1. InterScan Messaging Security Solutions
Filip Demianiuk
Technical Channel Manager Poland & Baltic Countries
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

2. Agenda – Gateway Messaging Security
Threats
InterScan Messaging Security Solutions
Beyond Gateway Messaging Security
Summary and Keys to Remember

3. Threats
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

4. Spam Problem 75-90% of Email is Spam 1
Spam has increased fivefold in the last couple of years.2
Zombies and botnets make it easier for spammers and are now responsible for most spam
Spam is evolving with new techniques like image spam
Even if blocked from the inbox, letting spam into the network uses bandwidth, storage, and other network resources
Might want to ask the customer if they have been experiencing an increase in spam. How is there current anti-spam solution performing?
1 Source: Gartner “Benchmarking Anti-Spam Effectiveness.” April 25, 2006 (Gartner customers report that 75-90% of the s they receive are spam)
2 Source: Ferris The Global Economic Impact of Spam, February 2005 (Other statistics)

5. Virus Problem Viruses are only in about 2-6% of emails.1
HOWEVER, the impact can be substantial.
And the number of viruses can add up. 2 3
Instead of the mass virus attacks of the past, hackers are using viruses for monetary gain (often using more targeted attacks)
Examples
Bot code that allows hackers to use the victim’s machine to send spam or fraudulent s
Key-logging Trojans that collect confidential information
1 Source: Gartner “Benchmarking Anti-Spam Effectiveness.” April 25, 2006 (viruses 2-6% of )
2 Source: Computer Economics Malware Report: The Impact of Malicious Code Attacks. January (Figure 1)
3 Source: The Radicati Group, Inc. Security Market, June 2006 (Bar Graph)

6. Phishing Problem Email fraud made up 4% of email in 20061
Phishing s spoof legitimate companies and attempt to steal information
Phishing affects both individuals and corporations with thousands of unique phishing threats sent out every month
Companies need to protect themselves from loss of confidential information and potential liability 1
Blended threats – Malware and phishing attacks
Key-Logging Trojans also “phish” for information
Pharming Crimeware redirects users to fraudulent Web sites to steal information
Phishing is no longer just a consumer threat, it also targets corporations.
Corporate phishing often appears to come from within the organization. For example, HR, IT, or maybe payroll. The will ask the employee for confidential corporate information, such as the employee’s login and password.
1 Source: The Radicati Group, Inc. Security Market, June 2006 (fraud 4% of )
2 Source: Anti-Phishing Working Group. Retrieved from Web site: (fraudulent and Web site)

7. Targeted Attacks Unique attacks tailored for the targeted organization
Viruses (such as ransom attacks)
Spyware in
Corporate Spear Phishing
Directory Harvest Attack (DHA)
Tries numerous variations of possible addresses using a company’s domain
Goal = to acquire a valid list for the company
Can use the list later for a targeted attack, such as a phishing, virus, spyware, or spam attack
Bounced Mail Attacks
Spoofs a legitimate company by inserting its domain as the sender
When the receiving servers bounce the , the bounced s are sent to the spoofed company, flooding the server and tainting the reputation of the innocent company
Examples of targeted attacks
Ransom attacks – infiltrates an organization with a virus. Then demands a ransom or will activate the virus. These can be generic (for example, downloads claiming to be early, free versions of Vista that encrypt all of the user’s data and demand a payment or claim they will destroy the data – PC Pro UK) or they can be organization specific.
Spyware
“A man in Tokyo was arrested for allegedly sending a spyware-infected to a Japanese jewelry company. Once the spyware was installed, the man was able to obtain the user ID and password to the jeweler’s bank account and thus was able to steal ¥210,000 by transferring the money into his own bank account. Furthermore, he is suspected of stealing more than ¥11.4 million from more than 10 companies using spyware.” (from Forrester)
Corporate spear phishing are targeted phishing attempts aimed as specific organizations. Example - Employees at a Dekalb Medical Center were sent an that appeared to come from their own HR department (used the company domain in the “from” address). The told them they had been laid off and provided a link to a “career counseling” Web site. When employees followed the link to the site, a key-logging Trojan was downloaded. (NetworkWorld)
DHA and bounced mail attacks – by their nature, targeted attacks

8. Data Privacy & Protection
Regulatory Compliance Regulations impose mandates on data protection or privacy Can affect and other digital communication
Corporate Governance Internal standards or policies that a company uses to govern itself In this case policies for appropriate use of messaging
Loss of Confidential Information Protection against data leakage, whether intentional, or inadvertent
Might want to ask customers if they are subject to regulations. How do they feel this affects their messaging security? (slides with our solution will follow)
Some countries impose a lot of regulations on industries. For example, the US has thousands of regulations. A couple of the more well known regulations are HIPAA for health care and GLBA for the financial industry. Other countries are also instituting more regulations, like privacy laws in EMEA. In addition companies will want to set up their own messaging policies, for example, detecting harassing content. Organizations also want to ensure that confidential information stays secure. This goes beyond wanting to block threats and turns to controlling the information within and attachments.

