Emai1 Security Annua1 Review & Threat Report 2005
Total Page：16
File Type：pdf, Size：1020Kb
bã~áä=pÉÅìêáíó ^ååì~ä=oÉîáÉï=C qÜêÉ~í=oÉéçêí= OMMR REPORT PUBLISHED BY POSTINI, INC. JANUARY 2005 PREEMPTIVE EMAIL PROTECTION As the leading provider of secure email boundary services, Postini is in a unique position to describe email security activity and trends because of the scale of our global email processing. Currently processing more than 3 billion email messages per week for 6.6 million email users worldwide, Postini sits between the email gateway and the Internet, preventing spam, viruses, phishing and other email attacks from impacting our customers email systems and networks. More than 4,000 customers now route their emails through Postini's redundant bã~áä data centers to remove unwanted emails and threats, and instantly deliver legitimate emails to recipients. Because all customer email flows through Postini's ^Çãáåáëíê~íçêë= processing centers, Postini is able to directly monitor and collect statistics in real time. The hundreds of millions of emails passing through Postini's managed service on a daily basis constitute approximately 1% of the world's business C pÉÅìêáíó email traffic, and therefore provide a unique opportunity to accurately view worldwide email activity and trends. The data provided in this report, unless mêçÑÉëëáçå~äëW specifically stated otherwise, is based upon direct measurements of mail flowing through Postini's systems, and is not the result of extrapolation, estimation, or subjective analysis. The Postini Email Security Annual Review & Threat Report provides a summary of how spam and other email threats have evolved over the course of the past year; changes in the regulatory climate that impact email communications; how organizations have responded to changes in email threats and regulations; and what to expect in email security trends in 2005. The Email Security Annual Review & Threat Report offers email and security professionals a concise and convenient resource to: z Gain a brief, yet comprehensive overview of 2004 in terms of changes in email threats and the regulatory environment. z Review the latest tactics and trends in spam, virus and email attacks, and get an overview of how organizations are responding to these threats. z Get a sneak preview from analysts and experts into emerging issues and concerns that may help inform email security strategies and/or implementations in 2005. Please note that the opinions expressed in this report are those of Postini unless indicated in references or direct attribution. To monitor email security statistics and trends from Postini throughout the coming year, visit our website at www.postini.com. Current email threat activity statistics are updated daily on our website. Postini Redwood City, California January 2005 2 1. EXECUTIVE SUMMARY PAGE 4 2. 2004: THE YEAR IN REVIEW PAGE 6 3. 2004 EMAIL THREAT STATISTICAL HIGHLIGHTS PAGE 9 Spam Viruses q~ÄäÉ=çÑ Directory Harvest Attacks `çåíÉåíë Phishing 4. 2004 MILESTONES IN EMAIL SECURITY & PAGE 19 REGULATORY ENVIRONMENT 5. BEST PRACTICE RESPONSE TO PAGE 22 EMAIL SECURITY THREATS & REGULATIONS Intrusion Prevention Encryption Policy Compliance & Enforcement Archiving Authentication Administrator/User Flexibility Reporting & Security Management Email Disaster Recovery 6. EXPECTATIONS FOR EMAIL SECURITY IN 2005 PAGE 27 7. APPENDICES PAGE 29 Appendix A - References Appendix B - Postini Real-time IP Analysis Appendix C - About Postini 3 Even as attention to spam and its harmful impact on worker productivity reached a high point in 2004, threats to email systems grew worse as the incidence of spam, virus attacks, and directory harvest attacks have all increased in frequency and/or severity over the course of the year. Email Threat Highlights from 2004: z Despite new laws and regulations, the proportion of spam compared to total email remained consistently high—between 75% and 80% throughout 2004. z Smaller companies such as those with 100 users or less received up to 10 times more bã~áä=pÉÅìêáíó=OMMQ spam per user than large companies (10,000 users or more). bñÉÅìíáîÉ=pìãã~êó z Different types of organizations received different amounts of spam. The publishing industry, for example, leads with more spam per user than any other industry. z The average company experienced 150 directory harvest attacks (DHAs) per day in 2004, with each attack averaging 234 invalid address lookups. These figures make DHAs the least visible and most underreported threat of 2004. z Virus infected emails were more widespread, encompassing 1.5% (about 1 in 67) of all emails in 2004. This is significanly higher than in 2003 when .5% (1 in 200) of emails were infected. z Email viruses significantly increased the propagation of spam through highjacked computers (known as zombies) that unknowingly serve as conduits for spreading spam. z As email threats continue to escalate and become more sophisticated, small businesses with limited IT resources that often rely on first-generation or open source anti-spam solutions were vulnerable. 