Extracts from: www'barracudanetworks'com

1
Barracuda Spam Firewall

• Extracts from www.barracudanetworks.com
• See also
• http//www.sophos.com/security/spam-glossary.html

2
1. The Barracuda Spam Firewall

• The Barracuda Spam Firewall is an integrated
  hardware and software solution for complete
  protection of an email server. It provides a
  powerful, easy-to-use and affordable solution to
  eliminating spam and viruses by providing the
  following protection
• Anti-spam
• Anti-virus
• Anti-spoofing
• Anti-phishing
• Anti-spyware (Attachments)
• Denial of Service

3
2. The Barracuda Spam Firewall

• The Barracuda Spam Firewall protects an email
  server with twelve defence layers
• Network Denial of Service Protection
• Rate Control
• IP Reputation Analysis
• Sender Authentication
• Recipient Verification
• Virus Scanning

4
3. The Barracuda Spam Firewall

• The Barracuda Spam Firewall protects an email
  server with twelve defence layers
• Policy (User-specified rules)
• Spam Fingerprint Check
• Intent Analysis
• Image Analysis
• Bayesian Analysis
• Rule-based Scoring

5
(No Transcript)
6
Email the problems

• Email is a key tool for communications among
  companies worldwide
• However email is becoming inefficient because of
  virus attacks and spam
• It is predicted that by 2009, there will be 228
  billion spam messages each day, representing the
  vast majority of email traffic on the Internet
• Hence the need for a spam firewall product

7
Network Denial of Service Protection

• Denial of Service (DoS) attack
• Where a hacker sends attachments or other unusual
  or excessive traffic in an attempt to bring down
  email systems
• Also check for dictionary based spam attacks

8
2. Rate Control

• Rate Control
• Before accessing the main server the client must
  for example get a ticket from a Rate Control
  Server
• Ticket includes start time, end time, count of
  the max number of accesses, sender IP, issue time

9
2. Rate Control (con)

• Tarpitting similar to Rate Control
• The use of traffic monitoring to identify remote
  IP addresses sending a suspiciously large volume
  of email
• Access to the mail system from suspected spam
  addresses can then be slowed or temporarily
  suspended.

10
3. IP Reputation Analysis

• Allow list
• A list of external email addresses, IP addresses
  and domains trusted by the entire organisation or
  individual users

11
3. IP Reputation Analysis (con)

• Block list see IP Reputation Analysis
• A publicised list, usually commercial, of IP
  addresses known to be sources of spam. which can
  be used to create a network block list to filter
  out mail originating from these addresses.
• A block list is also a feature of anti-spam
  software that allows users to designate IP
  addresses, domain names and individual email
  addresses from which no mail will be accepted.

12
8. SPAM fingerprint check

• Complex dictionary checking SPAM fingerprint
  Check
• A feature of anti-spam software that screens text
  for rude words and isn't fooled by various spam
  tricks, such as the replacement of letters with
  lookalike numerals or characters (such as
  "1nterest r_at_te").

13
11. Bayesian filtering

• Bayesian filtering
• A statistical approach to determining whether an
  email is spam. Based on probability inference
  techniques pioneered by English mathematician
  Thomas Bayes.

14

• Phishing
• (Pronounced 'fishing'.) This involves creating a
  replica of a legitimate web page to hook users
  and trick them into submitting personal or
  financial information or passwords.

15

• Spoofing
• When spammers forge an email address to hide the
  origin of a spam message
• Scammers spoof address lines to fool people into
  thinking an email has arrived from a legitimate
  source, such as an online bank. Similarly, virus
  writers have passed off viruses as security
  patches by spoofing their origin as being, for
  example, from Microsoft technical support.

16

• Address harvester
• A program that searches web pages and filters
  newsgroup postings looking for valid email
  addresses to be used for spam purposes.

17

• Dictionary attack Rate Control
• A program that bombards a mail server with
  millions of alphabetically generated email
  addresses in the hope that some addresses will be
  guessed correctly

18

• Network check (also known as reverse DNS check)
  see IP Reputation Analysis
• When an anti-spam engine uses a Domain Name
  System database to check an email's IP address to
  ensure that it originated from a valid domain
  name or web address.