9. Email Security Concerns
Spam
Viruses
Network Security
Regulatory Compliance
Corporate Governance
Loss of Confidential Information
Spyware
Denial of Service Attacks
Phishing
Directory Harvest Attacks 1
1 Source: The Radicati Group, Inc. Security Market, June 2006 (Bar Graph)

10. InterScan Messaging Security Solutions
The following section discusses how Trend Micro solves those problems.
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

11. Gateway Email Security Products
Same superior protection in all form factors
SOFTWARE: InterScan Messaging Security Suite (IMSS)
Flexible configuration options on customer’s own hardware and on multiple machines
Solution on leading operating systems: Windows, Linux and Solaris
APPLIANCE: InterScan Messaging Security Appliance (IMSA)
Easy deployment with pre-configured software
Redundant, high-throughput appliance optimized for security and performance
HOSTED SERVICE: InterScan Messaging Hosted Security (IMHS)
Immediate deployment by simply redirecting the MX record
Added security and bandwidth by keeping threats completely off the network
Reduced hardware and software purchases and maintenance
Other vendors might offer different form factors, but they vary the types of protections and capabilities across those form factors. Trend Micro offers the same superior security across software, an appliance, and a hosted service, allowing customers to select the solution that best fits their network environment without having to sacrifice protection.

12. Comprehensive Messaging Protection
Viruses, Worms, Trojans
Spyware
Spam
Phishing
Inappropriate Content 
Award-Winning Anti-Virus – includes zero-day protection
Anti-Spyware –protection against spyware in
Multi-Tier Anti-Spam – Network Reputation Services, IP Profiler, and our anti-spam composite engine for high effectiveness with low false positives
Anti-Phishing – reputation services, signatures, and heuristics aimed at phishing
Inappropriate Content – content filtering enforces compliance and prevents data leakage
This slide is an overview of protection included in the InterScan Messaging Security solutions. Detailed slides follow.
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

13. Highly Effective Solution
Multi-Tier Anti-Spam
Highly Effective Solution
Network Reputation Services – First Defense
Global and dynamic reputation services
Blocks up to 80% before entering the network
IP Profiler – Patent-Pending Technology
Customer-specific reputation services based on company traffic, keeps threats off network
Firewall against DHA and bounced mail attacks
We offer three distinct tiers of anti-spam. Each tier continues to remove more threats. Network Reputation Services provides the first line of defense. Its global and dynamic reputation services can remove up to 80% of threats at the connection layer before they even reach the gateway. IP Profiler uses patent-pending technology to apply customer-specific reputation services based on the organization’s traffic. This also keeps threats off of the network. The few remaining threats are filtered by the anti-spam composite engine which integrates technologies to keep spam out of the inbox. The following slides explain these tiers in more detail.
Anti-Spam Composite Engine – Guards Inbox
Stops any remaining spam before it enters inbox
Integrates statistical analysis, heuristics, signatures, whitelists, blacklists and more
Patent-pending image spam detection technology

14. Network Reputation Services
Global: Verifies IP addresses against the world’s largest, most trusted reputation database
Dynamic: Identifies new spam and phishing sources, stopping even zombies and botnets when they first emerge
Fights off spam at the source
Before it enters the gateway
Uses samples and sender histories to accurately determine the reputation
Leaves only a small percentage of mail to be filtered by the traditional scanning
Saves bandwidth, storage, and other network resources

