Maintaining a Secure Messaging Environment Across Email, IM, Web and Other Protocols

1. Maintaining a Secure Messaging Environment Across Email, IM, Web and Other Protocols Jim Jessup Regional Manager, Information Risk Management Specialist Symantec, Federal Sales

2. Agenda Emergence of Information Risk 1 Messaging Threat Landscape 2 Symantec Messaging Solutions 3 Symantec Vision 2007 Symantec Vision 2007 2

3. Nature of Information Risk Management Information is Distributed, High-Volume and Real-Time Messaging and collaboration accelerate information risks and costs Information Risks Cross System Boundaries Risks follow information, not systems External Threats Data Loss Discovery & Audit Archiving & Retention Databases File Servers Email Servers IM Servers Portal Servers Symantec Vision 2007 Symantec Vision 2007 3

4. Requirements forInformation Risk Management 2 1 4 3 Keep The Important Things In Keep The Bad Things Out Web Servers File Servers Email Servers IM Servers Retain Things Only As Long As Necessary Find Things Easily When Needed Data Loss Prevention External Threat Protection Electronic Discovery Archiving / Retention Symantec Vision 2007 4

5. Messaging Threat Landscape

6. Current Spam Trends Spam is 90% of email traffic Spam attack duration shortening: from hours/days to minutes/hours Increased frequency of rotating through URLs in spam attacks Image spam with multiple obfuscation tactics is the latest tactic Increased use of zombies to send spam (e.g. ~80% of image spam) Adult content - reverted to plain text from HTML with adult images Symantec Vision 2007 6

7. The Rise of Image Spam • As vendors crush image spam, spammers getting more desperate: • Started w/ background noise • Neopolitan • Mr. Ransom • CAPTCHA • Magic Eye Symantec Vision 2007 Symantec Vision 2007 7 7

8. Attack TrendsBot Networks Symantec Vision 2007 During the current reporting period Symantec observed an average of 63,912 active bot network computers per day, an 11% increase over the first half of the year. The worldwide total of distinct bot-infected computers that Symantec identified rose to just over 6,049,594 - a 29% increase. Command and control servers decreased during this period to 4,746 - a 25% decrease. The United States continues to have the highest number of command and control servers worldwide with 40% - a 2% drop from it’s previous total. China has increased its global proportion of bot-infected computers to 26% while the United States continues to decline. EMEA countries, with the exception of the U.K., showed the largest increase.

9. Attack TrendsData Breaches Symantec Vision 2007 • Information on data breaches that could lead to identity theft. Data collected is not Symantec data • The government sector accounted for the majority of data breaches with 25%, followed by Education (20%) and Healthcare (14%) - the majority of breaches (54%) were due to theft or loss with hacking only accounting for 13%

10. Malicious Code TrendsThreats to Confidential Information • During the current reporting period, threats to confidential information made up 66% of the volume of top 50 malicious code reported to Symantec, up from 48% in the previous reporting period. • While the volume of threats that allow remote access have decreased from the same reporting period last year, the volume of threats that log keystrokes and export user and system data have all increased - Keystroke loggers represent 79% of the report threats to confidential information. Symantec Vision 2007

11. Instant Messaging Threats ClientVulnerabilities1% Viruses& Trojans 12% Top 5 IM Threat Mutations 2006 Monthly Unique IM Threats Worms87% “ As one of the most successful and widely deployed applications on the Internet, IM has become a potent means for the propagation of viruses, worms, and other threats.” Symantec Security Response 2006 Note:Symantec Security Response Symantec Vision 2007 Symantec Vision 2007 11

12. Symantec Messaging Solutions

13. Multilayered Email Security Symantec Vision 2007

14. Symantec Solutions - Overview Customer site Symantec operations Symantec SecurityResponse Centers Symantec GlobalIntelligence Network Spam Viruses Inbound andOutbound mail Secure Transmission Content filtering • Collects spam, virus, sender reputation, and other email security data • Employs technicians 24/7 who analyze threats and create filters in real time • Deploys updated filters and reputation information to customer sites every 7 minutes Mail Gateway • Symantec Mail Security 8300 • Scanner • Control Center Viruses in the wild Updated Spam Filters Spam and Reputation Data ~ Updated Virus Signatures Email Server (e.g. Exchange, Domino) Updated Reputation Information User Mailbox Symantec Vision 2007

15. Information Foundation 2007 Delivers Market Leading Products A Recognized Leader In Security (Mail Security + IM Management) Source: Gartner Symantec Vision 2007

16. Thank You

17. Internet Case Study 2M messages 1M messages 620K messages 620K messages User Mail Stream 600K Good 1.4M Spam 1M eliminated 600K Good 400K Spam 1.38M eliminated 600K Good 20K Spam 1.38M eliminated 600K Good 20K Spam 30 Good 1 Spam Groupware + Archiving 20K End Users SMS 8300 Content SMS 8300 Reputation Purify Mail Stream Deeper analysis of structure and content of message Control Infrastructure The reduced mail volume equals fewer strains on Groupware and Archiving servers. Satisfy End Users Only 1 Spam message per user. Cut Volume In Half. Throttle mail from known bad senders to reduce unsolicited email. Symantec Vision 2007 Symantec Vision 2007 17