1. Protecting GroupWise® from Viruses and Security Threats Using GWAVA
Novell BrainShare 2002
Protecting GroupWise® from Viruses and Security Threats Using GWAVA
Charles Taite
CTO
Beginfinite, Inc.
Howard Tayler
GroupWise Product Manager
Novell, Inc.
TUT225—Protecting GroupWise from Viruses and Security Threats Using GWAVA

2. Who Is Beginfinite Inc.? Focused exclusively on GroupWise® security
Developers of GWAVA (formerly MTASieve)
Offices in Canada and USA
Products available worldwide through resellers and distributors

3. The Cost of E-Mail Security Breaches
“In 2001, viruses, worms and trojans caused worldwide damages worth $13.2 billion”
Computer Economics, January 2002

4. What Are Businesses Doing About It?
“According to Forrester Research, an average of .0024% of revenue is being spent on IT security. That’s a little bit less than what most companies spend on coffee.”
-Richard A. Clarke
Chair of the President’s critical
Infrastructure Protection Board
and Special Advisor to the
President for CyberSpace Security

5. Put GWAVA on the Case
GWAVA scrutinizes every message that passes through your GroupWise MTAs…
Providing eSecurity Policy Management for
Virus protection
Spam prevention
Content control
Bandwidth control

6. How GroupWise Works
Traditional file scanning is useless because GroupWise stores all messages in an encrypted database
A virus can move freely around your GroupWise system because it cannot be scanned

7. How Generic Gateways Work
Virus
blocked
Other products that claim to protect GroupWise are really designed generically for SMTP—It’s like posting a guard outside your front door, but who’s watching the interior and your back door and your windows?
This image depicts a virus (green line) successfully traveling from “LA 2” to “NY 2”;It is never scanned because it never passes through GWIA—This system is not fully protected because scanning only occurs at the edge of your network
Virus
blocked
Virus
delivered

8. Urban Myth…
“Wait a second, we don’t use Outlook. Aren’t we immune to viruses?”
—What many of you are thinking

9. Security Backdoors— MAPI
Outlook and Office can access the GW address book via MAPI
Example:
Badtrans was one of the most successful viruses in 2001—It spread using MAPI

10. Security Backdoors—MAPI Top 50
Here’s a short list of MAPI-capable viruses:
W32.Navidad
VBS.Elva.Worm
VBS.VBSWG.B
VBS.VBSWG.AF
VBS.Noon
W32.XTC.Worm
Worm.ExploreZip.C
Worm.ExploreZip(pack)
Worm.ExploreZip.B
W97M.Piece
W97M.Melissa.AU
W97M.Melissa.AM
W32.WinExt.Worm
W32.SouthPark.Worm
W32.Navidad.16896
W32.HLLP.Scrambler.F
W32.HLLP.Scrambler
VBS.LoveLetter.CH
VBS.LoveLetter.BJ
VBS.Freelink
VBS.BubbleBoy
W97M.Melissa.W
W97M.Melissa.A
VBS.Plan
VBS.Loveletter.AS

11. Security Backdoors— Web Mail
How many people check their personal web mail from work?
Virus
delivered
Virus
delivered
Virus
delivered

12. Security Backdoors— Blended Viruses
NIMDA was a
blended virus that
also attacked web
servers and
penetrated networks
through browsers
Virus
delivered
Virus
delivered
Virus
delivered

13. Security Backdoors— (un)Authorized Outlook Usage
MS Outlook is embedded in recent versions of Windows and may be in use on your network… whether you allow it or not
Virus
delivered
Virus
delivered
Virus
delivered

14. How GWAVA Works
Virus
blocked
Since  GWAVA was designed from the ground up for GroupWise, it can run as a NetWare Loadable Module™ on all of your Message Transfer Agent servers. Both Internet AND inter-office traffic must pass through your MTAs. It’s like having a guard in every hallway of your building. GWAVA can prevent a virus from spreading beyond a single post office.
In this image viruses cannot travel to other post offices because they are scanned by GWAVA when they pass through the MTA

15. Virus
blocked
delivered
Virus
blocked

16. Quarantine and Filtering
As messages pass through the MTA, GWAVA temporarily moves the message (and attachments) to a quarantine zone, where they can be scanned for policy violations
Since GWAVA essentially exposes attachments in the quarantine zone, GWAVA makes it possible for you to use your existing AV NLM to scan the attachment

17. Anti-Virus Strategy Using GWAVA
“562 million s and 2 million viruses are carried by the Internet each day”
-IDC/Barrings

18. Anti-Virus Strategy Using GWAVA (cont.)
Tight integration with traditional AV NLM™ allows GWAVA to protect GroupWise from known viruses
Virus scanning
Address blocking
Size limits
Attachment blocking
Content filtering
Blocking file types known to carry viruses (i.e. VBS, SCR, COM, PIF, EXE…) can protect GroupWise from outbreaks of unknown viruses

19. Anti-Spam Strategy Using GWAVA
Viruses and spam have a lot in common…
They target your inbox with unwanted messages
They can tie up servers with excessive traffic
They tempt you to click an attachment or link
Spam is a very subtle and gradual virus infection that is slowly degrading your GroupWise system

20. Anti-Spam Strategy Using GWAVA (cont.)
A traditional approach to combating spam that rejects arriving from specified address or domains (i.e. block all mail from “abroller.com”)
Virus scanning
Address blocking
Size limits
Attachment blocking
Content filtering
Spammers may change their addresses/domains on a regular basis. Content filtering can block spam from both known and unknown sources (i.e. block mail containing the phrase “loose weight”)

21. E-Mail Usage Policy Using GWAVA
“The biggest threats to security may already be inside your network”
-Anne Chen, eWeekk km

22. E-Mail Usage Policy Using GWAVA (cont.)
Prevent confidential information from being shared with your competitors
Virus scanning
Address blocking
Size limits
Attachment blocking
Content filtering
Control bandwidth usage by limiting attachment size
Prevent the exchange of non-business related materials (i.e. *.MP3, *.AVI, *.JPG…)
Block confidential terms or inappropriate language

23. GWAVA Versions Standard Edition Enterprise Edition Virus scanning
Attachment blocking
Size limits
Content filtering
Anti-spam
Stand-alone management
Enterprise Edition
Virus scanning
Attachment blocking
Size limits
Content filtering
Anti-spam
Multi-server management
ConsoleOne® snap-in

24. How To Contact Us Phone: +1 514 639 4850 Option 4
1-866-GO-GWAVA
Web:

25. demonstratio Novell BrainShare 2002
TUT225—Protecting GroupWise from Viruses and Security Threats Using GWAVA