MXSweep Hosted Protection

Transcription

1 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT MXSweep Hosted Protection JANUARY

2 2 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT CONTENTS MXSweep Tel: +44 (0) Introduction...3 Test Network...4 Test Methodology...5 Product Testing Reporting...6 Checkmark Certification...7 The Product...8 Test Report...9 Test Results...14 West Coast Labs Conclusion...15 Security Features Buyers Guide...16 West Coast Labs, William Knox House, Britannic Way, Llandarcy, Swansea, SA10 6EL, UK. Tel : , Fax :

3 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 3 INTRODUCTION As the war for corporate inboxes intensifies, and unmonitored s disrupt effective and secure working practices, Anti-Spam solutions continue to evolve to deal with this menace. In this, the second Anti-Spam Technology Report, we examine the functionality and performance of the leading products in this market, which are aimed specifically at the SME network environments. A key objective of the testing is to replicate the installation, configuration and use of the solutions in a real-world business environment to enable readers of the White Paper prospective buyers to make a meaningful assessment of the product that is right for protecting their corporate environment. Test Engineers have evaluated how the solutions install to ensure timely and effective spam protection. Consideration has also been given to the level of security administrator expertise and technical support required to facilitate both out-of-the-box operation and thereafter product training to ensure maximum effective spam protection. This reports provides an independent assessment of effectiveness with regard to: The features and functionality of the solution. Integration into a network infrastructure. The level of user administration required to operate the product effectively. Spam detection capability and rates of detection.

4 4 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT TEST NETWORK WCL has a number of domains that collect genuine spam. These domains receive varying levels of spam and are consistent with different environments. To reflect the usage within a corporate environment, within each domain are a number of designated user accounts with a variety of practices and needs including some that are subscribed to a variety of newsgroups and mailing lists. Some user accounts actively contribute to mailing lists. The multiple domains designated for testing purposes were those that, between them, receive spam at a level consistent with the defined requirements of testing. Software solutions included in the test program were installed on servers that meet the minimum specifications required by the vendor. Appliance-based solutions were installed on the network according to the vendor's recommended placing. For hosted services, WCL testes through identified domains and changed the MX records to divert the mail stream through the hosted service.

5 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 5 TEST METHODOLOGY WCL initially performed the testing with an out-of-the-box configuration, changing only those settings on the solution needed to ensure correct operation in line with the vendor's recommended installation and configuration procedures. Further testing was then performed following the vendor's advice for the tuning or training of the solution under test. WCL fine-tuned the solution each day of the test, spending no more than half an hour per day undertaking such work. Throughout the course of testing, a mixture of was sent to the test domains from other addresses and domains controlled by WCL to mirror genuine activity common in business, for example, requesting meetings, sending notifications to groups and non-business related social s. s were also sent from web-based accounts such as Hotmail and Google's Gmail in order to simulate external users sending non-business related social s, and home workers. Thus, during the testing period the domains received some spam, some list/newsgroup mailings and "genuine" individual s.

6 6 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT PRODUCT TEST REPORTING Product evaluation addresses three specific areas* - Management/Administration, Functionality, Performance plus Additional Feature Testing. 1. MANAGEMENT/ADMINISTRATION Ease of Setup/Installation Ease of Use Logging and reporting function Rule creation Customization Content Categories 2. FUNCTIONALITY Processing Steps Allow/Blocking of Quarantine Area Additional functionality reporting Steps to Process Block Addresses Blacklist/Whitelist Allow Addresses 3. PERFORMANCE Volume or Percentage of spam detected False positive rate Spam incorrectly passed through Legitimate mail blocked Legitimate subscription mail blocked

7 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 7 CHECKMARK CERTIFICATION Upon completion of the testing, individual product results are analyzed, resulting in accreditation to one of the two Checkmark Certifications for Anti- Spam subject to achieving the following catch rates:- Checkmark Anti-Spam Certification - Premium - 97% and over Catch Rate. Checkmark Anti-Spam Certification - Standard - 90% and over Catch Rate.

