互联网安全新趋势与应对策略.pptVIP

互联网安全新趋势与应对策略 Russell Wu IronPort 大中国区总经理 2009年1月6日 年度回顾：2008年的威胁和走势 数据盗窃迅速上升 风险转移到了数据领域 罪犯 无意的披露 令人难以置信的利润丰厚的”多种经营” 欺诈 Deceiving consumers to purchase. 信息盗窃 Identity. Credit card numbers. Corporate information (compliance violation). ‘My Canadian Pharmacy’ ? $150M / 年 Christopher Smith (rizler) ? $20M 垃圾邮件和僵尸网络的发展趋势 垃圾邮件发展趋势2008年11月 网络钓鱼发展趋势 CISCO/IronPort 应对策略 传统方法的弊端 名誉的概念给信息安全一个“实时”的保护 * * * Analogy to X-Ray Security IPS/FW URL Filtering AV Signature-based solutions Sleeper Cell * It is useful to look at what comprises the enterprises Web traffic. About 50% of the enterprise traffic is predictable and goes to fairly well-known sites. These sites are unlikely to be distributing malware. This traffic is fairly easy to categorize using techniques such as URL categorization. The vast majority of the threats are associated with the other 50% of traffic that much less predictable and more often associated with malware. These are sites that are put up and taken down within days—even hours and are much harder to find and categorize even using the more automated techniques that are being employed today. As such, URL filtering really cannot provide reliable security-focused filtering. * It is useful to look at what comprises the enterprises Web traffic. About 50% of the enterprise traffic is predictable and goes to fairly well-known sites. These sites are unlikely to be distributing malware. This traffic is fairly easy to categorize using techniques such as URL categorization. The vast majority of the threats are associated with the other 50% of traffic that much less predictable and more often associated with malware. These are sites that are put up and taken down within days—even hours and are much harder to find and categorize even using the more automated techniques that are being employed today. As such, URL filtering really cannot provide reliable security-focused filtering. * * While server architecture is critical to a security gateway, the heart of any secu