Protecting GroupWise® from viruses and spam using GWAVA

Charles Taite

ct@gwava.com

Beginfinite Inc.

© April 15, 2005 Novell Inc, Confidential & Proprietary

1

GWAVA Today

Leading Anti-Spam and Anti-Virus solution for GroupWise®:

GWAVA

GWAVIX

Guinevere

WASP

Redline

More GroupWise® users are protected by GWAVA then any other security solution

Phone:	514-639-4850 Option 4

866-GO-GWAVA

E-mail:	info@gwava.com

Web:	www.gwava.com

1

GWAVA Today

Multiple levels of protection from Viruses and SPAM

Product Lineup (cont)

GWAVA + Guinevere + GWAVIX + WASP=

GroupWise Security for...

GWIA, Webaccess, MTA and POA

Running on NetWare®, Windows & Linux

1

GWAVA – Guinevere – GWAVIX - WASP

GWIA

GWAVA Zone

Internet

MTA Domain

MTA Domain

Post Office

Post

Office

Post Office

Post Office

GWAVIX

Zone

Guinevere

Zone

WASP Zone

WebAccess Agent

GWAVA & GroupWise Roadmap

GWAVA

4.0

(Linux)

Redline

2.0

Redline 1.1

WASP

2.0

(Linux)

Guinevere 3

GWAVIX

Anti-Spyware

GroupWise Sequoia

2005

GWAVA

3.11

GWAVA

4.5

Redline

3.0

Brainshare Announcements

Guinevere 3.0

Redline 2.0

Gee Whiz Acquisition

GWAVA 4.0

Kaspersky Integration

Kaspersky Partnership

KAV Engine to be included in future Versions of:

GWAVA

WASP

Guinevere

GWAVA 4

Major Changes

Multi-NOS Architecture

NetWare

Linux

Windows

Scan Engine and Interfaces Separated

Integration with Redline Control Center

Digest/Aggregated Notification

New, Automated Spam technologies

GWAVA 4 - Spam

DCC (Digital Checksum Clearinghouse)

Pattern Matching

Leverages Global Checksum Sharing

Very Accurate

100% Automated

GWAVA 4 - Spam

SURBL

Regular RBLs list IP Addresses

SURBL lists the URLs that appear inside the e-mail message

Very Accurate

100% Automated

GWAVA 4 - Architecture

Scan Engine and Interface Separated:

Interfaces for POA, MTA, WebAccess & GWIA

One Scan engine can service multiple interfaces Across mulitple servers/OSes

Amazing fault-tolerance, redundancy and load balancing possibilities.

1

GWIA

MTA Domain

NetWare

GWAVA MTA &

GWAVA Scanner 1

Post Office

Windows

GWAVA POA

Post Office

Linux

GWAVA POA

Zone

Guinevere

Zone

GWIA

NetWare

GWAVA Scanner 2

Remote Server

Linux

Offsite GWAVA Scanner 3

GWAVA 4 - Architecture

© April 15, 2005 Novell Inc, Confidential & Proprietary

1

How GroupWise Works

GWIA

Internet

MTA Domain

MTA Domain

Post Office

Post

Office

Post Office

Post Office

Traditional file scanning is not effective because GroupWise encrypts all messages and stores them in an encrypted database

What is GWAVA?

GWAVA looks at every message that passes through your GroupWise 5.5 and 6.x MTAs and full scans of 6.5 Post Offices…

Providing eSecurity for:

Virus protection

Spam prevention

Email Surveillance

Archiving/Auditing

© April 15, 2005 Novell Inc, Confidential & Proprietary

1

Where GWAVA Sits

GWIA

Internet

MTA Domain

MTA Domain

Post Office

Post

Office

Post Office

Post Office

GWAVA Zone

From Zero to Critical Mass:

Blended viruses spread faster then traditional AV can react

Traditional AV solutions are no longer enough

*Melissa was not a blended virus

Blended Viruses Spread Fast

1999: Melissa*

2001: Code Red

2003: SobigF

2004: MyDoom

24 Hrs.

90 Min.

10 Min.

Now

Example: Sober.C

coming from Germany

started on the 20th of december 2003, 03:00 am

spreading with own SMTP-Engine and through P2P fileshareing programs like “Kazaa” or “Edonkey”

medium category of damage, fast spreading

Category: Worm

overwriting other files

Sober.C

Example Sober.C

Reaction time for updates AV-vendors

Bitdefender = 10 hours, 20 Minutes

Kaspersky Labs = 11 hours, 45 Minutes

Trend Micro = 16 hours, 50 Minutes

H+BEDV = 19 hours, 20 Minutes

Symantec = 25 hours, 5 Minutes

Sophos = 35 hours, 35 Minutes

GeCAD/Microsoft = 36 hours, 40 Minutes

Panda Software = 38 hours, 5 Minutes

Sober.C

…. AND THAT IS NOT THE END…..

Example Sober.C

Reaction time for updates AV-vendors

NAI/McAfee after hard and lots of pressure from customers = 49 hours, 10 minutes

CA version 1 = 51 hours, 30 minutes (did not work)

Ikarus Software = 55 hours, 35 minutes

CA version 2 = 62 hours, 50 minutes

(source: PC-Welt Germany)

Sober.C

Virus delivered

Security Backdoors
used by Blended Viruses

Post Office

Virus delivered

GWIA

Internet

MTA Domain

MTA Domain

Post Office

Post

Office

Post Office

Protection

Zone

Virus

Gateway

Virus delivered

A GWAVA Success Story . . .

