TrustedSource: Solving the Growing Spam Problem

1. F5 Message Security Module Presented by: Insert Name Insert Title

2. The Message Management Problem • Out of 75 billion emails sent worldwide each day, over 70% is spam! • The volume of spam is doubling every 6-9 months! • Clogging networks • Cost to protect is increasing TrustedSource Reputation Scores Nov 2005 Oct 2006 Higher score = worse reputation

3. Typical Corporate Pain • Employees still get spam • Some are annoying, some are offensive • Infrastructure needed to deal with spam is expensive! • Firewalls • Servers • Software (O/S, anti-spam licenses, etc.) • Bandwidth • Rack space • Power • Budget doesn’t match spam growth • Legitimate email delivery slowed due to spam

4. Why is this happening? • Spam really works! • Click rate of 1 in 1,000,000 is successful • Spammers are smart professionals • Buy the same anti-spam technology we do • Develop spam to bypass filters • Persistence through trial and error • Blasted out by massive controlled botnets • Professional spammers have • Racks of equipment • Every major filtering software and appliance available • Engineering staff

5. It’s not just annoying…it can be dangerous. • 2% of all email globally contains some sort of malware. • Phishing • Viruses • Trojans (zombies, spyware)

6. High Cost of Spam Growth • Spam volume increases • Bandwidth usage increases • Load on Firewalls increases • Load on existing messaging security systems increases • Emails slow down • Needlessly uses up rackspace, power, admin time… DMZ Firewall Messaging Security Email Servers

7. X X X X X X X MSM Blocking At the Edge Messaging Security Server Second Tier BIG-IP MSM First Tier Emails Mail Servers e hello Works with any Anti-Spam Solution Terminating 70% of the Spam from the “e hello” Filters out 10% to 20% of Spam

8. Why TrustedSource? • Industry Leader • Solid Gartner reviews & MQ • IDC market share leader • Superior technology • Stability

9. View into over 25% of email traffic 50M+ IP addresses tracked globally Data from 100,000+ sources; 8 of 10 largest ISPs Millions of human reporters and honeypots TrustedSource: Leading IP Reputation DB

10. GLOBAL DATA MONITORING IntelliCenter London Portland Atlanta Bad Good Hong Kong Brazil TrustedSource AUTOMATED ANALYSIS • Messages Analyzed per Month • 10 Billion Enterprise • 100 Billion Consumer Dynamic Computation Of Reputation Score Global data monitoring is fueled by the network effect of real-time information sharing from thousands of gateway security devices around the world Animation slide

11. Deploy agents officers around the globe (Police, FBI, CIA, Interpol.) Global intelligence system Share intelligence information Example: criminal history, global finger printing system Physical World Interpol CIA FBI Police Stations Police Stations Police Stations Results Effective: Accurate detection of offenders Pro-active: Stop them from coming in the country Intelligence Agents Deploy security probes around the globe (firewall, email gateways, web gateways)Global intelligence system Share cyber communication info, Example: spammers, phishers, hackers Cyber World IntelliCenter London Results Effective: Accurate detection of bad IPs, domains Pro-active: Deny connection to intruders to your enterprise Portland Intelligent probes Atlanta Hong Kong Brazil Shared Global Intelligence

12. TrustedSource Identifies Outbreaks Before They Happen • 11/01/05: This machine began sending Bagle worm across the Internet • 11/03/05: Anti-virus signatures were available to protect against Bagle • Two months earlier, TrustedSource identified this machine as not being trustworthy 9/12/05 TrustedSource Flagged Zombie 11/02/05 Other Reputation Systems Triggered 11/03/05 A/V Signatures

13. Content Filters Struggle to ID certain spam

14. Image-based spam Hashbusting Scratches

15. Summary of Benefits • Eliminate up to 70% of spam upon receipt of first packet • Reduce Cost for Message Management • TMOS Module – High performance Cost effective spam blocking at network edge • Integrated into BIG-IP to avoid box proliferation • Improved Scaleability and Message Control • Reputation Based Message Distribution and Traffic Shaping • Slightly increase kill-rate on unwanted email

16. Packaging • BIG-IP LTM Only • Version Support: 9.2 and higher • Module May be added to any • LTM or Enterprise • No Module incompatibilities with other Modules • Licensed per BIG-IP by number of mailboxes • BIG-IP Platform sizing depends on: • Email volume • Number of BIG-IP’s • Other functions expected of BIG-IP (additional taxes on CPU time)

18. Additional Info

19. Secure Computing Trusted Source™ IP Reputation Score Existing Messaging Security Slow Pool DNS Query 20% Suspicious? Email Servers Fast Pool 10% Trusted? 20% Good? Error Msgfor clean termination 70% Bad? Existing Messaging Security 10% Bad? Drop first & subsequent packets Delete Message How BIG-IP MSM Works Internet Animation slide

20. Spam Volumes Out of Control % of Worldwide email that is Spam 85% Percent Spam 70% Nov 2005 Oct 2006

21. Hard-to-detect Image Spam is Growing Percent of Total Email 2006

22. Computing Credit Physical World Cyber World Businesses & Individuals IPs, Domains, Content, etc. Track Business Transactions Cyber Communication • Purchases • Mortgage, Leases • Payment transactions • Email exchanges • Web transaction • URLs, images Compile Reputation Score Credit Score Compute • Timely payment • Late payment • Transaction size • Good IPs, domains • Bad • Grey – marketing, adware Allow / Deny Communication Allow / Deny Credit Use • Loan • LOC • Credit terms • Stop at FW, Web Proxy, Mail gateway • Allow • Quarantine Reputation-based Security Model