Identifying and Combating GroupWise
Security Threats

Greg M. Smith,

Product Manager, Messaging Architects

Greg.Smith@messagingarchitects.com

Messaging Architects – Quick Intro…

Stability for the Future

Over 5,000,000 passionate users

Focused research and development

No Down Time

Direct access to Novell engineers

Greater Employee Productivity

Single source for your on-going issues

Agenda

Security Threats

Mail System Vulnerabilities

Security Threats

Security Workshop

How spammers attack your systems

Tactics & Countermeasures to secure your messaging system

Spam Wars

Tales from the front

Driving Factors

It’s all about the $$$

Security Attacks are conducted to elicit information to generate revenue for the attacker

It’s all about malicious behavior

Attacks are conducted to impact your business
and cause a loss of service and potential revenue

Reality: Millions systems are vulnerable

Generating Revenue

Address Harvesting

Spammers obtain lists of valid users

Consumes bandwidth & services

Can result in more SPAM

Address Validation

Validation of internal addresses

Social engineering or SMTP queries

Attacking the Individual

Phishing

Identity theft

Defraud users & steal money

Compromise an organization’s security

Spoofing

Hiding the sender address

Social engineering or SMTP queries

Attacking the Organization

Denial of Service

Flood the mail server with requests

Compromise the ability to receive messages

Joe Jobs

Retaliatory Attack to place your mail server on Internet Black Lists

Mail Bombs

Specially crafted messaged designed to take your message server down

Phishing & Pharming

Fastest Growing Fraud Operations

Bank &Financial Fraud

Identity Theft

Easy to Operate

Messages can be camouflaged

HTML coding provides familiarity

Social Engineering techniques

Hard to Catch or Prosecute

Dummy Websites in foreign countries

Organized crime

Snatch-and-grab operations

Phishing Risks

Corporate Risks

Execution of Malicious Code

Compromise Network Security

Damage to Corporate Integrity

Damage to Online Business

Legal Liability

Phishing Risks

Individual Risks

Identity Theft

Exposure of Personal Information

Financial & Monetary Loss

Credit

Loss of confidence in online business

Legal Liabilities

Phishing Scams

Let’s Go Phishing!

Real or Fake?

Real or Fake?

Real or Fake?

Real or Fake?

http://www.antiphishing.org

Learn to identify Phishing Emails and Websites

View history of reported Phishing attacks

Report Phishing attacks you may receive

Real or Fake?

Exploitations

Spoofing

SMTP Messaging Basics

Using Telnet to Forge the Display Name

Defenses

Defending the Message System

Legacy Approaches

Reverse DNS Lookups

Domain Validation

SMTP Content Filtering

Legislation

Next Generation Defenses

Sender Policy Framework (SPF)

Sender ID (Microsoft Caller ID + SPF)

Domain Keys

Defending the Message System

Pharming Attacks

Anti-Spyware / Malware Software

Attachment Blocking Policies

Anti-Virus Email Protection

End User Education

Address Harvesting

Accept all inbound messages (GWIA 5.5)

SMTP Connection Analyzer

Denial of Service / Mail Bombs

SMTP Connection Monitoring

SMTP Protocol Filter

Defending the Message System

Compression Bombs

SMTP Rejection Policies

Robust Anti-Virus Engines

Joe Jobs

SPF

Sender ID

Phishing

Content Blocking @ Subscription Service

User Education

Read Mime822 Headers

Validate WebSite URLs

Don’t Follow Links

Defending GroupWise

Good:

Keep your GroupWise Current…

Supports Real-time Blacklists, Reverse DNS Lookups

Supports Mailbomb Protection

Supports System Address Blocking

Includes Client-Based Address Blocking (User blacklists)

Much Better:

Follow Novell’s lead…

Implement GWGuardian Messaging Firewall

Defending the Messaging System

Messaging Firewall

Tales from the Front
Carl Ness.................Clarke College

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

Identifying and Combating GroupWise Security Threats

2005-03-10T18:38:24