lovgate 4 bagle 55

12. Sample report generated from stats logged by MD-450s: Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40 Other viruses captured: dloadr; dwnldr; dolebot parite; feebs; gibe forbot; wollf; klez netskyp; flcss

13. Do you want to talk about spam? Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40 Msgs rejected w/out processing: 2,274,485 895,961  550 Blacklisted domain (VT) 739,147  RBL rejection cbl.abusenet.org 550,492  “Mailhurdle deferral” 37,959  RBL rejection list.dsbl.org Total Notes Processed: 219,972

14. So….. Out of the 2,494,457 messages received on April 2 nd, 2006– 2,274,485 were rejected (91.18%) as “spam” or deferred Another 926 messages contained viruses Of the 219,972 messages processed, 124,705 were labeled as “spam” (header added) This means 96% of the messages received were suspected to be “unsolicited junk-mail.” (False positive rate at or below 3%)

15. For More Information... Virginia Tech William Dougherty Assistant Director for Systems Support Network Infrastructure & Services Virginia Tech 1700 Pratt Drive Blacksburg, VA 24060 william@vt.edu