Interview: Christophe Casalegno (Digital Network): “Place the filter upstream of the information system”

Editorial team, Décision Informatique, 24 February 2006 at 07:00

What are the basic techniques for protecting your email system?

There are three: put an effective filter against viruses and other malicious code upstream of the email system, put an antispam filter in the same place, and remember to protect the client workstation, preferably with a different solution from the one used upstream, to add more barriers. Finally, without proper staff awareness, even the best technical solutions may prove ineffective.

Where should those barriers ideally be placed?

The antivirus/antispam filtering system should preferably sit upstream of the information system and filter both incoming and outgoing traffic. This architecture removes viruses, spam and other malicious code before they even reach the information system. Alongside the security benefit, it saves bandwidth and processing time on client workstations.

Source: http://www.01net.com/article/306090.html

The original interview follows:

1) What are the three basic technical measures for protecting your email system?

There are many measures involved in protecting an email system. Forgetting even one can have critical consequences for email and, in some cases, for the entire information system. However, we can identify the following 3 main technical measures:

1) Put effective protection (filtering) against viruses and other malicious code upstream.

2) Put effective protection against spam and other junk mail upstream

3) Do not forget the client workstation in all this. It must also be protected, preferably with a filtering solution different from the one used upstream, to add more barriers.

In every case, technical solutions depend first and foremost on an effective security policy and proper staff awareness (training). Without these, even the best technical solutions may prove ineffective. Do not forget system and network protection for the filtering system itself, either.

2) Where should the email antivirus/antispam filter ideally sit within the company's information system topology?

The antivirus/antispam filtering system should preferably sit upstream of the information system and filter both incoming and outgoing traffic. This architecture removes viruses, spam and other malicious code before they even reach the information system. Alongside the security provided, it saves bandwidth and processing time on client workstations.

3) Why did a security specialist such as Digital Network choose an open source tool?

Open Source offers many advantages that are currently impossible to obtain with commercial tools. In particular, it lets us maintain our own antivirus database, implement our own rules and react quickly to alerts.

The solution we currently use consists of email relay servers running 2 antivirus products (a free-software antivirus, ClamAV, and a commercial antivirus, Kaspersky Antivirus), an antispam filter (SpamAssassin + various extensions) and 2 content filters (MailScanner and Maildrop).

The solution is based on the OpenProtect bundle, which is nothing more or less than an intelligent combination of its components. We add our security expertise (specific rules, a private database, etc…) to protect our clients.

Apart from Kaspersky Antivirus, all the tools used are open source.

4) Is it better to choose a bundle of antivirus, antispyware and other tools, or separate components?

This is a difficult general security question, with supporters and opponents on either side. On the one hand, putting everything in a single bundle means putting all your eggs in one basket. On the other, it lets you keep your "eyes" on that basket at all times.

Personally, I recommend a bundle made up of several independent components, as described above, with additional client-side protection using different software. If the bundle fails, that gives you an extra layer of protection that could save the day.