GFI MailSecurity for Exchange/ SMTP Version 10

[LEFT][CODE]http://www.messagingtalk.org/product-review-gfi-mailsecurity-for-exchange-smtp-version-10[/CODE]

[B]Disclaimer[/B]

This product review reflects my own opinion & views about GFI MailSecurity for Exchange/SMTP Ver 10. Throughout this review, GFI product documentation has been consulted in order to refine my thoughts and references.
[B]Introduction
[/B]

Do you ever dare to leave your home with doors open? Probably not! The same goes with our company network, if you do not have a properly configured firewall. Also, if you do not give any importance for security in your messaging infrastructure, the impact will be severe too. In other words, mail server will get exposed highly to the very bad “animals” such as Trojans & Viruses.

E-mail is very mission critical in this digital economy, and therefore we should never overlook the security in our email system. Gone are the days where you could totally rely the updated virus definitions on your desktops & laptops. Love bug Virus has given a “lesson learned” incident to many organizations in the past.
[B]Why GFI MailSecurity for Exchange/SMTP?
[/B]

Industry provides many solutions on compacting these bad “animals” to a great deal, so GFI MailSecurity for Exchange/SMTP v10 does. GFI MailSecurity is server based and which includes multiple virus scanners with effective signatures/definitions being updated regularly. Meaning, once you purchase this product, you have the ability to subscribe various virus engines licenses and its definitions. The five vendors supported by this product are Norman, McAfee, Kaspersky, BitDefender & AVG. I will explain why one virus engine is not enough in the later part of this review.

GFI MailSecurity allows the automatic download of virus definitions on a scheduled manner from all the scan engine vendors. If your organization is running on Exchange 2000/2003/2007, GFI MailSecurity for Exchange/SMTP is worth considering. I have been using the GFI MailSecurity 10 in my lab for a while; apart from the anti-virus feature, GFI MailSecurity offers other great capabilities to offer . They are,

[LIST][*][B]Information Store Protection[/B][*][B]Content and Attachment checking[/B][*][B]Virus Scanning[/B][*][B]Email Exploit Engine[/B][*][B]Quarantine[/B][*][B]HTML Sanitizer[/B][*][B]Real-time Monitoring[/B][*][B]Decompression[/B][/LIST]
I explored some of these functionalities in detail as below:
[B]
Information Store Protection[/B] – if this option is enabled in GFI MailSecurity, message contents in the Microsoft Exchange Information store will be scanned for viruses through Microsoft’s Virus Scanning API (VSAPI). If you see below [B]Figure 1.0[/B], I have enabled all the three virus scanning engines to protect information store. VSAPI is effective and efficient when it comes to attachments as it scans only once even though there are multiple recipients.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiis.gif[/IMG]
Figure 1.0

[B]Content & Attachment Checking[/B] – in Mail Server, this area is being considered as “check post” for immigration/clearance. GFI does its job here very good with great results as it controls both content and attachments in the email while passing through. It will ensure messages with VBScript attachments are blocked, restrict users sending/receiving attachments and minimize spam by greater level of filtering – GFI has all these features. When you install GFI, there already few rules by default. One of default rules in GFI is to block all potentially malicious attachments (namely, .exe, .js, .vbs, .vb etc) – See [B]Figure 1.2[/B] below. It has also created separate rules for image, video & audio out of the box.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiattach.gif[/IMG]
Figure 1.2
[B]
Virus Scanning [/B]– As a must feature, GFI comes with Virus scanning. It scans all the incoming/outgoing mails as well as information store. By default, GFI enables three virus scan engines – Norman, BitDefender & AVG. Under normal circumstances, this is good enough. If you think this is not sufficient for your environment, feel free to add the rest of the engines – Kaspersky & McAfee. If you see below [B]Figure 1.2[/B], I was provided with 3 licenses and activated them on priority.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiav.gif[/IMG]
Figure 1.2


[B]Why do we need multiple Virus Engines? [/B]

If you use multiple virus scan engines, the advantages are more. So GFI MailSecurity 10 with 5 scan engines is the right choice, because:


[LIST][*]There is a high probability that rising threats will be promptly fixed.[*]It provides high availability when one of the scan engines fails.[*]Administrators have the flexibility to choose the most effective scan engines from the list of five which delivers most appropriate level of protection for their mail server environment[*]You can perform the reconfiguration or update of engines in offline mode without being the message queued.[/LIST]
In nutshell, those viruses are being unblocked or undetected for longer time are significantly reduced.
[B]
Email Exploit Engine[/B] – The way suspicious attachments are being received by users are changing constantly, it’s just not only coming from the email explicitly. It has found many means to reach you, for example, active content or scripting via HTML emails are destructive too. I am very glad to see that this new version of GFI MailSecurity has provided this feature in compacting email exploit to a great deal ([B]Figure 1.3[/B]).

