Cisco Email Security Concerns

[jinakolis]

Hello, we're looking to enhance our email security. Management is suggesting we look into Cisco CES since we're run basically everything else Cisco here (except NetApp). We desperately need some sort of next generation threat detection that can sandbox and detect dynamic content. I've used Proofpoint in the past, but figure I should check out Cisco since that's coming from above my head.

In my own research I've read up on AMP, but it doesn't seem like it's nothing more than a reputation service and I don't like there're limits to how many messages are uploaded to ThreatGrid. Similarly, it seems like the URL protection is weak at best. Fundamentally, it seems strange URL protect is enforced only when the TOC determines the URL seems strange. The permutations and swift changing of URL based threats is something we struggle with all the time.

We have a scheduled meeting with an SME next week, but I'd figure I'd reach out to the community in hopes of finding answers to my questions.

[Ken Stieers]

Regarding upload limits, what is your mail flow like?

We get about 5k messages a day and upload less than 100 a day. The ESA does a pretty good job of only uploading files with executable content.

[marc.luescherFRE]

Look at AMP like this :

ESA does a very good job with pre-classification of active content, you only want active content to be sandboxed, non active content does not make sense.

URL protection works the same it does for Proofpoint its a reputation based service at ingest, with a proxy extension at execution.

Cisco is currently reworking the way the handle URL's, will be interesting to see how that impacts future Releases.

-Marc

[MuZeeshan28731]

Cisco CES is good solution but heavy to manage. A lot of time required to find gaps and improve polices.  It protect well if you have Intelligent Multi-scan and advance phishing protection licenses enabled on top of basic inbound bundle. If company size is more than 3500 inbox i think then you need 500 files sandbox per day licenses. And when you calculate all above licenses, CES is going to be expensive than Mimecast.