15. Additional Information
IP Profiler
Customer-Specific
Reputation Services
Spam
Virus
DHA Attacks
Bounced Mail
Customers set thresholds
Duration s from an IP Address are monitored
Percentage of s from that IP Address that contain the threat
Total mails that need to be received to be considered a relevant sample
Triggering actions – what happens when these thresholds are met (block temporarily or block permanently)
Provides customer-specific reputation services by blocking IP addresses that exceed set thresholds—also keeps threats completely off the network
Suggestion – read numbers in screenshot fields as an example.
Example: IP Addresses are monitored for 1 hour. If during that time at least s are sent by an IP Address and 80% of the s are spam, the thresholds are exceeded and the triggering action is activated. In this case the IP Address is blocked temporarily.
Additional information (links to appendix) – links to first slide of three
Slide 1 - shows additional fields for DHA (# of recipients in the and # of non-existing recipients – now LDAP integrated, so it checks the directory)
Slide 2 lists the process of how the traffic from the IP address is actually profiled – can just speak to this (below)
Records all inbound and outbound SMTP traffic
Reports records on traffic from each IP Address to a database
The s are scanned by the anti-spam composite engine
The results of the scanning engine are reported to the database
The traffic from the IP Address is profiled by cross referencing the recorded traffic with the scanning results
For example, total messaging from the IP address vs. spam messages from the IP Address
This outcome is compared against the user thresholds
If the outcome exceeds the thresholds, the trigger action is applied Block Permanently (SMTP 5xx) or Block Temporarily (SMTP 4xx)
Slide 3 – shows how customers can actively manage the monitoring IP Address – they don’t have to wait until the thresholds are triggered. Can select an IP Address and block permanently or temporarily.
IP Profiler is not part of the hosted service because this technology is based on customer-specific traffic. In essence, the hosted service is like one big customer, allowing Trend Micro to tune the protection across all customers.
Additional Information

16. Trend Micro Anti-Spam Composite Engine
What is Trend Micro Anti-Spam Composite Engine?
Trend Micro anti-spam composite engine uses a “cocktail” approach to block both spam and phishing s.
Statistical Analysis
Advanced Heuristics
Signature Filtering
Whitelists/Blacklists
Multilingual Spam Detection
Patent-Pending Image Spam Detection Technology
Industry Proven Technology
Install base of over 25 million seats over the past four years
Stops any remaining spam before it reaches the inbox using a combination of technologies.
We are one of the only companies that provides effective multi-lingual anti-spam. This is particularly helpful for global companies.
The image spam detection technology is explained in more detail in the next slide.

17. Image Spam Detection Patent-Pending Image Spam Detection
Boils down to the core of the —for example, strips out background and text colors, dimensions, and other randomized elements
Enables just a few main signatures to stop all of the numerous variations
Our approach is able to strip away the image elements that the spammers vary. For example, background color, text color, different dimension, etc. We’re left with just the core of the image. We are then able to apply just a few signatures to stop all of the variations. This is combined with heuristics that help to identify image spam. This combined approach is very effective at detecting and blocking image spam.

18. Award-Winning Antivirus and Anti-Spyware
Antivirus – and Attachments
Pattern files
Zero-day protection
Zero-day protection applies heuristics to detect unknown viruses
For example, IntelliTrap stops viruses based on the tools used to hide the virus and not the virus code itself--no signature is required
Anti-spyware and other malware protection for
ActiveAction provides automated responses to viruses, spyware, and other malware
You can point to the screen shot to show that InterScan Messaging Security solutions go beyond viruses and specifically address spyware and other types of malware.
IntelliTrap is not part of the hosted service, but it uses other heuristics for zero-day protection. That is why IntelliTrap is just listed as one example.

19. Anti-Phishing Technologies specific to phishing Phishing signatures
Heuristics for phishing indicators
Reputation services block known phishers
Embedded URL reputation
Customers can set
policy rules for
phishing s
Phishing signatures – signatures of phishing s.
Heuristics – heuristics specific to phishing s. For examples, looking at tricks used to obscure the true URL in a link. Usually spammers do not need to hide the URL.
NRS – blocks s from known phishers
Embedded URL reputation – an embedded URL can have a bad reputation because it links to a phishing-related Web site.
The screenshot shows that customers can set policies on how to deal with phishing s (delete, quarantine, notify, etc.)

20. Protection from Targeted Attacks
Technologies that prevent known attacks will not work (for example, signatures and reputation services)
Instead we apply predictive techniques--zero-day protection, heuristics, and behavior analysis
Antivirus = prevents virus attacks aimed at specific organizations (for example, ransom attacks)
Anti-spyware = stops the more targeted spyware attacks sent through .
DHA and bounced mail protection (IP Profiler) = protects against bounced mail attacks and directory harvest attacks, which can result in additional targeted attacks
Anti-phishing = blocks corporate spear phishing

21. Data Privacy and Protection
Enforce Content Compliance
Minimize legal liability
Comply with regulations (SOX, HIPAA, …)
Support internal messaging standards
Prevent data leakage
Antivirus stops any malware sent by that could potentially damage or corrupt data.
Anti-phishing helps to prevent the theft of confidential information.
Anti-spyware stops the potentially more targeted attacks sent by which attempt to steal corporate data.
Flexible content filtering enables the efficient inspection of messages to ensure that data does not improperly leave the organization.
Securing data takes a combination of approaches. The data needs to stay intact (protected by anti-virus), external sources need to be prevented from stealing data (anti-phishing and anti-spyware), and employees need to be prevented from inappropriate use of data, either intentional or inadvertent (protected through content filtering). Trend Micro provides this holistic protection.

