Congratulations to the GIAC White Paper winner for Q2 2009!
Jeremy Koster
Jeremy's paper is titled Zombie Profiling with SMTP Greylisting and can be viewed from the SANS Reading Room. Jeremy will be presenting this topic at SANS Sydney 2009.
Author Bio
Jeremy Koster is an Information Security Specialist for a large Australian Telco. He has been working in Information Security and the IT industry in general for over 12 years. The last 5 years he has concentrated on eradicating spam and malware from corporate environments.
Jeremy provides security guidance for IT initiatives within his organization as well as being involved in PCI DSS compliance projects, network security, spam protection, defenses against malware and web application security. In particular, Jeremy architected and championed a successful anti-spam solution comprising commercial, open-source and in-house built components. Jeremy supports the business by articulating risk and providing pragmatic mitigating solutions in an industry where identifying real risks is often difficult.
Jeremy holds a CISSP, GCIH and a MInfoSysSec from Charles Sturt University.
Synopsis
Email is consistently used to propagate malware, conduct phishing and deliver spam. A large proportion of this unwanted email is sent by compromised machines or computer zombies. This paper observes that computer zombies react differently to being greylisted, providing a method to profile computer zombies into various types. The GCIH course touches on the concept that this age is the Òage of the botnetsÓ and how malware is propagated with the help of email. This paper extends this topic by analyzing greylisting activity for the purposes of identifying computer zombies and exploring methods to reduce the unwanted email received from botnets.
Submit your paper for the GIAC White Paper of the Quarter!
Three Reasons to Submit Your PaperIf you are the GIAC Paper of the Quarter winner:
- Your paper will be published in the SANS Reading Room (one of the most visited pages on our site)
- You'll be asked to present your topic at a SANS conference or via SANS webcast
- A FREE SANS OnDemand course! The winner will receive free tuition and books for a SANS OnDemand course of their choice.
- Papers should be:
- on a relevant and timely security subject
- have a significant impact on the information security community
- 10 - 20 pages in length
- You do not need to hold a GIAC certification to submit a paper
- Papers should follow the GIAC Gold Guidelines
Papers will be judged by industry experts and based on expertise, content and impact on the industry.
