Unified Threat Management White Paper

Using a Gateway Antivirus to Guard the Enterprise Protocol Spectrum

 Preface 2

 And One Night 2

 “Infected” may not necessarily be “Affected” 3

 Rise of the Email 3

 A Misleading Trend 4

 Harnessing the Email Protocols 5 1)Enterprise uses its own mail server 5 2)Enterprise uses web-based mail 5 3)File Transfer the Internet 5

 Mail Server Deployment 5 I.Mail server hosted in DMZ 5 II.ISP Based External Mail Server & Individual User Access to Mailbox6 III.ISP Based External Mail Server & Internal Intrapop Server 6 IV.Mail Server Hosted as a Part of the Intranet 6

 Gateway AV Quarantine Option 7

 Guiding the HTTP Protocol 7

 Granular Control Over Gateway Anti-Virus Solution 7

 Summary 8

 About Cyberoam 8

www.cyberoam.com Unified Threat Management White Paper

Slammer hit its first victim Preface at 12:30 am EST. By 12:33 Internet is omnipresent. It has shrunk the world and has been tremendously beneficial. However, on the flip side, this shrunken virtual world is not free of threats. New blended threats am, the number of slave have reared, rendering single security solutions inadequate. In the present scenario, Unified Threat Management (UTM) solutions guiding the network gateway have come in vogue. A servers in Slammer's standard UTM broadly comprises of , Anti-virus, Anti-spam, Intrusion Detection and Prevention (IDP), Content Filtering and Band-width Management services. replicant army was The purpose of this paper is to explore the Anti-virus facet of UTM. We will elucidate the exact doubling every 8.5 role of an Anti-virus in a UTM solution. En route we will look at the various protocols that need to be tapped by the Anti-virus in case of various deployments of a UTM. seconds. By 12:45 am, huge sections of the And One Night Internet began to wink out It was little after midnight of Saturday, January 25, 2003. In a Network Operations Control Center, just down the street from MIT, Owen Maresh almost choked when Priority 1 alert of existence. popped up on his panel of screens. This Network Operations Control Center was the command room for 15,000 high-speed servers stationed around the globe commanding a God's-eye view of the activities on Internet.

This was big trouble. Fifty-five million meaningless database server requests were traversing the globe. Maresh was the first person on earth to spot the Internet worm that came to be known as Slammer.

Slammer's attack was ruthless and quick. It started with a single killer packet which was delivered through a mail. The worm hit its first victim at 12:30 am EST. The machine - a server A virus “ infected” systems running Microsoft SQL - instantly started spewing millions of Slammer clones, targeting computers at random. may not be actually By 12:33 am, the number of slave servers in Slammer's replicant army was doubling every 8.5 “ affected.” seconds. Maresh and his coworkers began calling and emailing fellow night owls at ISPs worldwide to warn them of the tsunami of traffic. It was already too late.

By 12:45 am, huge sections of the Internet began to wink out of existence. Three hundred thousand cable modems in Portugal went dark. South Korea fell right off the map: no cell phone or Internet service for 27 million people. Five of the Internet's 13 root-name servers - hardened systems, all - succumbed to the squall of packets. Lost revenue spilled over halfway into the next week. Total cost of the bailout: more than $1 billion.

This fateful day marked a paradigm shift in the history of Solutions. Firewall and desktop antivirus solutions proved hopelessly inadequate. Slammer was delivered through a mail that went undetected and it triggered a Denial of Service attack.

The enterprises worldwide felt an urgent need to guard their mail environme