consider this Ive got the trend suite + IMSS (SMTP gateway product)
Now beside's Martin's list of danger (See FAQ) Ive add a bunch of other stuff. i.e. Ive set it pretty aggressively. here's what I came into this morning: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< <<<<<<<<, ---------- From: System Attendant Sent: Tuesday, August 05, 2003 3:24:52 AM To: Administrator Subject: [MailServer Notification] To Administrator a virus was found and action taken. Auto forwarded by a Rule ScanMail for Microsoft Exchange took action on the message. The message details were: Sender = [EMAIL PROTECTED] Recipient(s) = "Brea;[EMAIL PROTECTED]; Subject = MOTHER PC CHIPS Scanning time = 08/05/2003 03:24:50 Engine/Pattern = 6.510-1002/598 Action taken on message: The message body contained JS_FORTNIGHT virus. ScanMail deleted the message body. Warning to administrator. ScanMail has detected a virus. Who: "Brea;[EMAIL PROTECTED]; Sender: [EMAIL PROTECTED] Date: 08/05/2003 Time: 03:24 AM Type: scheduled scan >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< <<<<<<<<<< Now Ive got to go check me IMSS to why it made it past... But if I had, had NO AV on my exchange box Id be infected....!! In Fact! before I loaded the trend exchange AV, I had another companies AV...and well when I loaded the trend It found a bunch of viruses which where "hang'in around" If I could justify the Antigen AV for exchange..IN A heart beat... In fact Im looking to made change my AV lic and setup to try in squeeze in the Antigen.. Also Note: IF you only use a gateway AV..what happens when I user brings something in from Home...they will dispite company policy. Viruses thru web site's..you get block them all... Once it's inside you'd be screwed... I personally would not run a Exchange server without it..in fact same for any mail server... but then that's me.... It's going to cost you more when something slip's by..it time then the intial capital cost and yearly "service/subscription cost..etc" My 2 cents bill >>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<,, I'm considering going with an outside SPAM/AV company. However, my manager feels that we don't need to put AV on our Exchange server if we do...so I am considering going just with AV/SPAM on our Exchange server and keeping everything in house. I was considering using MX Logic Defense Level 3 and using Antigen on Exchange server. I can't convince him that both would be the way to go...both meaning SPAM/AV outside and AV on Exchange. Now, I am considering just Antigen with the SPAM agent added to it. Anyone got any good points about having both SPAM/AV outside and AV on Exchange that I can bring up to my boss so he can see the added value? His points were...you mean they won't be able to do it as well as we can...then we need to not use them! Thank you, Ron Crumbaker, MCP -----Original Message----- From: Michael Brownell [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 05, 2003 9:41 AM To: Exchange Discussions Subject: RE: AV/Spam scanning services I see the outsourced AV as another layer that gives me greater defense in depth (I have Trend on every platform). Also their use of multiple and different AV scan engines gives me another (admittedly small) edge. I'll take whatever edge I can get, having been hosed by Iluv you and Funlove. One of my concerns about using this type of service is latency. How much longer does it take a message to get through? Are any of the vendors better or worse in this regard? Michael -----Original Message----- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 05, 2003 6:36 AM To: Exchange Discussions Subject: RE: AV/Spam scanning services My point is that you're spending money on an internal AV product for mail (i.e. ScanMail or Antigen) plus the second layer at the gateway - either internal or external. My caution is geared towards those who think that they ONLY need the outsourcer for AV. -------------------------------------------------------------- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. > -----Original Message----- > From: Chris Scharff [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 05, 2003 8:45 AM > To: Exchange Discussions > Subject: Re: AV/Spam scanning services > > > It's not necessarily about saving money though right? Scanning at the > gateway (in-house or outsourced) can be a valid additional level of > protection. A significant number of our customers use some form of > gateway scanner[1] in addition to their server and desktop based AV > solutions. > > [1] MessageLabs, MailSweeper, Trend's Instercan, et al. > > > From: Roger Seielstad <[EMAIL PROTECTED]> > > Reply-To: "Exchange Discussions" <[EMAIL PROTECTED]> > > Date: Tue, 5 Aug 2003 07:10:22 -0400 > > To: "Exchange Discussions" <[EMAIL PROTECTED]> > > Subject: RE: AV/Spam scanning services > > > > There are some discussions of a few of them in the archives. > > > > Personally, I'm not a fan of outsourced anti-spam, but > that's in part > > because we're a heavily email dependent company and so we > can justify the > > expense of in house measures to combat those issues. > > > > As a side note - outsourced antivirus doesn't save money - > you still need to > > have an inhouse AV product for email, because scanning at > the gateway isn't > > enough. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t ext_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
