Office Network Antivirus & Spam Filter Options

**Rob** · 12-10-2009, 13:31

So our office internet security system is due for renewal. What might my better options be?

At present we operate a centralised console running on the office server. The console allows configuration and control of all the antivirus / antispam distributions to other networked workstations and the server itself. But the console does have a habit of bombing out or loosing it's connections to clients.

The server runs Small Business Server 2003 software all on one box. That iincludes the file server functions, domain control permissions, ISA server (the firewall proxy), Exchange (email server), SQL, and something called Sharepoint. Running the antispam and antivirus on this server adds to the load, most significantly in RAM use which is maxed out.

Spam filtering is more of a headache than antivirus. OK so the a/v can be a bit of an overhead on a couple of the slower workstations. But the spam filter kills around 1000 emails a day and that is ever inicreasing. Even so some junk gets through.

I'm coming to a conclusion that an integrated spam and antivirus system is no longer the way to go, at least if that is being run from the main server.

Does anyone have experience of these gateway defender type boxes that somehow sit between the internet and mail server to pre-scan and filter all email? Would I still need an antispam on the server? Can these sit alongside a server based antivirus system?

webcrawler2050 · 12-10-2009, 14:04

Quote:

Originally Posted by Rob

So our office internet security system is due for renewal. What might my better options be?

At present we operate a centralised console running on the office server. The console allows configuration and control of all the antivirus / antispam distributions to other networked workstations and the server itself. But the console does have a habit of bombing out or loosing it's connections to clients.

The server runs Small Business Server 2003 software all on one box. That iincludes the file server functions, domain control permissions, ISA server (the firewall proxy), Exchange (email server), SQL, and something called Sharepoint. Running the antispam and antivirus on this server adds to the load, most significantly in RAM use which is maxed out.

Spam filtering is more of a headache than antivirus. OK so the a/v can be a bit of an overhead on a couple of the slower workstations. But the spam filter kills around 1000 emails a day and that is ever inicreasing. Even so some junk gets through.

I'm coming to a conclusion that an integrated spam and antivirus system is no longer the way to go, at least if that is being run from the main server.

Does anyone have experience of these gateway defender type boxes that somehow sit between the internet and mail server to pre-scan and filter all email? Would I still need an antispam on the server? Can these sit alongside a server based antivirus system?

For MX filtering, Mailfoundry works a treat. http://www.mailfoundry.com/

gazzae · 12-10-2009, 14:13

We use a hosted service in work. It works great for us, very few false positives. It flags items as Virus/Definite Spam/Likely Spam. Every day you get an email showing the likely spam it has filtered then if there is something you want you can this click on a link and it will be delivered to you.
http://www.mxsweep.com/services/emai...tion-overview/

Druchii · 12-10-2009, 16:02

We use an off-site service or mail filtration (Spam, Viruses, Phishing) called Frontbridge.

MS bought them out, but it is a kickass service.

Matthew · 12-10-2009, 16:23

There is Sophos although I dont rate them anymore, there is also NOD32 by Eset. We use McAfee for AV at the moment at work and soon it will be centerally managed. Just a few. Personally I would go with NOD.

**Rob** · 12-10-2009, 17:07

I have to be careful to ensure the antivirus system is properly written for use on the Small Business Server system. I need to ensure too that it doesn't have too great an overhead on resources. I suspect that might come down to a toss up between AVAST and NOD32.

The suggestions for spam filtering look interesting thanks.

webcrawler2050 · 12-10-2009, 19:36

Quote:

Originally Posted by Rob

I have to be careful to ensure the antivirus system is properly written for use on the Small Business Server system. I need to ensure too that it doesn't have too great an overhead on resources. I suspect that might come down to a toss up between AVAST and NOD32.

The suggestions for spam filtering look interesting thanks.

Mailfounry is great. If you have the Colo space however, its pretty exspensive, for a hosted solution, http://www.messagelabs.co.uk/ are pretty good.

**Rob** · 12-10-2009, 20:04

Cost of all this will be an issue. The clue here is that we run "Small Business Server" and that has a 75 client / user limit. In fact we have about 20 users and are rarely likely to get more than 15 using the network at once since many of those are part time.

It's only an ADSL-Max connection, and our webspace is very much the basic entry level shared hosting services. Thus things like colocation would be way outside of our league and needs. It's really a choice of running stuff locally on the server, having some sort of gateway, or routing all traffic through a third parties service.

webcrawler2050 · 12-10-2009, 20:31

Quote:

Originally Posted by Rob

Cost of all this will be an issue. The clue here is that we run "Small Business Server" and that has a 75 client / user limit. In fact we have about 20 users and are rarely likely to get more than 15 using the network at once since many of those are part time.

It's only an ADSL-Max connection, and our webspace is very much the basic entry level shared hosting services. Thus things like colocation would be way outside of our league and needs. It's really a choice of running stuff locally on the server, having some sort of gateway, or routing all traffic through a third parties service.

