Presentation cisco iron port e-mail security solution
- 1. © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID 1
- 2. © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID 2 Logotip sponzora Cisco IronPort E-mail Security Solution Borderless Advanced Protection - Hrvoje Dogan
- 3. 3 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Agenda 1. About Cisco IronPort and Cisco Security 2. The Power for Advanced Protection 3. Cisco IronPort E-mail Security Appliances 4. Don’t Believe What We Say – Try It Out!
- 4. 4 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Borderless DataCenter 3 Borderless Internet 2 Borderless EndZones 1 Cisco’s Architecture for Borderless Network Security Policy Corporate Border Branch Office Applications and Data Corporate Office Policy (Access Control, Acceptable Use, Malware, Data Security)4 Home Office Attackers Coffee ShopCustomers Airport Mobile User Partners Platform as a Service Infrastructure as a Service X as a Service Software as a Service
- 5. 5 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Pillar 2: Borderless Security Array Advanced Scanning and Enforcement Capabilities Access Control | Acceptable Use | Data Security |Threat Protection Integrated into the Fabric of the Network Access Control | Acceptable Use | Data Security |Threat Protection Integrated into the Fabric of the Network Cisco IronPort Email Security Appliance Cisco Adaptive Security Appliance Cisco Integrated Services Routers Cisco IronPort Web Security Appliance 5 VM Software Security Module Hybrid HostedAppliance
- 6. 6 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID The Power for Advanced Protection
- 7. 7 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID A Seismic Shift 1. 2000-2008: IT security products look deeper 2009: Cisco Security products look around, respond faster
- 8. 8 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco Security Intelligence Operations (SIO) Overview Most Accurate Protection Against a Broad Range of Threats Cisco Threat Operations Center Cisco Threat Operations Center Global Threat Telemetry Dynamic Updates and Actionable Intelligence Adaptive Security Appliances Intrusion Prevention Solution Email Security Appliances Web Security Appliances wwwwww Global Threat Telemetry System Administrators
- 9. 9 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco SIO Key Components Powerful Ecosystem Enables Fast, Accurate Protection
- 10. 10 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco SIO Cisco SensorBase Largest Network, Highest Data Quality, Unmatched Breadth
- 11. 11 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco SensorBase Network Unmatched Visibility Into Global Threats Most Devices 1M security devices, 10M clients shipped per year Core Internet routers Cloud-based services Largest Footprint 30% of the world’s email traffic 200+ parameters 368GB per day sensor feeds Diverse Sources Eight of the top ten ISPs Fortune 500, Global 2000, universities, SMBs 152 third-party feeds First to Combine Network and Application Layer Data
- 12. 12 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Spam with Malicious Attachment Malware Distributing Site Email Web Directed Attack Firewall / IPS Cisco SensorBase Network Unmatched Breadth Malware Distributing Site Directed AttackSpam with Malicious Attachment SensorBase Network
- 13. 13 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco SIO Cisco Threat Operations Center (TOC) Advanced Research and Development, Security Modeling, Experienced Analysts
- 14. 14 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco Threat Operation Center Advanced Research and Development 1. Millions in R&D investment Threat experts and statisticians Equipment and infrastructure Thought leadership, prevention and best practices expertise 76 patents 2. Innovative services IPS Global Correlation ASA Botnet Traffic Filters Virus Outbreak Filters Reputation Filters (IPS, email, web, etc.)