22. Content Filtering
Inbound and outbound content filters scan s and attachments
Specify Protected Content
Attachment characteristics (true file type, name, size, etc.)
Keywords, lexicons, and preset dictionaries
Customize with Boolean and regular expressions
Select Authorized Senders or Recipients
Company-wide, department, group, or individual
Designate Appropriate Enforcement
Delete, quarantine, notify, postpone, pass, encrypt with TLS, or archive
Add company specific legal disclaimers to text
We provide a flexible approach to content filtering with an easy step-by-step process. First you set the content you want identified. Next you indicate the senders or recipients whose s you want scanned for this content. Finally, you sent the action that is applied if the policy is triggered.

23. Easy Management High performance Highly scalable solution
Single Web-based management console
Centralized policy, quarantine, archive, logging, and reporting
Delegated administration
Message tracking with flexible search criteria
End-User Quarantine
Screenshots from IMSS/IMSA. But IMHS offers a similar interface.
The solutions are highly scalable. The hosted service can scale to meet the size of any organization. The software and appliance can use multiple servers and even assign particular roles to servers (parent-child configuration) including policy, scanning, database, and quarantine servers. Of course, all of this can be contained within one server as well.
Regardless of the number of servers or appliances used, the solutions provide a single, Web-based management console. The top screenshot shows that customers can search across multiple quarantines on different servers to locate an . The middle screenshot shows the delegated administration options. The bottom screenshot shows the messaging tracking results for a single . The links at the bottom of that screen are policies that were triggered by that . Clicking on those links provide details on how each policy affected the . This allows for very detailed messaging tracking, making it easy for administrators to answer, “What happened to my ?”
End-User Quarantine allows end users to manage their own spam. IMSS and IMSA also offer quarantine notification s. End-User Quarantine capabilities reduce the burden on IT staff.

24. Policy & Reporting Enhancements
Policies
Intuitive policy creation
Inbound or outbound or both
Select what to filter
Select the action
Review and assign order
Reports
One-time and scheduled reports
Reports on mail traffic, viruses, spam, content, policy, Network Reputation Services, and IP Profiler
For IMSS and IMSA organizations put the policies in the order they want them applied. In IMHS the policy order is set in a logical order for the organization based on the policy action.
The report screen shot is from IMSS / IMSA, but IMHS also provides detailed reports.

25. Return on Investment
Keeps threats out of the inbox—increasing productivity and preventing staff from falling victim to malware and phishing
End-User Quarantine and quarantine notification s allow users to efficiently manage their own spam
Messaging tracking and reports provide detailed system views
Single Web console, LDAP integration, and delegated administration make management easy, freeing IT staff
End-user spam management reduces the burden on IT
Stopping threats at the perimeter, often before they even enter the gateway (using reputation and/or hosted services)
Solutions provide security and preserve bandwidth, storage, and other network resources
Data protection helps reduce legal fees and settlements, retain customers, and preserve the company reputation
The top section addresses the benefits to the end user. The middle section include benefits to IT staff. The bottom section provides more company-wide values. Altogether they provide a higher return on investment.

26. Beyond Gateway Email Security
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

27. Layered Messaging Security
Trend Micro provides a comprehensive enterprise layered messaging security strategy. At the core of this strategy are gateway messaging and mail server security. Each of these security layers provides unique benefits.
Gateway Security
Stop Internet attacks at the perimeter
Block threats before they even enter the gateway
Prevent DHA and bounced mail attacks
Stop outbound threats at last network point
Mail Server Security
Secure interoffice from threats and sensitive content
Scan mail from mobile or remote PCs logging onto the network
Look at outgoing mail for threats and data privacy concerns
Inspect and clean the mail store with server-based protection
Complementary Web security and extended messaging security complete the messaging security framework.
Complementary Protection From Web Security
Block the transmissions to phishing sites
Scan for viruses in Web mail
Prevent the download of crimeware to protect against the loss of confidential information
Extended Messaging Security
IM Security for LCS
PortalProtect
Mobile Security blocks viruses and SMS text message spam
OfficeScan inspects Outlook files
Might want to mention Layered Messaging Security Whitepaper