Novell, Inc

Deployed GWAVA in March 2003

Every month, GWAVA catches dozens of viruses behind the firewall

Security Strategy Using GWAVA

2 Scanning Modes

Live: Blocks/Deletes messages

Surveillance: Logs violations without blocking

Real Time Scanning of MTA traffic

Internet

Inter-Post Office

MTA Scanner

POA Scanner

On Demand or Scheduled scans

Full scan of the entire Post Office database

Security Strategy Using GWAVA

Anti-Virus

Tight integration with traditional AV NLMs™ allow GWAVA to protect GroupWise from known viruses

Leverages your existing AV infrastructure

GWAVA 2.5 supports up THREE virus scanners on a single server

1

Block Viruses as they enter into GroupWise

Block Viruses as they circulate in GroupWise

MTA Scanner

POA Scanner

Clean up old, existing viruses in your PO

Clean out a new virus that penetrated your desktop AV

Security Strategy Using GWAVA

Attachment Blocking & Fingerprinting

Enhances your AV defences

Block dangerous file formats regardless of AV result:

VBS, COM, BAT, PIF, SCR…

Block wasteful formats: MP3, AVI, MOV…

2

Reclaim lost storage by removing all MP3 files from GroupWise

Use Surveillance mode to get a report of all MP3 files in GW

Block attachments as they enter into GW

Block Viruses as they circulate in GroupWise

MTA Scanner

POA Scanner

Security Strategy Using GWAVA

Oversize

Live: Blocks/Deletes messages exceeding a defined size

Surveillance: Logs oversize violations without blocking

Prevent large e-mails from abusing limited bandwidth

MTA Scanner

POA Scanner

Reclaim lost storage space by removing large files from the Post Office

3

Security Strategy Using GWAVA

Content Filtering

Live: Blocks/Deletes messages matching key-words or phrases

Surveillance: Logs content violations without blocking

Example: Novell was filtering “SuSE”

4

Block Spam: “Viagra”, “Lose Weight”, “Hair Restoration”

Enforce confidentiality

MTA Scanner

POA Scanner

Reclaim lost storage by removing all the junk in your PO

Surveillance can report all email containing “Enron”

Security Strategy Using GWAVA

Spam Heuristics / RBL

Live: Blocks/Deletes using higly advanced and automated technology

Surveillance: Can be used to refine spam blocking by observing behavior and adjusting settings without mistakes.

5

Block Spam as it enters the mail system

MTA Scanner

POA Scanner

Reclaim lost storage by removing the spam already filling your Post Office.

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

GWAVA as a company delivers three products for three levels of security. GWAVA is the largest GroupWise security partner. More GroupWise customers protected by GWAVA than all the other solutions combined.

GWAVA is about total protection. With three levels of protection you are guaranteed a strong security solution. We would like to explain briefly how these three levels of protection fit into your GroupWise infrastructure. First let’s look at how GroupWise works.

With three levels of protection, GWAVA, Guinevere, and GWAVIX are able to ensure the highest level of protection for your organization.

With three levels of protection, GWAVA, Guinevere, and GWAVIX are able to ensure the highest level of protection for your organization.

As you can see from this graphic, GWAVIX sits out in front of your GWIA gateway. Acting as a proxy server it intercepts all spam and viruses before they touch your GroupWise system. This allows you to minimize your GWIA traffic and allow GWAVIX to bear the load of processing unwanted spam. In some organizations, this can reduce the amount of traffic on your GWIA Gateway by 87%. Also, since GWAVIX is running on Linux, its hardware requirements are minimal, often a low end server can meet your needs.

GWAVA was uniquely designed to work with GroupWise from the inside out. GWAVA is the single largest anti-spam/anti-virus solution for Novell. GWAVA’s unique design means that in addition to virus scanning and spam blocking, GWAVA is able to conduct email surveillance inside your organization. Needing to snoop on employees email without knowing or changing their password. Need to protect your corporate assets from leaving the organization, then GWAVA is able to conduct email surveillance. And with GroupWise 6.5, GWAVA is able to clean your Post Offices from old viruses and spam clogging your email system.

With three levels of protection, GWAVA, Guinevere, and GWAVIX are able to ensure the highest level of protection for your organization.

Virus spread so fast. You need to have every level of protection you can to catch them.

Guinevere is the original Anti-Spam/Anti-Virus solution for GroupWise. Created by Michael Bell, Guinevere has been protecting GroupWise customers since 1998. It is a windows based solution that integrates into the GWIA Gateway. It is the best low cost solution for small organizations.

Guinevere is the original Anti-Spam/Anti-Virus solution for GroupWise. Created by Michael Bell, Guinevere has been protecting GroupWise customers since 1998. It is a windows based solution that integrates into the GWIA Gateway. It is the best low cost solution for small organizations.

Guinevere is the original Anti-Spam/Anti-Virus solution for GroupWise. Created by Michael Bell, Guinevere has been protecting GroupWise customers since 1998. It is a windows based solution that integrates into the GWIA Gateway. It is the best low cost solution for small organizations.

Perimeter defense stops spam and viruses before they get to your system. Internal defense ensure the system stays protected.

Viruses don’t just come through the SMTP/GWIA gateway. There are other ways they can attack your infrastructure.

Instant Messaging, Web Browsing, Hotmail and others allow viruses to enter in the backdoor of your system. Once there, GWAVA is able to capture these viruses before they are able to do harm.

Novell has been using GWAVA since March of 2003. Novell has encouraged us to tell customers of the success that GWAVA has had inside their organization. Even though Novell has been evaluating several products at the perimeter, only GWAVA protects them from the inside and captured 46 viruses AFTER their perimeter product was installed.

This is a perfect example of how GWAVA can protect your organization from the inside out from a virus getting through.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

McKay Brown

2002-04-25T15:40:43