- 15. 15 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Experienced Analysts 500 analysts European and Asian languages 1 Cisco Fellow 80+ Ph.D.s, CCIEs, CISSPs, MSCEs Cisco Threat Operations Center Ensuring Accuracy and Responsiveness Powerful Tools Dynamic updates Correlation and data mining Advanced rule approval, creation and publishing applications 24x7x365 Operations 5 threat operations center locations around the globe San Jose, San Bruno, Austin, North Carolina, Shanghai
- 16. 16 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco SIO Broadest Enforcement Capabilities Fast Device Scanning Engines and Granular Policy
- 17. 17 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Advanced Protection Putting It All Together Live Reputation Scores Live Reputation Scores Authored Rule Sets Authored Rule Sets New and Updated Signatures New and Updated Signatures Web Reputation Filters Web Reputation Filters Anti-SpamAnti-Spam Email Reputation Filters Email Reputation Filters Virus Outbreak Filters Virus Outbreak Filters IPS Reputation and Signature Filters IPS Reputation and Signature Filters Firewall Botnet Traffic Filters Firewall Botnet Traffic Filters Adaptive Security Appliances Intrusion Prevention Solution Email Security Appliances Web Security Appliances Hosted Email Services Cisco Products and Services: High-performance, flexible enforcement points Cisco SIO: Cloud-based intelligence to power Cisco security services Security Filters: Industry’s most effective security features wwwwww Auto-Updates Every 5 minutes Auto-Updates Every 5 minutes Dynamic Rule Sets Dynamic Rule Sets
- 18. 18 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco IronPort E-mail Security Appliances
- 19. 19 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco IronPort Consolidates the Network Perimeter For Security, Reliability and Lower Maintenance After IronPort Groupware Firewall IronPort Email Security Appliance Internet Before IronPort Anti-Spam Anti-Virus Policy Enforcement Mail Routing Internet Firewall Groupware Users Encryption Platform MTA DLP Scanner DLP Policy Manager Users
- 20. 20 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Management Email Security Architecture Inbound Security, Outbound Control Spam Defense Virus Defense CISCO IRONPORT ASYNCOS™ EMAIL PLATFORM Data Loss Prevention Secure Messaging INBOUND SECURITY OUTBOUND CONTROL
- 21. 21 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Global Volume Data Global Volume Data Over 100,000 organizations, email traffic, web traffic Message Composition Data Message Composition Data Message size, attachment volume, attachment types, URLs, host names Spam TrapsSpam Traps SpamCop, ISPs, customer contributions IP Blacklists & Whitelists IP Blacklists & Whitelists SpamCop, SpamHaus (SBL), NJABL, Bonded Sender Compromised Host Lists Compromised Host Lists Downloaded files, linking URLs, threat heuristics SORBS, OPM, DSBL Fortune 1000, length of sending history, location, where the domain is hosted, how long has it been registered, how long has the site been up Complaint Reports Complaint Reports Spam, phishing, virus reports Spamvertized URLs, phishing URLs, spyware sites Domain Blacklist & Safelists Domain Blacklist & Safelists SenderBase Other DataOther Data Web Site Composition Data Web Site Composition Data Cisco IronPort SenderBase Breadth and Quality of Data Makes the Difference
- 22. 22 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Spam Blocked Before Entering Network > 99% Catch Rate < 1 in 1 million False Positives IronPort Anti-SpamSenderBase Reputation Filtering Verdict Anti-Spam Defense in Depth
- 23. 23 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID • Known good is delivered • Suspicious is rate limited and spam filtered • Known bad is blocked IronPort Anti-Spam Incoming Mail Good, Bad, and Unknown Email Reputation Filtering Cisco on Cisco Our Corporate Email Experience Message Category % Messages Stopped by Reputation Filtering 93.1% 700,876,217 Stopped as Invalid recipients 0.3% 2,280,104 Spam Detected 2.5% 18,617,700 Virus Detected 0.3% 2,144,793 Stopped by Content Filter 0.6% 4,878,312 Total Threat Messages: 96.8% 728,797,126 Clean Messages 3.2% 24,102,874 Total Attempted Messages: 752,900,000 SenderBase Reputation Filtering Real Time Threat Prevention
- 24. 24 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Spam Botnets Spammer Networks EMAIL REPUTATION WEB REPUTATION MESSAGE CONTENT MESSAGE CONSTRUCTION Malware/Phishes Short-Texted Spam with URLs Image Spam Spam created using Automation Tools SMS Spam Attachment-based Spam Cisco IronPort Anti-Spam Defense in Depth Spam Protection Cisco IronPort Anti-Spam Verdict
