A. The SkyScan AV Service should be seen as an additional
layer of defence that supports what you already have in place. Although desktop anti-virus products are an essential part of any anti-virus policy, it's difficult to ensure that the virus signature files are
maintained especially where mobile users are concerned. With the huge increase in Internet and email use, intercepting viruses closer to the source is logical and will add a new layer of defence and
protection.
Q. I have a comprehensive anti-virus strategy which includes software at both the desktop and the gateway. Why would I need the MessageLabs service?
A.
MessageLabs is independent of any anti-virus vendor and uses 4 anti-virus scanners, only selected after extensive testing. Our statistics show that any one anti-virus scanner misses at least 3% of viruses.
Even if a customer uses more than 1 scanner, it is still necessary to keep signatures updated and react quickly to new outbreaks – the SkyScan AV Service automatically updates signatures every 10 minutes.
Q. How much would a computer virus cost my company?
A. The key cost is in lost productivity but there is also the time your IT staff spend disinfecting all your machines
and the cost of lost files and data. Additionally there may be a need to shut down all external email until the problem is resolved – essentially 'cutting-off' a business-critical communication tool.
Independent American (ICSA) and British surveys (Department of Trade and Industry) suggest that the average cost of a virus infection or security breach can vary between £20,000 and £100,000.
Furthermore, disruption can be caused by network system crashes, the loss of customer data, corrupted files and the reduction in end-user confidence.
Q. How did MessageLabs protect their
customers from the LoveBug virus?
A. MessageLabs was able to protect all of its customers thanks to its proprietary scanner Skeptic™, which intercepted the first copy of the LoveBug
virus shortly after midnight on Thursday 4th May 2000.
Skeptic is a rules-based and heuristic virus scanner that enables the system to intuitively react to any new virus outbreak immediately. It instantly
identified and stopped the LoveBug virus because it detected characteristics similar to those found in a virus intercepted a few months before.
The anti-virus companies did not produce a public signature,
or report any interception till at least nine hours later. MessageLabs was stopping the LoveBug virus and protecting its customers hours before anyone else worldwide. Not a single copy of the LoveBug virus
penetrated the MessageLabs Email Control Centre and to date over 16,000 copies have been intercepted including several variants.
Q. What happens in the time between a new virus outbreak
and the signatures becoming available from the anti-virus vendors?
A. Firstly, through our partnership with the anti-virus vendors we have the advantage of having access to signatures and
incremental updates before they are publicly available. Secondly, we monitor the high levels of email traffic passing through the Email Control Centre and can quickly identify any signs of a new virus. When
a new virus is detected we configure Skeptic™, MessageLabs' proprietary rules-based and heuristic scanner, to intercept it based on its core characteristics. For example, we can block all mail
programmed to forward to 50 people that contains an EXE file.
Q. Do you measure volumes of email passing in and out of our network and virus activity levels?
A. Yes.
Every customer is given access to InSight, a web-based management tool providing comprehensive service statistics and reports in real time.
Q. Is it not possible for a company to provide
total protection at a local area network level?
A. Yes it would be possible to have total protection at the LAN level but economies of scale make it far more logical to add an extra layer
of protection in the form of a centrally-hosted facility. To have total protection at a local level you would need an anti-virus scanner and an email-to-virus scanner gateway.
In addition, you would need
support staff, who are trained in anti-virus procedures, and update virus signatures at least every hour and be able to identify and react quickly to new virus trends. You would also need to use more than
one anti-virus scanner and make sure that your gateway product supports multiple scanners.
Q. Our Exchange Server uses anti-virus software to check inbound mail, surely we're covered?
A. Microsoft have indicated that the server based anti-virus solutions are a significant cause of server failures. In addition, the anti-virus system contained within Exchange only allows
for one anti-virus scanner which really isn't sufficient and the anti-virus program still needs to be managed and maintained.
Q. We use an SMTP solution, isn't this the same as your
product?
A. Compared with standalone gateway solutions such as Trend Interscan or Mimesweeper our service offers several key advantages:
- We use 4 virus scanners
- The system automatically updates signatures every 10 minutes with incremental updates before they are even publicly available
- There is no hardware, software or management required by the customer – we do everything
- Scalability – our system is completely scalable – handling millions of messages a day – avoiding the limitations and single point of failure inherent in single machine/LAN solutions
- With over 2,000,000 emails passing through the system everyday we can instantly identify any trends or signs of a new virus
- Skeptic, our rules-based and heuristic scanner, can enable the system to intercept viruses based on certain characteristics before a signature is available
- Through InSight, our customer-only web-based management tool, we provide real time service statistics and reports
Q. How often do you update the signatures for your virus scanners?
A. We use 4 leading anti-virus scanners and update all signatures every 10 minutes. In addition, our
vendor partners ensure that signatures are updated instantly by the anti-virus software authors – including incremental updates normally unavailable to other subscribers. We also monitor the key anti-virus
web sites and hack centres for breaking news and trend analysis.
Q. What about new macro viruses?
A. Although we cannot catch viruses before the signatures are
available, our statistics show that most email viruses are MS Office macro based. If requested we could block all MS Office documents containing macros to and from your organisation in an emergency.
Q. How do you scan our outbound mail?
A. To scan outgoing mail, you configure your mail gateway to forward all mail to vscan.messagelabs.net. All major mail gateways
(Exchange, Lotus, etc.,) allow you to do this via simple configuration screens. Clean email is then immediately forwarded to its destination.
Q. How do I know my mail has been scanned?
A. Every email is scanned, except for encrypted mail, and a banner is attached stating that a message has been passed by MessageLabs and is virus free. The banner can be tailored to each
customer with the default as follows:
In the case of multi-part mail, the banner is attached to both the plain text, and the html formatted part.
Banners cannot be added to digitally signed mail, since this would invalidate the
digital signature. Therefore, we can also add a line to the message header reading:
Q. What happens once a virus is detected?
A. When a virus is detected the Message Distributor will pass the contaminated mail into the Virus Containment Unit. The sender, recipient
and a selected administrator will be immediately notified. You can also nominate an additional contact email address to receive a copy of the virus warning.
Q. What happens if MessageLabs
detected a virus but the document contained important information which the customer needed urgently?
A. Infected mail is kept in the secure area for 30 days. If requested and authorised,
our support department can pass on any infected mail.
Q. Can MessageLabs handle our volumes?
A. We have designed the system from the ground up to be scalable and
inclusive of significant redundancy. Each control tower is capable of scanning 5,000,000 emails every day and as volumes increase more towers will be added. Towers will be deployed at every major Internet
exchange around the world during 2000 providing global coverage. MessageLabs aim to maintain 100% redundant capacity at all times.
Q. Does this slow mail down?
A.
MessageLabs maintains comprehensive statistics on all mail passing through our system. It takes us 1.2 seconds to process an average email.