8 8 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT THE PRODUCT MXSWEEP HOSTED PROTECTION MXSweep Protection protects your business, employees and infrastructure from spam, viruses, fraud and other threats. MXSweep spam filtering is backed by world leading Spam detection methods. Unlike traditional security solutions, we look after the chore of continuous real time database updates so you never have to worry about updating the service. Backed by a 24-hour active response team to enable spam free . Protecting from both inbound and outbound threats, you can rest assured your business remains pure. MXSWEEP SAYS ABOUT THE BUSINESS BENEFITS... Reduce I.T. overheads Protected in 1 hour Improve employee productivity by eliminating spam Protect business assets from viruses and attackers MXSWEEP SAYS ABOUT THE TECHNICAL BENEFITS... Denial of service protection Directory harvest protection Saves bandwidth Provides multiple layers of spam detection Requires no software or hardware Works with any platform

9 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 9 TEST REPORT INTRODUCTION MXSweep provides a hosted service aimed at organizations ranging in size from small business to larger enterprises, who are looking to outsource protection against spam. As MXSweep is a managed service there is no need for hardware or software installations, increasing the speed in which an organization can begin benefiting from spam protection. As the responsibility for managing the antispam service is held by a separate company, the system administrator is then free to focus on other security matters. This is an ideal situation for smaller companies who may be looking to avoid the added cost of hardware or a further drain on perhaps already stretched manpower.

10 10 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT TEST REPORT INSTALLATION AND CONFIGURATION To enable a trouble-free transfer to the hosted service, the team at MXSweep have developed a fast and efficient setup process. The company claims to be able to begin protecting an organization's mail from spam within one hour of contacting them. The first stage of the setup is the provision of an online signup form asking the administrator to enter details about the company and a technical contact. Below this are a series of questions relating to technical information about the mail servers, such as addresses and any mail software being used. Using this information, engineers at MXSweep then create the account and provide the administrator with logon credentials and information about further customization. Amongst the information provided to the administrator is a user guide that is customized to match the mail server currently being used by the company; this provides great help in configuring the service to best suit the needs of the company. Upon receipt of a message defined as genuine, MXSweep automatically creates accounts for each user within the protected domain. This has the effect of further reducing the time required for setup. By default each created user belongs to the domain group but users may also be assigned to different groups.

11 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 11 TEST REPORT INTERFACE Access to the service is provided through two separate web interfaces running over a secure connection; one provides a Helpdesk function while the other acts as a reporting tool. Logging into the Helpdesk interface allows the administrator to view two points of functionality: the Junk Box for information relating to detected malicious or unwanted mail, and the other for User Management. The Junk Box provides the ability to search through various blocked messages including spam, phishing, and virusinfected s. User Management allows an administrator to view and edit further information for each user account, such as reporting options and blacklists. MXSweep offers protection against spam through the use of several leading antispam industry technologies, including checks for user authentication, sender reputation, and content filtering. Using a layered approach to spam filtering means that a spam message must successfully avoid a series of scans and checks before it is able to reach the user's mailbox. Also, like most managed services, MXSweep assumes responsibility for updating the service, ensuring that even the most recent of spam patterns and families are checked for. Messages that are detected as spam by MXSweep are immediately blocked, avoiding the scenario of detected spam messages ever having impact on the stability of the mail server. So that the user is constantly aware of which s are blocked, a web interface is available that allows the user to view a list of all previously blocked messages. Using this method, any messages that are incorrectly classified as spam may still be viewed, thus removing the risk of potentially important information being missed. Adjusting the options for the detection of spam is carried out via the User Management section of the Helpdesk interface. From here the administrator may add or remove names and addresses from within various black and white lists. Also available are the settings relating to how aggressively

12 12 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT TEST REPORT MXSweep should check for spam. By default each user is set to default group settings, however options are available that allow the administrator to log into each user's account and select an aggressiveness level between one and five for various fields. These fields include sexual content, offensive language, and gambling, along with settings for the Bayesian filter. This method of selecting between one and five allows for quick and easy configuration, adjusting the level of scanning to best suit the needs of the company, or individual employee. REPORTING Reporting for MXSweep is handled by the second of the two web interfaces, from which the administrator may view a breakdown of all traffic that has been processed by the service. By selecting different options from the available fields, the administrator can view information gathered between various dates and relating to individual user addresses. The data displayed in the reports is well presented through a series of charts and accurately portrays the requested information. There are two reports pages available: Reports and Audit Centre. The Reports page, which is also the page initially displayed after login, allows the administrator to view traffic information between any two dates. The administrator may either enter the dates manually or select from a calendar function, and then use the Generate Report link. In very short time, the interface returns the report for the requested dates. The report itself is made up of three individual pie charts showing Good Versus Bad Mail, Analysis of Bad Mail, and Top Spam

13 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 13 TEST REPORT Recipients. Each of these charts is color coordinated and provides an accurate portrayal of traffic received by the service. The first chart displays a comparison of the amount of bad mail, such as spam and phishing, compared to genuine mail. The second chart breaks down detected bad mail into six categories: likely spam, definite spam, likely phishing, definite phishing, likely virus, and definite virus. Finally, the third reports on the users that received the highest quantity of spam mails in the given time frame. The second page within the interface is Audit Centre, which enables an administrator to search for messages using a number of different fields. These could be by date, recipient, sender, or direction. Any results based on the field entries are displayed in rows, with the entries containing the date, subject, sender, recipient, size and threat of the . 'Threat' relates to whether the message is defined as spam, phishing, or virus. Clicking on 'subject' allows the administrator to view the text body of the .

