<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.im
{mso-style-name:im;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Yeah, I totally agree with those points. And for those customers we manage internal IT for, we try and implement a number of strategies. But depending
on the size of the customer, or if they have their own IT of varying levels of competence, sometimes it’s not possible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">This in particular is why I thought it might be an idea to post on AusNOG (which I know for a lot of people would deem border-line off-topic), because
this is NOT a scenario of a single enterprise/corporate network. That would be clear-cut not for AusNOG, IMO, and I guess that’s probably what a lot of people have assumed I’m posting about – I guess I should have been clearer about that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">But it’s because we’re dealing with a classic ISP style situation where we don’t have control over the end user’s network, but are trying to provide
them the best experience possible that we reasonably can, without controlling all of their internal IT.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">And I figure a number of network operators on this list in particular (depending on their product set, size, etc) would be facing a similar situation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">So I agree with all your points, but for all of those (well I’m sure there’s still more to look at) we’ve already worked to try and solve the problem
from that fundamental angle, where it’s possible to do so. There’s, unfortunately, still customers we can’t really approach it like that with. So we’re now looking to try and work on solving this particular angle as well.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">On another note, thanks to everyone for their suggestions. I’ve got a few options to start looking over! Hopefully this has been useful for others
as well.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Hope everyone has a great weekend.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Mister Pink [mailto:misterpink@gmail.com]
<br>
<b>Sent:</b> Friday, 2 October 2015 4:31 PM<br>
<b>To:</b> Rhys Hanrahan <rhys@nexusone.com.au><br>
<b>Cc:</b> Noel Butler <noel.butler@ausics.net>; ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Fw: important<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">The thing with a lot of modern malware is that it often goes through a crypter before it gets sent out, which means that it's not uncommon for every single sample in a given campaign to be completely unique - this is why people have been
bemoaning the fact that signature based AV has been broken for years.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ironport is for stopping spam, it can look for known malware whilst it's at it but this relies upon signatures (see above). There are some pretty good cloud based as a service offerings for Spam/Malware filtering but email is just one
vector of attack, as has been mentioned. Users are used to clicking on dropbox links etc and downloading files all day long, even more so if you block all zip files on your mail server.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Everyone has a laptop and a smartphone these days, so if you stop them doing something on the corp gateway, they will often tether their phone, grab what they want and drop back on the corp network minutes later.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You need defence in depth, you need ongoing security awareness training (Schools not prisons), you still need good backups, you should be thinking about next gen firewalls, you still need traditional AV, and you might want to consider app
whitelisting (Esp for problem users or vulnerable vectors like HR opening resumes all day) .<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There are a bunch of cool things on the market that can also solve some of these problems from Sandboxing to MicroVM's etc but they can be costly so I think you need to address the fundamentals first.<o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 2 October 2015 at 12:36, Rhys Hanrahan <<a href="mailto:rhys@nexusone.com.au" target="_blank">rhys@nexusone.com.au</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Noel,<br>
<br>
Personally, I agree with your opinion, and typically have stayed away from these solutions over the years for exactly this reason. However, over the last few months things seem to have worsened to the point where we need to try something different.<br>
<br>
We've been running a typical postfix+rbls+spamassassin+clamav+lots of other bits for about the last 5 years, with me running the same setup personally, prior to that. And over the years, aside from some performance tweaks to get more throughput on Amavis, it's
done fine. There's always been stuff it's missed, but like people have said, there's no silver bullet.<br>
<br>
The problem is that the amount of stuff it misses seems to miss has gone up by a fair amount for us in recent times - not just with the crypto stuff, but with general junk that comes through.<br>
<br>
I'm not going to extend this thread to "how do I fix our setup", because that's way outside the scope of the list, but I'll just say that I've already looked at improving the config in several ways and I feel like I've taken the setup as far as I can take it
in terms of tweaks to reasonably improve its accuracy.<br>
<br>
I know they're probably running the same or similar setup under the hood of any appliance, but the thing is, if they're going to provide me 24x7x365 signature updates that they manage, which can stay on top of outbreaks, then to me that's worth paying for.<br>
<br>
Hopefully I manage to find something that doesn't end up falling over. :-)<br>
<span style="color:#888888"><br>
<span class="hoenzb">Rhys.</span><br>
</span><br>
<span class="im">-----Original Message-----</span><br>
<span class="im">From: AusNOG [mailto:<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>] On Behalf Of Noel Butler</span><br>
<span class="im">Sent: Friday, 2 October 2015 10:07 AM</span><br>
<span class="im">To: <a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a></span><br>
<span class="im">Subject: Re: [AusNOG] Fw: important</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">nearly missed this, found it in Junk because you replied direct, please reply to list only<br>
<br>
On 01/10/2015 17:10, Brad Peczka wrote:<br>
> Google will also show me examples of the aliens that landed at<br>
> Roswell, if I look hard enough. Doesn't mean it's real! :-)<br>
><br>
<br>
That maybe so, but the nightmares of ironport are well realised by those with a clue, including those that run networks large enough to make telstra look like a ma 'n pa part time vISP<br>
<br>
<br>
> Ironport ESAs are a solid product, as evidenced through their use in<br>
> Australia by iiNet, Micron21, and many others in both the ISP and<br>
<br>
and I (and assume others) recall a numnber of problems with mail and iinet in recent times because of ironport<br>
<br>
Like I said YMMV, but most are shying away from these things, well, those that care do :)<br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>