Company

Outsourcing Email Security

« Back

Author: Kurt Marko
Source: Processor Magazine

Jan. 26, 2007

Email is a manifest boon to most businesses; however, it’s been a mixed blessing for IT professionals. Whereas users are insulated from the hassles of running email infrastructure, the IT staff must cope with a raft of email-related problems, not the least of which are security threats and spam. Clearly, we are all inconvenienced by spam or suspicious message attachments, but that’s just the tip of the iceberg compared to the troubles email administrators deal with. Predictions of increased spam or email virus traffic are commonplace, but unlike the boy who cried wolf, these warnings are invariably true. According to statistics compiled by email security vendor Postini (www.postini.com), spam traffic grew by 147% last year (73% in the last quarter alone), and viruses were found in one out of every 200 messages.

While protecting users against these menaces was once a routine administrative task, the multiplicity and complexity of threats is beyond the capacity for individuals to thwart effectively. Thus, an entire industry has spawned, devoted to providing IT departments with comprehensive solutions—usually embodied as standalone hardware appliances—for defending email systems. Although these filtering appliances are simple to deploy and manage, for SMEs grappling with limited IT staff, any extra box means extra headaches. For them, outsourcing email security to one of the growing number of service providers is a quick, no fuss way of protecting internal email systems.

Services Overview

Email security is one of the most easily implemented outsourcing services because it doesn’t require onsite equipment or external access to private servers and networks. Setup involves changing a domain’s DNS MX (mail exchange) record to point to the service provider’s mail gateway, so all mail is first routed through their systems. The vendor’s gateway is usually a virtual address load balanced across multiple enterprise-class filtering appliances, ensuring nearly 100% uptime.

Incoming mail is filtered for viruses, spam, and (optionally) inappropriate content prior to being forwarded to your corporate gateway. Blocked content is quarantined, allowing manual review by either administrators or individual users, for false positives. Because the filtering is entirely external to corporate networks, it does not interfere with any other security devices or services, such as an internal firewall or intrusion detection services, a company may have in place.

According to research by the Yankee Group, a potentially important differentiator among various hosted services is whether they provide outbound message cleansing and policy compliance—restrictions for appropriate usage, protection of sensitive data, reporting/logging, etc.—because egress controls aren’t a standard feature of all providers.

Managed Services Advantages

The obvious advantage of using an email security service is the convenience of someone else managing the processes and infrastructure associated with message filtering and delivery. However, one of the hidden, yet significant benefits of using a hosted service is the elimination of all network traffic associated with spam, says David Troup, CEO and founder of MailFoundry (www.mailfoundry.com). He’s found that most of MailFoundry’s hosted customers don’t want any potentially threatening email traffic clogging their internal networks, noting that with the growing use of image spam, unwanted email traffic can significantly tax SMEs with congested Internet connections. According to Commtouch (www.commtouch.com), image spam averages 18KB per message, roughly three times the size of traditional spam, and spikes in image spam traffic can increase bandwidth and email storage usage up to 70% over background levels.

Joel Smith, CTO of AppRiver (www.appriver.com), notes that another hidden advantage of outsourcing email security is offloading the connection management involved with running an email gateway. Given the increasing use of so-called zombie networks of compromised client PCs to distribute spam, distinguishing between legitimate relay networks and spam-spewing zombies is complicated and time-consuming. According to Smith, about 10% of AppRiver’s customers now use its service primarily to ensure that valid mail gets through and to avoid DoS attacks by letting AppRiver manage its email connections and discriminate between legitimate senders and compromised networks.

Outsourcing can also be quite cost effective for an SME. The cost of antispam appliances varies widely, with MailFoundry having some of the most aggressive pricing. Of course, even an appliance with automatic updates requires a level of in-house support, so factoring in personnel costs, hosting services may be less expensive and are particularly attractive to businesses with limited IT resources. According to Troup, given the modest cost of either solution—hosted or appliance—the choice is “not so much price-driven as by your IT philosophy.”

Another potential advantage of outsourcing is the ability to scale investment to precise usage requirements without overbuying equipment. A service provider can rapidly adjust to changing user populations whereas an in-house solution often entails buying more equipment than initially required.

Potential Disadvantages

Other than cost, one reason some businesses resist using an email service provider is the loss of local control over critical infrastructure. As Troup mentions, this often is a function of a company’s IT philosophy.

Another potential disadvantage is delivery reliability, as a service provider interjects another "hop" in the email chain, potentially adversely affecting delivery reliability. Service providers mitigate this by using fully redundant infrastructure. The service's email gateway, through which all customer mail is routed, is typically a virtual IP address that is network load balanced across two (or more) data centers. Furthermore, the filtering hardware used in each data center is itself redundant, thus, according to AppRiver’s Smith, network reliability is essentially 100%.

Security may also be viewed as a potential disadvantage. Because email is an inherently insecure transport (anyone with access to the network backbone can sniff on your email traffic), having an additional layer through which mail passes isn’t seen as much of a risk by customers. While a filtering service could theoretically snoop on a company’s mail traffic, so could its ISP. According to Troup, MailFoundry has had no real customer concerns about security, and its customers “trust them to do their email.”

In some cases, an email service provider can make email traffic more secure. According to AppRiver’s Smith, its service supports secure connections using TLS (kind of like SSL for email) between the customer’s gateway and their’s and that they can also broker secure connections to other service providers or company. Thus, a customer using its service could set up a completely encrypted email path between its site and a business partner’s site, all brokered and managed by the service provider. Such an encrypted tunnel would be more difficult to set up on one’s own and possibly beyond the capabilities of most SMEs.

Beyond Security: Fully Managed Email

According to Smith, the next stage in the evolution of email services is hosting a company’s entire infrastructure. In light of its dominance as a corporate email platform, many service providers, including AppRiver, offer hosted Microsoft Exchange services that eliminate the need for any internal hardware and software licensing. AppRiver’s solution also includes its virus and spam filtering, providing a complete email solution.

Managed email security is a convenient and cost-effective solution for control of email-borne malware and spam. Other benefits include eliminating unwanted mail traffic from internal networks and obviating the need for IT personnel to manage another security appliance. Hosted services are available from a wide variety of vendors, including traditional IT services companies, specialty email service providers, and spam-control appliance vendors expanding into the managed service business. SMEs looking for an email security solution that can be rapidly implemented with no startup costs should find hosted services to suit their needs.

Article on Processor.com »