28. Trend Micro Enterprise Protection Strategy – A Complete Network Security Framework
Monitor network
and Internet for potential threats
Enforce security
policy on every
network device
Recover via automated cleanup of viruses, worms, Trojans and spyware
Prevent damage by stopping threats
Our Enterprise Protection Strategy goes beyond messaging security to offer full gateway-to-desktop protection. Trend Micro Control Manager centrally manages Trend Micro’s enterprise products to provide coordinated threat management. (Note: IMHS cannot be integrated with TMCM)
Customized and comprehensive centralized management

29. Summary and Key Points to Remember
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

30. Summary and Key Points
InterScan Messaging Security solutions offer integrated, comprehensive security at the enterprise perimeter
All pain points are addressed:
Multi-tier anti-spam with cutting-edge, patent-pending technologies
Award-winning antivirus with zero-day protection and anti-spyware
Anti-phishing with phishing-specific technologies
Targeted attack prevention using predictive techniques
Data protection to enforce compliance and prevent data leakage
Minimizes risks and costs, providing high return on investment
The solutions are optimized to keep threats off the network, increasing security and network resources
Easy management reduces the burden in IT staff, freeing them for other projects
Data security helps stop data leakage, reduce legal fees and settlements, retain customers, and preserve the company reputation, mitigating these business risks

31. Gateway Security Leader
Trend Micro pioneered gateway antivirus security and is the market share leader – IDC1
“Having been founded in 1988, Trend Micro has nearly two decades of experience in the enterprise, service provider, mid-sized, SOHO and consumer security market. With many years of success behind it, the company has grown to be a current global leader in network security” – Radicati 2
Trend Micro started in antivirus and has expanded into a comprehensive network security company, providing a strong, unified defense for its customers.
1 IDC, Worldwide Antivirus 2006–2010 Forecast Update and 2005 Vendor Analysis, Doc ##204715, Dec 2006
2 Source: The Radicati Group, Inc. Security Market, June 2006

32. Appendix
Underlying Message
This section of the presentation focuses on the specific business objectives for the Public Sector, as well as the security challenges that prevent most organizations from attaining them. The discussion will then transition into how Trend Micro and their solutions can address the security challenges and help Public Sector organizations achieve their goals.

33. Product Levels Threat protection is packaged in different levels
* IMHS Standard = complete inbound protection with streamlined management IMHS Advanced = granular access and control for inbound and outbound traffic with flexible content filtering, similar to IMSS and IMSA
Market the full offering. But this slide is available if you need to show different security options.

34. Back to Main IP Profiler Slide
Firewall against DHA and Bounced Mail Attacks
IP Profiler applies additional information to block directory harvest attacks
Number of recipients that can be listed in an
Number of non-existing recipients (this technology is LDAP integrated)
IP Profiler also conducts other behavioral
analysis to block DHAs
This shows additional fields in the DHA tab for IP Profiler (# of recipients in the and # of non-existing recipients)
We use LDAP integration to check for non-existing recipients.
IP Profiler also uses behavioral analysis to block DHA attacks. For example, s in a DHA attack often do not have information in the body of the because this is not necessary to try to harvest address information. This characteristic and others are used to identify and stop DHA attacks.
Back to Main IP Profiler Slide

35. IP Profiler – How It Works
Records all inbound and outbound SMTP traffic
Reports records on traffic from each IP Address to a database
The s are scanned by the anti-spam composite engine
The results of the scanning engine are reported to the database
The traffic from the IP Address is profiled by cross referencing the recorded traffic with the scanning results
For example, total messaging from the IP Address vs. spam messages from the IP Address
This outcome is compared against the user thresholds
If the outcome exceeds the thresholds, the trigger action is applied Block Permanently (SMTP 5xx) or Block Temporarily (SMTP 4xx)
Back to Main IP Profiler Slide

36. IP Profiler Management
Manage currently
monitored
IP Addresses
Display Logs
Total spam s
Total malicious attempts
Total connections
Percentage of malicious attempt in the overall number of connections
This slide shows how customers can actively block IP Address – they don’t have to wait until the thresholds are triggered. Organizations can select an IP Address and block permanently or temporarily.
In the screenshot, 25% of the s from the top IP Address are malicious. This might be lower than the set threshold (maybe 50%), but the customer decides to bock this IP address anyway.
Note: Total Malicious attempts includes spam, virus, DHA, and bounced mail together.
Administrators can select IP Addresses and permanently or temporarily block these IP Addresses
Can create global white/black lists for IP/Domains which will apply to both NRS and IP Profiler
Back to Main IP Profiler Slide