4 Regulatory Highlights Email Security Expectations for 2005: from 2004: z Email threats will continue to evolve at a faster pace as spammers z The CAN-SPAM Act went in to effect on become more sophisticated and counter measures designed to January 1, 2004 in the U.S. and did not combat these threats will become available much more quickly. demonstrate any significant impact in z Companies will move from first generation single function "point" decreasing spam during 2004. email security products/services to next-generation solutions that z Microsoft, America Online, Earthlink, and offer broader scope of protection from a single vendor/source. Yahoo! filed the first major industry lawsuits z Email security will see an increased focus on sender IP address under the CAN-SPAM Act in March 2004. and "reputation" or behavior analysis of email messages in addition The lawsuits named hundreds of to content filtering as a critical component of "multi-layer" email defendants, with more than 90 percent of intrusion prevention. them identified only as "John Doe." z Increased consolidation among email security software and "point z On the first anniversary of Britain's Privacy product" vendors will continue as appliance and managed service and Electronic Communications regulations email security solutions grow in popularity and expand their share (December 2003) aimed at stopping of the market. unsolicited email, not a single offender has been prosecuted. z Email authentication efforts will continue despite setbacks, but will have only minimal effect on solving the spam problem. z As email threats continue to escalate and become more sophisticated, small businesses that often rely on first-generation or open source anti-spam solutions will remain particularly vulnerable to spam, viruses and email attacks. 5 Spam Levels Consistently High Throughout 2004, Postini observed that 75 to 80 percent of all emails were spam, with the statistics showing consistently high levels throughout the year. Richi Jennings of Ferris Research (www.ferris.com) argues that the economic incentive for sending spam versus the risks continues to favor spammers. Ferris Research reports the type of spam generated in 2004 according to the following categories: Other 10% Discounted software, Pornography drugs, herbal 15% alternatives bã~áä=pÉÅìêáíóW 35% Fraud & scams Financial OMMQ=áå=oÉîáÉï 20% Services 20% Spammers Get More Sophisticated, Shift Tactics By mid-2004, spammers were observed using new tactics designed to fool conventional anti- spam content filters. The logic behind these new spamming techniques was simple: take away or reduce the content of a message to confuse filtering methods just enough to allow a message to get through. Because anti-spam filters on enterprise servers must handle messages for hundreds or even thousands of users, it is difficult for the IT department to increase the sensitivity of filters to catch these techniques. Increasing content filter sensitivity too much increases the risk of false positives. 6 During 2004, spammers and hackers also shifted techniques to launch more of what are known as directory harvest attacks (DHAs). DHAs are designed to steal valid email addresses from corporate email directories so they can send more spam or sell the harvested addresses to other spammers. DHAs cannot be stopped by conventional content filtering since there is no message content, nor can new spam techniques that reduce or eliminate content in a message be reliably blocked with content filtering. DHAs and minimal content spam must be detected at the SMTP connection point in real time, in order to prevent these threats from reaching the enterprise email gateway. Battle Against Email Threats Moves To The Front Lines Of IP And Behavior Analysis Because spammer techniques have shifted to minimizing or removing content from spam messages, conventional content filtering alone proved insufficient in stopping spam and email attacks in 2004. This has put increased focus on multiple layer protection from email security providers such as Postini, specifically, with its patent- pending IP analysis and threat detection. Postini estimates that it currently blocks 35 to 50 percent of email messages at the SMTP connection point, prior to examining the message content, based on the actual behavior patterns of the sending computer over the previous seconds, minutes, or hours. Anti-Spam Legislation Largely Ineffective So Far The CAN-SPAM law in the United States, and anti-spam regulations based on the Privacy and Electronic Communication directive from the European Union, have thus far failed to stem the growing tide of spam throughout the world. Despite fines and jail time penalties under the CAN-SPAM law, prosecutions have been limited to only a few high profile cases. While the United Kingdom was among the first European countries to introduce its own version of the Privacy and Electronic Communication Directive (nearly half the EU member states had failed to implement any laws by the end of 2004), the UK law protects only personal email addresses, and the government agency in charge of enforcing the law lacks the funds and clout to pursue prosecutions.