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiemailexplo.gif[/IMG]
Figure 1.3

[B]Quarantine [/B]– By doing content & attachment filtering by GFI MailSecurity, there will always be messages filtered. So quarantining these messages is the best practice rather than trashing it upfront. Authorized personnel can manually approve or reject those messages being filtered. In the below [B]Figure 1.4[/B], [email]sfiroz@bright.local[/email] is the authorized person to do this job.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiqurant.gif[/IMG]
Figure 1.4

GFI MailSecurity 10 allows administrators to configure a series of folders, this is to manage quarantined mails better and faster. At any given time, a quarantined folder can be setup with a purpose – for example, a folder created for a particular user due to its emails are being infected by virus continuously or folder created for a user who suspiciously sending some image files to outside the organization, and there can be many scenarios with various reasons. Once you are in a situation where you created large number of folders, then the need of search within the quarantined emails becomes more important. If you see the below [B]Figure 1.5[/B], search is performed based on sender, ID, recipient, subject, reason for quarantine, date and source.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiqua2.gif[/IMG]

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfiqua1.gif[/IMG]
Figure 1.5

[B]HTML Sanitizer[/B] – Using HTML, it’s easy to embed malicious commands in the mail. GFI MailSecurity does a good job here by scanning the email body, then detect if any .htm/.html attachments for scripting code and finally sanitize the HTML. By default, GFI MailSecurity enabled this feature for both inbound and outgoing emails, see [B]Figure 1.6[/B] below.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfisanitizze.gif[/IMG]
Figure 1.6

[B]Real-time Monitoring[/B] – Below is the screen capture from GFI MailSecurity server in my lab. This monitor keep refreshed in 10 seconds by default (it can be changed). All the scanning activity are shown in sequential manner (see below [B]Figure 1.7[/B]).

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfirealmon.gif[/IMG]
Figure 1.7

[B]Decompression[/B] – GFI MailSecurity provides Decompression engines with set of rules already defined such as password protected files, corrupted files, recursive files etc. (see [B]Figure 1.8[/B]). This rule defines how various archive files are appropriately handled.

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gfidecompress.gif[/IMG]
Figure 1.8


[B]Installation
[/B]

You can install this in a separate physical machine as Mail Security gateway to be used as typical SMTP server, I installed directly into my Exchange 2003 backend server. I installed this in my MS Exchange Server 2003 SP2 Enterprise Edition. Once the straight forward installation is finished, rest of the configuration and administration can be done using the GFI MailSecurity administration panel as below ([B]Figure 1.9[/B]).

[IMG]http://www.messagingtalk.org/sites/messagingtalk.org/files/gficonsole.gif[/IMG]
Figure 1.9

[B]Trial Version & Availability[/B]

You can find out more about GFI MailSecurity for Exchange/SMTP 10 from the [URL="http://www.gfi.com/mailsecurity/msec10manual.pdf"]product’s info page[/URL] and you can download the 30 days trial version of GFI MailSecurity from [URL="http://www.gfi.com/downloads/downloads.aspx?pid=msec&lid=EN"]here[/URL]. Pricing for GFI MailSecurity starts at $575 for 25 users

[B]Summary[/B]

I prefer GFI MailSecurity very much mainly because its ease of usage in Administrator's perspective. I have been evaluating this in my lab using MS Exchange 2003 server. If your organization has a different version of Exchange (e.g. Exchange 2000 or the latest Exchange 2007), GFI MailSecurity 10 supports them with no big difference in features, setup as well as usage. Overall my rating is 4.5 out 5 for GFI MailSecurity and I highly recommend this. However some pros & cons worth mentioning here about GFI MailSecurity.

[B]Pros[/B]


[LIST][*]Straight forward installation, configuration & administration[*]Easy use for Administrators. Reduced Maintenance. Multi-layered defense.[*]Remote management using Web based console.[*]GFI MailSecurity is affordable in the market and maintaining the subscription cost is relatively low.[/LIST]
[B]Cons[/B]


[LIST][*]Honestly, I don’t see any cons in terms of features and performance. My ratings becomes 4.5 out of 5 is just because of this.[/LIST]

[/LEFT]