IIS & Exchange Digest

This post is not directly Exchange related, but more general about one way of enhancing messaging security, so it’s actually relevant no matter what messaging platform you have.

In this post I’ll try to outline some of the hosted mail gateway security products that are available on the market. A mail gateway is generally used to relay mail in and out of the company. Mail Security gateway became popular services a few years back, by providing external scanning for spam and virus of all incoming mail traffic. Today some ome of the services listed below also has additional features, such as backup and compliance among some of the features.

Below is some of the messaging security companies that provide mail security, there’s properly a lot more, but these seems to be the most popular ones:

• Microsoft Exchange Hosted Filtering (Formerly known as FrontBridge)
• MessagingLabs (Recently acquired by Symantec)
• ExchangeDefender
• Postini (Now owned by Google, now part of Google Apps Security Services)
• Comendo (also known as Virus112)
• SoftScan
• SpamFighter (Available as a hosted solution and as a module for Exchange)

The last 3 are Danish companies and they all provide a hosted mail gateway solution, although SpamFighter also have the product: SpamFighter Exchange Module, a lot similar to what we know from the Microsoft product: ForeFront Server for Exchange Server.

Of course the price varies on the products and services listed above. I don’t know all the services myself.

This post was meant as inspiration and to list the options of hosted mail security solutions available. Using external mail security gateway solutions is a great way of enhancing messaging security for your company, without having the competence in-house to maintain and manage the mail security solutions and keep all the spam and virus filters up-to-date.

It’s still not best practice to always use an external mail gateway to enhance messaging security, but again depending on the organizations requirements it could be very good practice.

Pros:

• The provider is doing filtering as their business and they are usually very good at it
• SMTP backup, if the internal Exchange is unavailable for a period, the mail is usually kept for up to 7 days and you can pay for more
• Usually 4-8 different scan and spam engines are used
• All maintenance are handled externally, you pay for a service and no other costs to licenses and software maintenance
• All spam/virus definition updates are handled externally and more frequently than a lot of the internal solutions
• All support handled externally

Cons:

• All support handled externally
• “Trust the provider” – this is essential with any hosted services
• You might loose some control of the filters, depending on the control you are used too

By using external solutions like the ones above, does not mean you can leave your internal Exchange without any antivirus and antispam software. It’s always good practice to have a two layer security strategy, combining the external solution with you existing internal solution. So there’s no savings on the cost of licenses and management of the internal solution, but security is always a cost at some point, it’s just a matter of what level you want.

When talking about TCO with hosted messaging security, it’s worth mentioning, that if you already have Exchange Enterprise CALs, Microsoft Exchange Hosted Filtering is available at no additional charge.

Cross-posted at: http://it-experts.dk/blogs/petsch/archive/2008/10/22/messaging_2D00_security.aspx