14 14 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT TEST RESULTS Type of mail Detected as genuine Detected as SPAM GENUINE 100% 0% SPAM 1% 99% MXSweep performed well, delivering 100% of the genuine mail correctly and correctly classifying 99% of the Spam mail. It is also worth noting that MXSweep delivers a good proportion of grey and list mail as genuine. This gives an organization the flexibility and opportunity to define policies during a training period without missing mail that could potentially be business critical. West Coast Labs is pleased to award MXSweep the Premium Anti-Spam Checkmark.

15 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 15 WEST COAST LABS CONCLUSION MXSweep offers a multi-layered and easily configurable hosted approach to spam detection. Using multiple leading technologies from the antispam industry, coupled with an intuitive and informative web-based interface, MXSweep provides any company with the power to protect their users from spam threats with confidence. The solution also offers good reporting capabilities, portraying an accurate representation of mail traffic over any given time period. Overall, MXSweep provides an organization with a strong defense against spam with the benefits associated with a managed service. West Coast Labs Disclaimer While West Coast Labs is dedicated to ensuring the highest standard of security product testing in the industry, it is not always possible within the scope of any given test to completely and exhaustively validate every variation of the security capabilities and/or functionality of any particular product tested and/or guarantee that any particular product tested is fit for any given purpose. Therefore, the test results published within any given report should not be taken and accepted in isolation. Potential customers interested in deploying any particular product tested by West Coast Labs are recommended to seek further confirmation that said product will meet their individual requirements, technical infrastructure and specific security considerations. All test results represent a snapshot of security capability at one point in time and are not a guarantee of future product effectiveness and security capability. When West Coast Labs provide test results for any particular product tested, said results are most relevant at the time of testing and within the context of the specific scope of testing and relative to the specific test hardware, software, equipment, infrastructure, configurations and tools utilized during that specific test process. West Coast Labs is unable to directly endorse or certify the overall worthiness and reliability of any particular product tested for any given situation or deployment.

16 16 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT SECURITY FEATURES BUYERS GUIDE AS STATED BY MXSWEEP... Keeping business pure is an everlasting task! Spammers are sending higher volumes of spam, and using new techniques to bypass spam filters. The rapid increase of image spam has reduced the effectiveness of rules based spam filters. In additional to this the spread of botnets have caused a large number of false positives when using traditional IP blacklists. MXSweep understands that spammers will continue change methods. We will always continue to update or add additional technology to stop new trends in spam from penetrating our defences. This dynamic approach to spam detection will ensure MXSweep customers will always benefit from the most accurate spam detection on the market. MXSweep multi layered approach to spam detection process stops spam before it gets into your business. Layers of detection include: Sender Authentication Sender Reputation Content Filter Collaborative Network Real-time outbreak monitor FEATURES Save employee time by removing spam from their inbox Optimise network resources by reducing bandwidth congestion Access to all spam stopped from an online web portal Stops more than 99% spam Per user or per company access to spam quarantine Granular control of spam aggressive, at company or per user level. Outbound recipient profiling to reduce false positives Per user allow and block lists for addresses or domains Continuous updates

17 ANTI SPAM SOLUTIONS TECHNOLOGY REPORT 17 SECURITY FEATURES BUYERS GUIDE AS STATED BY MXSWEEP hour system management and support Audit of all entering and leaving the organisation No latency Protection from liability cases from employees Administrative control over user options Dashboard reporting of information 100% virus detection Server and Network protection Phishing / Fraud prevention Protected backup SMTP Periodic Summary of all blocked s Granular configuration controls from Web Portal Per user allow and block lists Web Reporting of threats auditing / message tracking centre No software or hardware required Perimeter Protection approach ensures attackers cannot enter your network Automated solution means that no manual updates of user lists required Intuitive web reporting interface alerts you to attacks that have been blocked Continuously updated to protect you from new threats