Invent the Future

Some information about VT

• ~28,000 students; 83% UG/17% Graduate• Most users publish/utilize a single e-mail

address such as xyz@vt.edu even if their messages are forwarded to departmental/college servers

• Central I.T. offers virus protection to these other servers as well

• E-mail inboxes resident on centrally maintained server: 130,000+ (includes retirees, alumni, in addition to students, faculty, and staff)

• Avg. 2-3 million SMTP connections from external hosts per day

Obligatory Copyright Statement

• Copyright © 2006 William Dougherty• This work is the intellectual property of the

author.• Permission is granted for this material to be

shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

What caused VT to choose Mirapoint?

• In 1999-2000, VT was spending inordinate amounts of time at the Help Desk on virus cleanup of users’ computers

• At that time, enterprise-wide virus scanning was rare; desktop A/V software was common

• SENDMAIL based systems had solutions for the server, but we were (are) running a proprietary solution (from Sun)

• We needed something vendor “neutral”

What caused VT to choose Mirapoint?

• VT had made a decision to restrict “plain-text” logins; no user IDs or passwords sent without encryption

• Many users forward their accounts to the central MS Exchange service

• We also employ an outbound mail server to offload some of the e-mail traffic

• Mirapoint devices fit perfectly into the architecture deployed; only required standard interface with all devices

• Also allows use of CLI or GUI

How VT uses Mirapoint devices

LoadBalancing

devicesIncoming

E-mail&

Messages Sent out

MD450

All Messages

From Public Internet

& internalusers

(includingforwardedmessages)

VIA private network to the Sun ONE ServerVIA “Public Internet” to VT Exchange server; VT outbound

SENDMAIL based server; VT departmental or college owned servers; external SMTP servers

MD450

MD450

MD450

Can we live without anti-virus devices?

• “Client software and vendor provided services have advanced over the last few years.”

• “Benefits derived from running central A/V services do not always outweigh the costs.”

• “Restoring and rebuilding users’ computers isn’t that time consuming.”

A few numbers to think over…….

• At Virginia Tech we’ve captured

• 1,151,954 viruses in FY 2002

• 2,127,387 viruses in FY 2003

• 31,712,418 viruses in FY2004

Since bringing the Mirapoint devices online in August of 2001……

• Total Viruses Caught To Date: 47,088,822

• Total Savings at 1:100 ratio: $14,126,646.00

• Total Savings at 1:10 ratio: $141,266,466.00

• Based on an average of 3-4 hours for cleanup at $8.00 per hour (snapshot taken April 3rd, 2006)

What has been happening lately?

An overview of current operations.

Sample report generated from stats logged by MD-450s:

Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40

• Total Email Received: 2,494,457• Virus Summary--Total Viruses: 926• nyxem 368• mytob 331• netsky 18• zafi 19• mydoom 81*• lovgate 4• bagle 55

Sample report generated from stats logged by MD-450s:

Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40

• Other viruses captured:

• dloadr; dwnldr; dolebot• parite; feebs; gibe• forbot; wollf; klez• netskyp; flcss

Do you want to talk about spam?

Log Dates from Apr 02 00:00:40 to Apr 03 00:00:40

• Msgs rejected w/out processing: 2,274,485

• 895,961 550 Blacklisted domain (VT)• 739,147 RBL rejection cbl.abusenet.org• 550,492 “Mailhurdle deferral”• 37,959 RBL rejection list.dsbl.org• Total Notes Processed: 219,972

So…..

• Out of the 2,494,457 messages received on April 2nd, 2006– 2,274,485 were rejected (91.18%) as “spam” or deferred

• Another 926 messages contained viruses• Of the 219,972 messages processed,

124,705 were labeled as “spam” (header added)

• This means 96% of the messages received were suspected to be “unsolicited junk-mail.” (False positive rate at or below 3%)

For More Information ...

VirginiaTech

William DoughertyAssistant Director for Systems SupportNetwork Infrastructure & ServicesVirginia Tech

1700 Pratt DriveBlacksburg, VA 24060

william@vt.edu