- 25. 25 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Marketing Message Detection – The Problem Not Spam, because of tacit opt-in and working opt-out Privacy Policy At Buy.com, your privacy is a top priority. Please read our privacy policy details. … All information collected from you will be shared with Buy.com and its affiliate companies. X Securing The Web Gateway In The World Of Web 2.0 Does Web 2.0 have legitimate business applications? If so, how can business take advantage of its unique capabilities? In this Q&A, Gene Hodges, CEO of Websense,shares his insights on the risks, rewards, and future of Web 2.0 and the secure Web gateway. MORE BUSINESS FOCUS Business Blogs, Vapid or Vital? With 40,000 new blogs cropping up every day, it begs the question—is there a business benefit to blogging? And with the blogosphere already inconceivably immense, how can one company stand out? Learn how enterprises such as General Motors have made their mark, and how you can too, in this BusinessWeek story about social media and business. MORE APPLICATION FOCUS Web 2.0 Ready for Prime Time? Web 2.0 makes many promises, but managers are stumped about how to use it to drive growth and profits. With companies like Google, IBM, and Adobe creating software for commercial use of Web 2.0, businesses are poised to make the leap. Learn more about the new applications and how your business can get up to speed in this ChannelWeb review. MORE LATEST NEWS OLYMPIANS CONNECT WITH FANS THROUGH BLOGS ACQUISITION HELPS READY INTERNET SECURITY SOFTWARE FIRM FOR WEB 2.0 THE 2008 SUMMER OLYMPICS: THE MOST DIGITAL OF ALL MANAGING ACCESS TO FACEBOOK: A GOOD IDEA? EDITOR'S CORNER Anticipation Big changes are happening at Websense, and as a loyal subscriber to our newsletter, WebsenseConnect, I want to share the news with you first. Think you know Websense? If you've been a Websense (or SurfControl) customer for years, be prepared for a big surprise—we are way more than Web security. MORE QUICK LINKS PRODUCT TIP OF THE MONTH CUSTOMER TRAINING EVENTS SUPPORT WEBSENSE NEWS SUCCESS STORY Furniture Seller Tables Threats Furniture retailer WS Badcock Corporation is taking aggressive measures against emerging Internet threats. Aware that current attacks are focused on secretly stealing information rather than the highly visible and public "bring down the network" attacks, the company selected Websense Email Security because of its ability to stop spam and viruses and prevent confidential information from leaving the organization through email.
- 26. 26 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Blocks messages from major bulk mailers (i.e. Constant Contact, Vertical Response) Determination based on user voting (i.e. Apple iTunes, Dell, United Airlines are legitimate) PercentofGlobalMailDetectedAs UnwantedMarketingMail(%) Marketing Message Detection – The Solution: AsyncOS 7.0
- 27. 27 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Marketing Message Detection Stops aggressive bulk mailers Can be applied on user-by-user basis Flexible actions: tag, drop, quarantine Separate reporting for visibility
- 28. 28 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Intelligent Multi-Scan Best of Both Worlds: Higher Detection with Low FPs Intelligent Multi-Scan
- 29. 29 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Management Email Security Architecture Inbound Security, Outbound Control Spam Defense Virus Defense CISCO IRONPORT ASYNCOS™ EMAIL PLATFORM Data Loss Prevention Secure Messaging INBOUND SECURITY OUTBOUND CONTROL
- 30. 30 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Virus Outbreak Filters Anti-Virus Engines Zero Hour Virus and Malware Detection Complementary Anti-Virus Engines Anti-Virus Defense in Depth
- 31. 31 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Virus Outbreak Filters Advantage Average lead time*…………………………over 13 hours Outbreaks blocked* ………………………291 outbreaks Total incremental protection*……………. over 157 days “VOF has stopped more than 12,000 separate viral messages in the last year” “Since VOF we have not had a single virus outbreak!” “Over 24,000 virus positive messages stopped in 9 months” Virus Outbreak Filters In Action INTERNET Dynamic Quarantine Dynamic Quarantine Virus FilterVirus Filter SenderBase Cisco IronPort Virus Outbreak Filters Zero Hour Malware Prevention
- 32. 32 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Management Email Security Architecture Inbound Security, Outbound Control Spam Defense Virus Defense CISCO IRONPORT ASYNCOS™ EMAIL PLATFORM Data Loss Prevention Secure Messaging INBOUND SECURITY OUTBOUND CONTROL
- 33. 33 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID IronPort DLP: Comprehensive, Accurate, Easy Comprehensive EasyAccurate No managing false positives Worldwide regulatory compliance coverage, numerous remediation options Quickly deploy and manage
- 34. 34 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Data Loss Prevention Simple Set Up Easy “3 click” set-up using content filters Use pre-defined content categories or create / customize your own Can be applied to specific users under specific conditions
- 35. 35 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Data Loss Prevention Comprehensive Remediation & Reporting Multiple remediation actions – encrypt, quarantine, drop, bounce, BCC, strip content Offending content highlighted in quarantine for easy analysis Reporting on a per policy and per user basis
- 36. 36 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID RSA – Market & Technology Leader Ranked as “Leader” in Gartner Magic Quadrant Focus on accuracy: large research team staffed specifically to write and refine content polices “RSA has strong described content capabilities enabled by a formal knowledge-engineering process” - Gartner
