E-mail Technical Coordinators Meeting Steve Siirila Chris Bongaarts May 7, 2008.

E-mail Technical E-mail Technical Coordinators MeetingCoordinators Meeting

Steve SiirilaSteve Siirila

Chris BongaartsChris Bongaarts

May 7, 2008

Outages

Tue 4/22, Wed 4/23 1100-1430:Periods of intermittent service on peridot due to memory shortage

Sun 4/27 0802-1032:Lost SAN connectivity to amethyst and emerald servers during scheduled SAN work

Tue 4/29 1043-1115:Intermittent service on several email servers due to mass mailing of a large attachment

ClamAV Filtering

5/5: Fully deployed ClamAV anti-virus filtering on all inbound mail servers

5/2: Deployed on 1 of 6 MX where 497,849 messages scanned thru 5/6– 967 Phishing.Heuristics.Email (Logged only)– 592 HTML.Phishing (Logged only)– 45 Email.Phishing or Trojan (Jailed)– 27 Worm/Virus (Jailed, detected by NAI as well)– 7 Other (Jailed by NAI, not detected by ClamAV)

Total Number of IMAP Users (Past Year )

0

5,000

10,000

15,000

20,000

25,000

30,000

35,000

40,000

45,000

50,000

Date

Nu

mb

er o

f Use

rs P

er D

ay

Webmail Pro+3.0 UsersGopherMail UsersOther Users

Total Number of IMAP Connections (Past Year)

0

100,000

200,000

300,000

400,000

500,000

600,000

700,000

800,000

900,000

1,000,000

Date

Nu

mb

er o

f Co

nn

ectio

ns

Per

Day

Webmail Pro+3.0 ConnectionsGopherMail ConnectionsOther Connections

E-mail Messages Rcvd Per Week (Past Year)

0123456789

101112131415161718

05/0

705

/28

06/1

807

/09

07/3

008

/20

09/1

010

/01

10/2

211

/12

12/0

312

/24

01/1

402

/04

02/2

503

/17

04/0

704

/28

Week Ending

Mil

lio

ns

of

Me

ss

ag

es

Pe

r W

ee

k

BlockedUnknown userGrey ListedAcceptedOther

Incoming Email Statistics (April 7 - May 4)

Relay Denied0.3%

User allowed0.3%

Greylisted orRate-limited

13.4%

User Inactive0.4%

Unknown user

12.7%

Blocked55.5%

Accepted23.8%

Messages Blocked By Reason (Past Year)

0

1

2

3

4

5

6

7

8

9

10

11

Week Ending

Mill

ion

s o

f Mes

sag

es B

lock

ed P

er W

eek

Spam source DynamicInsecure Protocol ViolationDNS Unauthorized access

Spam/Virus Blocking by Reason (April 7 - May 4)

Dynamic3.3%

Spam source7.7%

Insecure18.5%

Unauthorized Access65.3%

Protocol Violation

1.6%

Bad Mail From0.0%

DNS3.5%

Viruses Detected Per Week (Past 12 months)

0

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

9,000

5/7 6/7 7/7 8/7 9/7 10/7 11/7 12/7 1/7 2/7 3/7 4/7

Week Ending

Vir

use

s D

etec

ted

Bits ‘n’ Bytes

M Keys: over 4,600 distributed– Data Warehouse cut over Sunday

4/20– EFS is final application to be cut over

in Phase 1 Current price of an email password

on the black market? $4 to $30http://isc.sans.org/diary.html?storyid=4261

‘‘Till next month…Till next month…

Chris BongaartsChris Bongaarts [email protected] 612-625-1809612-625-1809

Steve SiirilaSteve Siirila [email protected] 612-626-0244612-626-0244

Internet ServicesInternet Services [email protected]