Personally, i'd recommend this:

buy a cheap VPS - install exim only, install cPanel - install ASSP (http://www.grscripts.com/) send all MX entries that way and have all accounts IMAP / POP 3 - probably looking at about Â£25 a month-ish.

**Rob** · 13-10-2009, 12:03

I'm not clear how that would work alongside exchange? Wouldn't the cpanel become the controller of all the email addresses for users. We do make heavy use of exchange for it's multiple distribution lists, multiple email domains, and multiple individual user email addresses as well as exchange allowing integration of diaries and such like through Outlook and Outlook Web Access.

webcrawler2050 · 13-10-2009, 16:48

Quote:

Originally Posted by Rob

I'm not clear how that would work alongside exchange? Wouldn't the cpanel become the controller of all the email addresses for users. We do make heavy use of exchange for it's multiple distribution lists, multiple email domains, and multiple individual user email addresses as well as exchange allowing integration of diaries and such like through Outlook and Outlook Web Access.

This is just my opinion and what i've personally done to save cash for business with various clients, who currently have exchange etc.

I've took away the Exchange system completly. Crazy you might think. However, in the long term it has saved alot of money. Using IMAP will allow you to have distrubution lists. Multiple domains, multi users, forwarders, auto responders etc etc - all the standard stuff

The VPS (exim) would become the controller, cPanel is just an API to allow you to create email address, manage space etc. ASSP is very very very good with spam and if tweaked right, will just about stop anything.

You're not going to be using HTTPD, MYSQL etc etc - so this can all be disabled and turned off. Your only going to be using the VPS for MX.

At the same time, if the box was tweaked right, you could cut down and maybe even prevent spoofing of some description. Although, you can't stop spoofing alltogether. However, tweaking Exim will help prevent this.

The VPS could easily be managed etc by the host and or 3rd party, or if you are fluent, yourself. . You can share calendars / diaries etc, if you are using POP3, Exchange and or IMAP again, theres plenty of Opensource software to basically do what exchange does. As far as I'm aware, Exchange is based on IMAP is some variety of another. Also, you can IMAP on mobile devices, etc etc.

So in review, your basically taking away the onsite Exchange box - using something far more simple and effective and will save a hell of alot of cash in my eyes.

Again, this is just a suggestion. I'd be more than happy to provide any guidance and or questions you may or may not have.

Ignitionnet · 13-10-2009, 21:20

Quote:

As far as I'm aware, Exchange is based on IMAP is some variety of another.

Tad vague for someone who claims to have done full Exchange -> open source migrations and to have an MCSE.

Exchange is based around MAPI and NSPI. If you have the experience and certifications you claim to have you will know this and not be 'As far as I'm aware' about anything to do with how MS Exchange is built. IMAP access is available but is relatively limited in functionality compared with a full MAPI / NSPI implementation. Full functionality is only available via Windows Mobile / OWA and fully MAPI / NSPI compatible clients. MAPI is a closed standard so easier said than done to produce a compatible client.

webcrawler2050 · 13-10-2009, 21:21

Quote:

Originally Posted by Broadbandings

Tad vague for someone who claims to have done full Exchange -> open source migrations and to have an MCSE.

Exchange is based around MAPI and NSPI. If you have the experience and certifications you claim to have you will know this. IMAP access is available but is relatively limited in functionality compared with a full MAPI / NSPI implementation. Full functionality is only available via Windows Mobile / OWA and fully MAPI / NSPI compatible clients. MAPI is a closed standard so easier said than done to produce a compatible client.

I aint going into details. I hate exchange full stop. Please stop.

Ignitionnet · 13-10-2009, 21:29

Quote:

Originally Posted by Rob

So our office internet security system is due for renewal. What might my better options be?

Messagelabs usually worked well for all the places I've been. Just contact them, do the deal, and forget about it - they are very good

---------- Post added at 22:29 ---------- Previous post was at 22:26 ----------

Quote:

Originally Posted by webcrawler2050

I aint going into details. I hate exchange full stop. Please stop.

Sorry to have burst your unreality bubble by bringing facts into it and pointing out your contradictions. As an MCSE you would be very familiar with MAPI, NSPI, RPC, etc. You lied, you got caught, end of.

webcrawler2050 · 13-10-2009, 21:32

Quote:

Originally Posted by Broadbandings

Messagelabs usually worked well for all the places I've been. Just contact them, do the deal, and forget about it - they are very good

---------- Post added at 22:29 ---------- Previous post was at 22:26 ----------

Sorry to have burst your unreality bubble by bringing facts into it and pointing out your contradictions. As an MCSE you would be very familiar with MAPI, NSPI, RPC, etc. You lied, you got caught, end of.

meh - either way. The above is still my reccomendation.