- 37. 37 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Comprehensive Policy Coverage 100+ Predefined Policies for Comprehensive Coverage
- 38. 38 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Comprehensive Remediation Options Automated Remediation Encrypt, quarantine, deliver, or drop Add disclaimer, modify subject Copy or notify Guaranteed secure delivery Hosted key management No plug-ins required No new hardware required Integrated Encryption
- 39. 39 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Easy to Set Up Stop Sensitive Content in Minutes One click activation of pre-loaded policies Integrated into Policy Manager
- 40. 40 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Drill Down Reporting Detailed Message Tracking Easy Reporting & Monitoring
- 41. 41 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Management Email Security Architecture Inbound Security, Outbound Control Spam Defense Virus Defense CISCO IRONPORT ASYNCOS™ EMAIL PLATFORM Data Loss Prevention Secure Messaging INBOUND SECURITY OUTBOUND CONTROL
- 42. 42 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Barriers to Adoption Why Email Encryption Isn’t Everywhere…Yet 1. Ease-Of-Use • Client plug-ins and confusing end-user intervention • Public Key and Identity Management 2. Ease-of-Deployment • Client plug-in support • Public Key and Identity Management Infrastructure 3. Universal Reach • Require pre-existing cryptographic relationship • Send / receive on limited set of email clients with plug-in
- 43. 43 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco IronPort Email Encryption Easy for the Sender. . . Automated key management No desktop software requirements Send to any email address seamlessly CISCO REGISTERED ENVELOPE SERVICE
- 44. 44 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Receive email, click to open attachment Cisco IronPort Email Encryption Receiving a message
- 45. 45 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Enter password Receive email Cisco IronPort Email Encryption Receiving a message
- 46. 46 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID View secure message Enter password Receive email Cisco IronPort Email Encryption Receiving a message
- 47. 47 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Solving Limitations of Other Email Encryption Products 1. Ease-Of-Use - Solved • Client plug-ins and confusing end-user intervention • Public Key and Identity Management • No client software, no certificates 2. Ease-of-Deployment - Solved • Client plug-in support • Public Key and Identity Management Infrastructure • IronPort Hosted Keys service 3. Universal Reach - Solved • Require pre-existing cryptographic relationship • Send / receive on limited set of email clients with plug-in • Send / receive from any email platform
- 48. 48 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Guaranteed Secure Delivery Destination-Sensitive Email Encryption 1. Use TLS if available 2. Encrypt using PXE Secure Envelope PUBLIC RECIPIENT PARTNER RECIPIENT TLS CONNECTION Internet SUE BOB TLS CONNECTION TO: SUE and BOB TO:BOB TO:SUE
- 49. 49 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Management Email Security Architecture Inbound Security, Outbound Control Spam Defense Virus Defense CISCO IRONPORT ASYNCOS™ EMAIL PLATFORM Data Loss Prevention Secure Messaging INBOUND SECURITY OUTBOUND CONTROL
- 50. 50 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Cisco IronPort Email Security Manager Single view of policies for the entire organization Categories: by Domain, Username, or LDAP IT SALES LEGAL “IronPort Email Security Manager serves as a single, versatile dashboard to manage all the services on the appliance.” – PC Magazine • Mark and Deliver Spam • Delete Executables • Archive all mail • Virus Outbreak Filters disabled for .doc files • Allow all media files • Quarantine executables
- 51. 51 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID • Email Volumes Spam Counters Policy Violations Virus Reports Outgoing Email Data Reputation Service System Health View Single view across the organization Real Time insight into email traffic and security threats Actionable drill down reports Multipledatapoints Consolidated Reports Comprehensive Insight Unified Business Reporting
- 52. 52 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Visibility Into Email Messages Message Tracking What happened to the email I sent 2 hours ago? Track Individual Email Messages Who else received similar emails? Forensics to Ensure Compliance
- 53. 53 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID 20,000+ customers globally 300 million users protected 40% of Fortune 100 companies 8 of the 10 largest service providers 99%+ customer renewal rates Named IronPort the market share leader in the email security appliance market IronPort is positioned as a leading player in the messaging security appliance market IronPort Positioned in the “Leaders” Quadrant in Magic Quadrant Report Unparalleled Market Leadership
- 54. 54 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID
- 55. 55 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID
- 56. 56 © 2009 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID