Securing Exchange With the
Next-generation Architecture.
This paper describes how, with the right architecture, email security solutions can be used to secure Microsoft Exchange and other groupware, while enabling them to work more efficiently and reliably. The end result: a greater ROI on the messaging network.Groupware solutions, including Microsoft Exchange, Lotus Domino, Novell GroupWise, and others, are well suited for internal collaboration. They allow employees to pool
resources on projects, improve teamwork and enhance knowledge management. Groupware solutions are highly utilized, from queuing and storing inbound, outbound and internal messaging, to providing calendaring and other collaboration functions, groupware servers are a mission critical resource in the enterprise and are in demand 24/7. But for all their benefits, groupware applications were designed prior to the explosion in Internet email and without anticipation of outside threats, not to mention rapidly evolving regulatory requirements. Relying solely on the security capabilities of groupware to protect the email network can seriously compromise security and significantly increase the server load, limiting the number of users each can support.
SECURING AND OPTIMIZING MICROSOFT EXCHANGE:
Leveraging “Defense in Depth” to Protect Your Groupware Platform.
INTRODUCTION
In a recent survey conducted by Osterman Research, Messaging Security and Market Trends, 2005–2008, over 60 percent of respondentsidentified growth in email storage requirements and spam as the two “very serious” problems currently facing their enterprises.
Escalating volumes of spam and viruses, along with evolving threats like spyware and phising, pose serious challenges to the security and stability of groupware networks. This barrage—spam, viruses, Denial of Service (DoS), dictionary-style attacks, and address harvesting—directed specifically at groupware networks, places the email network, employee lists, customer relationship data, directories and other corporate knowledge all at risk. To keep highly utilized groupware environments operating at maximum efficiency, administrators typically deploy additional servers dedicated to security processing, management, storage and quarantine. Investing in and administering these additional servers make this a prohibitive strategy given the certain growth in email volumes.
Spam, viruses and other attacks are only one facet of the problem. As a result of corporate restructuring and mergers and acquisitions, multiple groupware, email and directory solutions are another source of groupware complexity. Effectively administering and securing the flow of mail in complex and often heterogeneous environments is taxing on IT resources and leads to less than desired quality of service.
Exchange and other groupware solutions also require a significant IT investment. These costs include licensing, user and administrative support, and processing and storage capacity. In all, IT departments are under constant pressure to keep groupware functioning seamlessly, while keeping expenditures under control.
A secure email architecture aims to protect groupware from constantly evolving threats transported by email, and to prevent the constant escalation of costs. To optimize the message processing network, some large enterprises use an approach known as “Defense in Depth.” This multi-layered approach uses gateway components deployed in the DMZ to protect the enterprise email network from connection-level attacks and most invalid traffic. The next layer of components deployed in the secure network manages policies and provides end-user services to further reduce unwanted traffic and manage internal email between groupware servers and/or domains.
This architectural approach to email security takes into account the need for specific capabilities, as well as the security risks associated with those capabilities.
For example: components dealing with connections from/to email hosts belong at the edge of the network in the DMZ, but they cannot include any sensitive user data that can be compromised or serve as an attack vector. Components managing sensitive data (e.g., directories, internal policies) or requiring end-user access (e.g., quarantine) should be deployed on a protected internal corporate network rather than exposed to the penetration risks inherent in the DMZ.
Following are the key requirements for securing groupware and increasing its ROI. Starting with email gateway defense, they work in concert to reduce unwanted messages from the gateway to the mailbox. In total they provide “Defense in Depth” and secure and optimize the complete messaging infrastructure. The result is a greater ROI on the installed groupware platform.
• High performance, high availability mail transfer
agent (MTA)• Connection control for detecting and regulating
unwanted or suspect SMTP connections• Flexible options for anti-spam and anti-virus
filtering• Policy enforcement for corporate and regulatory
compliance• End-user quarantine facility with personal
delivery filters (e.g., allow- and block-lists)• Directory information integrated into the email
network at multiple points (e.g., connection control, routing, policy, etc.)
•
Unified management and reporting of the message processing network•
Clustering capabilities for load balancing and failover to enhance reliability•
Integration with backend groupware solutionsLeveraging “Defense in Depth” to Protect Your Groupware Platform.
SYNOPSIS
This paper discusses the problems associated with groupware security and stability, and describes an email security architecture that ensures a reliable and secure email network. It outlines the optimal approach based on the “Defense in Depth” strategy, a practical application of best practices from Sendmail’s extensive experience at Fortune 100 enterprises. Applying this strategy to email protection provides a comprehensive set of capabilities deployed in layers at each security zone. It assures that capabilities such as perimeter defense, AS/AV filtering, content policy enforcement, quarantining, internal email management, and optimal routing work in concert to virtually eliminate unwanted mail and provide the enterprise with a cost-effective solution to securely defend and optimize their Exchange or other groupware environment.
Enabling “Defense in Depth.”
To deliver the best possible security and performance for email and groupware networks leading enterprises are adopting a “Defense in Depth” strategy—architectural techniques for providing end-to-end email security from the gateway to the mailbox. “Defense in Depth” utilizes multiple techniques for defense at the gateway:
•
Connection control to identify, redirect and prevent DoS and DHA attacks•
Directory validation against a secure, highly optimized, read-only directory replica for connection regulation• Routing controls to withstand spikes in
incoming connections• Clustering to reliably queue email if/when
groupware servers are offline for maintenance or other reasons• Scanning engines to capture and quarantine
spam and viruses• Policy enforcement for inbound and outbound
messaging for corporate governance and regulatory complianceBehind the DMZ and within the secure portion of the corporate network, “Defense in Depth” uses these additional techniques:
•
Directory validation for optimized routing and policy capabilities using a centralized, messaging-only directory• Quarantine in an end-user accessible facility
•
Additional scanning for spam and virus detection• Automated directory synchronization with
a broad range of corporate LDAP and non-LDAP data sources
•
Policy enforcement for granular control over internal corporate and regulatory compliance initiativesWith a “Defense in Depth” strategy in place, the following product capabilities work seamlessly together to shape the optimal email security solution for groupware optimization.
A Robust Mail Transfer Agent (MTA).
The MTA is the foundation of Internet email—a routing infrastructure specifically designed to deliver security, reliability and scalability. Enterprises with high message volumes run the risk of security issues, performance degradations, and lower availability in their email and groupware networks by deploying unproven and proprietary MTAs. These MTAs were designed to handle cleaner, internally-generated and routed email, which can be easily-overloaded by a variety of Internet-based attacks, malformed email, or email addressed to invalid or non-existent recipients.Leveraging “Defense in Depth” to Protect Your Groupware Platform.
Groupware Servers Are Vulnerable to Overload Attacks.
Each groupware server performs multiple queries to resolve addresses, deliver or bounce messages. Typically, the Exchange server communicates with a local directory or centralized directory server performing DNS queries to process a message. Often in these environments, the catalog server and DNS server are on the same machine, which means that each invalid message requires additional processing on a server that may also be handling other types of user requests.
In Exchange, for example, as the volume of mail being delivered to the groupware servers increases, queries processed by the catalog servers also increases. As a result, if for any reason the groupware server sees the catalog server as busy or unavailable, the groupware server takes its mailbox stores offline—preventing users from accessing their email. Today, faced with dramatically increasing email volumes, many organizations have responded by deploying multiple groupware servers and catalog servers to ensure good performance and high availability. Because of the certain growth in email this strategy is unsustainable, especially in light of limited IT budget and administrative resources.
Standards-based MTAs provide enterprises more flexibility because they are tried and tested and deliver more security expertise through the collective knowledge of peer reviews and the support of user communities.
In addition, the MTA must provide extensibility to accommodate a wide range of security plug-ins such as anti-spam and anti-virus solutions, policy management and gateway defense solutions. For example: A popular MTA extension mechanism used by numerous commercial and open source solutions is the industry standard Mail Filter (milter) API first developed in the Sendmail MTA. This capability arms the enterprise with the flexibility to select from a broad range of anti-spam and anti-virus solutions, integrate best-of-breed compliance and encryption engines, and be well positioned to adopt new innovative approaches to emerging email threats and other needs. The MTA must be capable of managing enterprise-level volume—including withstanding spikes in connections due to normal traffic variations and DoS attacks—and know how to optimally route mail to the appropriate mailstore. The MTA must support high-availability clustering and configurations that re-route messages through alternate paths when necessary. For example: in the event of a network failure at the primary MTA, an alternate MTA should intelligently accept and queue messages for delivery until the primary mail environment becomes available or the redundant environment is ready for routing.
In large enterprise environments, routing between various groupware networks inevitably becomes more complex as the network grows in number of domains, users, locations and administrators. Mergers and acquisitions often add disparate networks and applications, further increasing this complexity. Enterprises often deploy a dedicated MTA to manage this complexity, optimizing network utilization, reducing message hops and delivery times, and making it easy to administer.
To augment the MTA, and eliminate hardcoding of frequently changing configurations, optimal email environments incorporate directory-based routing, which enables more efficient routing decisions and is easier to maintain and update. For example: using
directory information to route messages to the proper mailhub or mailstore the first time, every time; or accessing an alias list stored in the directory to avoid bouncing a message.
Connection Control for Monitoring
and Regulating the Connection.
Connection control means actively monitoringconnections to the mail gateway server at the SMTP level. With connection control, the server looks for irregularities or attacks, and makes a decision about accepting or rejecting a new external connection. When a malicious connection is detected—such as a denial-of-service, spam or directory attack—the connection is dropped, throttled back to a slower rate, or permanently blocked. This prevents unwanted messages from ever reaching the server, eliminating the need for CPU-intensive content scanning, directory queries, generation and queuing of a bounce message, etc.
Leveraging “Defense in Depth” to Protect Your Groupware Platform.
In this example, 10,000 connections represent 100,000 messages intent on reaching the mailstore. Without connection control security in front of the groupware environment there is no buffer to protect Microsoft Exchange and Active Directory from unwanted messages.
Internet
100,000 inbound messages representing 10,000 connections
Exchange SMTP BridgeHead 2 Exchange SMTP
BridgeHead 1
Exchange User Mailbox Stores
After AD verification messages are mailed
to user mailbox
100,000 address lookups
Active Directory Environment Without Connection Control
The standard attack profile for spammers is a mass-mail delivery, without message queuing. By rejecting connections with this profile, the number of messages entering the email network is dramatically reduced, typically by over 50%. By monitoring all the traffic connecting to an MTA and throttling back as needed, effective connection control protects the email network and groupware applications from spam, viruses, and denial-of-service attacks. Because nearly all malicious connections are rejected, resource usage is increased on the spammer’s system (queuing) instead of the corporate groupware environment. In most cases, spam servers are configured to “give up” on a receiving MTA if the connection is slow or repeatedly dropped, and move on to a different target.
With secure directory integration, connection control is further augmented by tapping into up-to-date directory data to reject invalid addresses, regardless of the connection profile. A connection generating messages that rapidly exceed a threshold of undeliverable addresses is likely being used for a dictionary-style attack or directory harvesting. Detecting and dropping such connections during the early stages of an attack (based on a configurable threshold) provides significant protection of sensitive address information and eliminates the load it would generate if allowed to reach the groupware servers. By terminating or throttling back incoming connections and rejecting messages with invalid addresses, effective connection control reduces the volume of messages entering the AS/AV/Content/Policy filtering and
groupware environment, significantly reducing resource usage. Checking for invalid addresses at the network perimeter also eliminates outbound bounce messages from the groupware server. The result is a massive reduction in network overhead, filtering servers, and number of backend mailstores.
Flexible Options for Anti-spam
and Anti-virus Filtering.
The optimal solution requires virus scanning at several points in the network: at the gateway, at each mailstore, and on the desktop. In addition, some enterprises elect to deploy different virus-scanning strategies (e.g., signature-based and distribution-signature-based) to minimize the possibility of an outbreak prior to a release of a new virus signature for signature-based vendor solutions (so called zero-day anti-virus defense).
Scanning for viruses at the gateway lessens the volume of virus-laden messages that could affect end-user desktops and the mailserver. Mailstore scanning on inter-user traffic, either on the same server or multiple mailservers, provides another tier to cleanse the environment from potential threats. For the end user, scanning at the desktop for malware using delivery channels outside the control of the email environment is also critical.
Enterprises should look for an anti-spam engine that receives both periodic and micro-updates to deal with the real-time flow and patterns of spam on the Internet. In addition, it should include flexible policy enforcement to augment the functionality of the anti-spam engine. This gives the administrator the ability to block, delete and redirect specific messages based on patterns detected in their subject and/or message body. With the right combination of connection control, anti-spam and anti-virus solutions at the gateway, most unwanted messages can be turned away before they are committed to resource-intensive Exchange processing and storage.
Security, Policy Enforcement
and Compliance.
Another critical value-add to groupware security is message content filtering and policy management. These give the administrator additional control over inbound/outbound and internal message flow, down to the individual message, sender, or recipient, as well as such criteria as user’s group, role, or security classification, etc. Powerful policy management capabilities are required to comply with increasingly stringent regulatory requirements as well as corporate governance issues such as leakages of confidential data and inappropriate messages violating HR policies. Key policy requirements include:
• Directory-enabled policy control for user- or
group-specific policies—e.g., appropriate use policies for customer service•
Scanning for inadvertent or malicious disclosure of non-public information (financial reporting, trade secrets, customer data, proprietary code, etc.)•
Selective encryption for regulatory compliance—e.g., encryption of protected health information to comply with HIPAA
• Selective quarantine for virus and spam
protection or supervisory review•
Selective archiving for regulatory compliance—e.g., broker messages in financial services institutions; messages with SSNs or account numbers• Message modifications based on policies (header,
envelope and body)•
Attachment stripping based on content, size, type or virus status•
Add/Delete of recipients (To, CC, BCC)•
Addition of disclaimers to outgoing messages• Cascading policies or applying policy based on
prior policy results
•
Applying different policies to different recipients for the same message (envelope splitting)The optimal message processing environment should include a flexible policy management system that is able to execute policies created for global message control and specific per-message content control. Some policies need to be enforced at the gateway for inbound and outbound messages (sometimes using dedicated gateways for each flow), while other policies apply to internal messages as well external.
The “Defense in Depth” strategy recognizes this need and leverages policy engines at the gateway and a standalone policy engine on the internal network. This also enables deployment of separate AS/AV solutions in a cascading fashion–less granular, high performance engine at the gateway to eliminate clearly bad messages, followed by more discriminating and higher processing cost engine on the internal network handling fewer messages.
Role-based, End-user Controls.
Connection control, anti-spam and anti-virus engines, and policy management can’t deflect all bad mail. Regardless of the quantity, once unwanted mail reaches the groupware server, it impacts system efficiency and user productivity. That’s why role-based, individual user controls—such as per-user allow, block-lists and quarantine access—are another essential component for securing and optimizing groupware environments. By implementing user controls, administrators gain the ability to offload user support for basic functions, (e.g., managing spam filtering beyond the default threshold; removing false positive spam from quarantine) while maintaining appropriate control over security. This self-help capability has the additional benefit of user satisfaction, as end users can quickly and easily resolve issues.Leveraging “Defense in Depth” to Protect Your Groupware Platform.
Directory-driven Email Security.
Directory-driven email security is a key element of the “Defense in Depth” strategy. Utilized throughout the entire email network, directory information is accessed to optimize capabilities such as: connection control, email policy, applying AS/AV and content filtering and message routing. For example: taking user information from an Active Directory source and mapping the mailserver information stored there to industry-standard DNS names for email delivery.By utilizing a high performance LDAP messaging-only directory server, enterprises can leverage up-to-date directory data to optimize the key component parts of the messaging infrastructure. The result is a more secure network and less processing/storage/disk space used due to fewer unwanted messages and more precise routing between mailstores. Key requirements for using directories as part of email security include:
•
A centralized, secure messaging-only directory optimized for message processing•
Automated synchronization capability from multiple LDAP and non-LDAP data sources•
A secure, read-only, DMZ directory replica that is updated from the centralized directory and protected from DMZ attacksUnified Management and Reporting
of the Entire System.
Enterprises that deploy multiple point products in order to secure email and groupware networks end up with multiple islands of administration to manage these environments. The result is complex security management in an environment that is error-prone and potentially susceptible to failure.
The optimal solution provides administrators with centralized control over point products and key security components. Functionality should include overseeing mail queues, aggregating traffic reports, automating email traffic alert notifications, monitoring specific health attributes and providing statistical reports for each SMTP router.
Failover Protection to Enhance
the Reliability of Groupware.
Many groupware systems, such as Microsoft Exchange and Lotus Notes, are preconfigured to bounce mail if they do not receive an immediate confirmation after recipient mailserver failures. Rather than queue such messages on the groupware email server and load it with delivery re-tries, the optimal solution must possess the capability to queue and store messages in a separate MTA for delivery until the mail environment becomes available or the redundant environment is ready for routing.
This architecture can include optional onsite and offsite failover MTA servers. In case of an internal or external failure, an alternate MTA can accept and queue email for delivery so that the system does not lose any messages. When the regular email system resumes operation, recipients receive mail from the queue. With the right solution in place, during an outage, customers, business partners and even internal users are unlikely to ever see a message bounce.
View the Entire Message Stream.
Unified management and reporting gives administrators a view into all aspects of message flow, filtering and policy application. This view helps administrators anticipate potential issues, and provides complete forensics to quickly track down the root source of problems. It also provides an audit trail for meeting regulatory and/or corporate requirements.
Leveraging “Defense in Depth” to Protect Your Groupware Platform.
Integration with Multiple
Groupware Applications.
Few large enterprises feature a single server or homogenous groupware environment. Corporatemergers, acquisitions and restructurings have complicated groupware, messaging and directory infrastructures. Disparate domains, products, and geographic distribution also present an administrative challenge.
The optimal email security solution features a single, centralized, email-specific messaging directory, and automatically consolidates relevant (user, mailstore routing, group) information from multiple groupware applications, non-standard formats and email systems to create a more efficient and secure network. A centralized, automated messaging directory perfects routing, and informs policy, because it leverages a single, consistent, instance of corporate information.
Sendmail: The Complete
Architecture for Securing and
Optimizing Groupware Networks.
Over half of the Fortune 100, including seven of the top ten, relies on Sendmail to design and implement email security solutions based on the “Defense in Depth” strategy. This expertise is why the largest corporate email networks trust Sendmail to support hundreds of thousands of their end users.Sendmail solutions not only prevent unwanted mail from entering the groupware network—they optimize the entire environment for security, reliability and
performance each step of the way with “Defense in Depth”.
Fewer Messages Equals Fewer Exchange Servers.
In addition to preventing virus-related downtime, blocking attacks and unwanted mail at the gateway enables companies to save money on hardware and storage. With increasing email volumes and over-taxed groupware servers, such as Microsoft Exchange, companies typically need to purchase additional servers to maintain system performance while keeping pace with incoming messages. Sendmail customers typically see a 50% reduction in unwanted messages at the gateway. A company that drops 50% of unwanted messages prior to spam and virus scanning, followed by a further elimination or quarantine of suspected spam is primed to dramatically reduce the email reaching its Exchange (groupware) servers, sometimes by 75-0%, resulting in a parallel reduction in the number of servers or increase in the number of users that can be supported by each server. Often this means savings in the range of hundreds of thousands of dollars per year. The larger the enterprise, the greater the savings will be.
Leveraging “Defense in Depth” to Protect Your Groupware Platform.
With Sendmail, enterprise groupware environments gain:
• Connection regulation and management
o Reduces invalid/unwanted connections by 50 percent
o Validates address queries more efficiently and accurately by leveraging directories
o Eliminates unnecessary queuing and generation of bounce messages
•
Dependable, accurate, and optimized routingo Enhances regulation of mailflow and mailserver traffic
o Improves routing accuracy through directory integration
o Provides dependable network redundancy and failover protection
o Provides selective recipient/channel encryption
•
Flexible approaches to protect against spam and viruseso Captures percent of spam and virus traffic with multiple AS & AV engines
o Filters and scans at the mailstore and gateway levels o Extends AS/AV filtering with additional cascading
policies
o Provides end-user quarantine facility and personal delivery filters
• Policy enforcement for corporate and regulatory
complianceo Establishes role-based policy with directory integration
o Enables policies to support specific regulatory requirements (SOX, HIPAA, GLBA, Reg FD, SEC Rule 17a-4)
o Comprehensive policies for inbound, outbound and internal mail
o Integrates with third-party content encryption solutions
Sendmail provides a complete solution for securing Exchange or any other groupware network. It supports all Internet-based mail protocols, including SMTP, POP and IMAP. It interacts with directories such as Microsoft Active Directory, Lotus Domino, Novell eDirectory, Netscape iPlanet/ Sun One/Fedora Directory Server, Open LDAP, and any other standards-compliant LDAP v directory server. In addition, Sendmail runs on most of the major operating platforms.
Appliance or Software to Meet
Any Enterprise Requirement.
Sendmail Sentrion is an email gateway security appliance that packages Sendmail’s award-winning software into an easy-to-deploy, integrated, and secure solution to defend the perimeter of the email network.
100,000 inbound messages representing 10,000 connections Sendmail Sentrion email gateway security appliance eliminates half of all messages and connections.
Exchange User Mailbox Stores Quarantine
Delivery of valid email to user mailbox
Exchange SMTP BridgeHead 2 Exchange SMTP
BridgeHead 1
Sendmail Sentrion: Protecting Groupware
Active Directory Environment
High Speed Queries
Internet
Receiving 15,000 messages
Periodic Directory Synchronization Sentrion AS/AV filters
and policy send 35,000 to quarantine
The Sendmail Sentrion email gateway security appliance uses advanced connection controls to reject up to 50% of unwanted mail, based on invalid addresses and suspicious connection patterns. Powerful spam and virus scanning provide additional protection, virtually eliminating all unwanted messages.
As the highest performing email gateway appliance,
Sentrion provides a robust and scalable foundation for “Defense in Depth”. Sentrion features centralized management of comprehensive security policies by combining functionality of three proven Sendmail software components with a unified management and monitoring interface:
•
Powerful connection control delivered by Sendmail Flow Control•
High performance and secure routing delivered by the Sendmail MTA•
Comprehensive policy enforcement delivered by Sendmail Mailstream Manager, with multiple anti-spam and anti-virus optionsAs with all Sendmail products, Sentrion leverages directory-driven email security, providing comprehensive integration with Active Directory and other corporate directories. With all of this functionality and performance packed into a hardened system, the Sentrion appliance is designed to easily secure and optimize groupware networks of any size. “Defense in Depth” starts with email gateway defense; the Sentrion appliance fulfills this requirement.
For enterprises whose perimeter defense requirements extend beyond a gateway appliance, Sendmail offers a complete array of enterprise email security software solutions designed to secure the perimeter of the email network. These products include:
Robust & Scalable Message Routing: Sendmail
Switch™ MTA
The Sendmail Switch mail transfer agent is the high-performance MTA designed to optimize and protect the flow of email moving in/out of the enterprise. In addition to regulating flow, Switch provides failover protection. In the event of a network connection failure, it will intelligently accept and queue messages until the environment becomes available or the redundant network path is ready.
Sendmail Switch integrates with Sendmail Directory Services to add additional intelligence to routing and policy enforcement.
The Sendmail email security architecture enables Defense in Depth. This multi-layered approach includes gateway components deployed to defend the perimeter of the email network, and additional policy, directory, and quarantine components within the secured portion of the network. With Defense in Depth, the message processing network provides optimal security and infrastructure capabilities for each security zone.
Address Validation
Outlook Notes
Sendmail
Webmail
Sendmail
Wireless Exchange
Domino Novell
Sendmail
Encryption Server
INTERNET
BOUNDARY CONTROL CONTENT & POLICY CONTROL USERS
Sendmail Messaging Directory Replicas
Sendmail Messaging Directory Master
Quarantining
MESSAGE STORE(S)
CORPORATE DATA SOURCES EMAIL CLIENT(S)
Anti-V
Firewall Firewall
irus Anti-Spam CONNECTION
CONTROL
Sendmail Flow Control
GATEWAY PROTECTION
Sendmail Mailstream Manager and Sentrion Appliance
Anti-Virus ROUTING
Sendmail Switch (MTA)
ROUTING
Sendmail Switch (MTA)
DIRECTORIES: Active Directory, Domino, OpenLDAP, SunOne, Novell RELATIONAL DATABASE(S): Oracle, MySQL, MS-SQL Server
FLAT FILES
DirSync
SENDMAIL DIRECTORY SERVICES
INTERNAL POLICY & MAIL MANAGEMENT
Sendmail Mailstream Manager
DMZ
Connection Control: Sendmail Flow Control™
Sendmail Flow Control regulates the flow of all inbound and outbound connections at the SMTP level. With Flow Control’s powerful defense against DoS and DHA attacks, enterprises typically experience a reduction in connections of over 50 percent. The resulting benefits for groupware environments are a dramatic decrease in mailstore traffic (unwanted mail) and reduced directory queries.
Policy-based Gateway Security: Sendmail
Mailstream Manager™
Sendmail’s award-winning Mailstream Manager features a fully-integrated email policy management solution that combines anti-spam, anti-virus, text and attachment scanning with rich inbound and outbound policy enforcement functionality and centralized management.
Mailstream Manager’s flexible directory query mechanism infuses policy with the power of corporate information.
Mailstream Manager works hand-in-hand with the
Switch MTA and Flow Control to deliver a resilient and dependable security strategy for the gateway.
Beyond perimeter security provided by Sendmail Sentrion
or software solutions, enterprises can deploy an internal routing MTA using Sendmail Switch that is designed to optimize and protect the flow of messaging moving within the enterprise. This will ensure that messages arrive at the correct mailstore the first time, everytime.
An internal deployment of Mailstream Manager
provides a flexible integration of an additional layer of AS/AV scanning with enforcement of corporate policies and regulatory requirements on internal message flows. It also enables integration of email archiving, recovery, and e-discovery solutions.
The resulting benefits are more complete spam and virus protection, and granular control over internal message routing and processing. To add extra intelligence to these functions Mailstream Manager fully leverages directory data.
In parallel with the MTA and policy manager, enterprises deploy Sendmail Intelligent Quarantine™, which provides a powerful, policy-based, centralized facility for queuing, reviewing, and taking action on quarantined messages.
Intelligent Quarantine is designed to safely quarantine inbound messages from the network perimeter and outbound messages. Deployed with a robust, scalable mailstore, Intelligent Quarantine provides safe, reliable access to quarantine queues within the safe confines of the corporate network, away from the gateway.
Sendmail Directory Services works with all of these products providing the most relevant information to enhance message routing and policy enforcement and to automatically synchronize multiple LDAP and non-LDAP data sources.
Sendmail Directory Services (SDS) is the most widely deployed commercial LDAP directory specifically designed and tuned for the enterprise email infrastructure. SDS centralizes users, alternate email addresses, groups, administrative group information and policy-related information into a secure, centrally managed data repository and provides this information to groupware servers across the enterprise to add additional intelligence to gateway security, routing, policy enforcement, and redundancy.
Sendmail also provides a scalable, standards-based mailstore solution, Sendmail Mailcenter, which can be deployed in parallel with groupware solutions, or implemented when other groupware mailstores are cost-prohibitive.
A Partner You Can Trust.
With proven technology used across the Internet for the past 20 years to deliver over half of all Internet email, and through the experiences gained at over 4,500 enterprise implementations, Sendmail has enabled the largest enterprise networks to secure and optimize email for hundreds of thousands of employees. This expertise
drives our continuing solution refinement and innovation, as well as the best practices provided by our professional services and technical support organizations.
Sendmail provides the industry’s most comprehensive knowledge base for designing, optimizing and protecting any email and groupware network. To learn how
Sendmail can protect and optimize your Exchange or groupware environment please contact us.
Leveraging “Defense in Depth” to Protect Your Groupware Platform.
Sendmail, Inc. 6425 Christie Ave., Emeryville, CA 460 USA| Tel: +1 54 150 or +1 510 54 5400 | Fax: +1 510 54 542 | www.sendmail.com
© 2005 Sendmail, Inc. All rights reserved. Sendmail, the Sendmail logo, Sendmail Directory Services, Sendmail Flow Control, Sendmail Switch, Sendmail Mailstream Manager, Sendmail Intelligent Quarantine, Sendmail Mailcenter and Sendmail Sentrion are trademarks of Sendmail, Inc. Other trademarks, service marks and trade names belong to their respective companies..
