The IronPort Secure E-mail offerings from Cisco consist of both appliances and now service-based product lines that provide for the organization E-mail protection in the form of anti-virus, anti-spam, and policy-based content encryption capabilities. The appliances are offered in multiple form factors, targeting deployment in SMBs through large, Global Enterprises.

At the core of the offerings is the vendor's C Series and X Series IronPort appliances, and at the core of each of these appliances is the vendor's AsyncOS operating system, which also serves as the core O/S for the other IronPort security appliances (including the IronPort S Series appliances, which are focused on the protection of Web-based traffic). The appliances are deployed inline at the network gateway, and provide anti-spam and anti-virus filtering features such that malicious or questionable messages can be blocked prior to entering the customer network.

For anti-spam, the products rely on both IronPort Reputation Filters, which examine the sender metrics of the E-mails and block those messages coming from known malicious senders or with known suspicious behavioral traits; and context-based filters, which examine the actual content of messages and attachments (who sent it, what content, etc.). For anti-virus, the products rely on both Virus Outbreak Filters, which are conceptually similar to the Reputation Filters described above and reject messages based on real-time examination of behavioral traits; as well as 3rd party examination of messages through Sophos and/or McAfee anti-virus scanning.

Both the Reputation Filters and the Virus Outbreak Filters rely on the vendor's SenderBase network, a global E-mail analysis network that the vendor states examines better than a quarter of the world's E-mail volume. The SenderBase network receives and analyzes E-mail activity around the world, noting anomalous behavior and creating rules to recognize and trap newly suspicious threats; rules that are then automatically sent to and updated on the individual IronPort appliances.

Appliance offerings in the IronPort Secure E-mail line range from the 1U, 1 processor, 2 port (GigE) C150 for SMBs; to the 2U, dual multi-core processor, dual power-supply, six drive (RAID 1+0), five port (2 GigE, 1 10/100, 2 Fiber) X1060. Also available from the vendor is the IronPort Encryption Appliance, which provides gateway-located, policy-based encryption to outbound E-mail. The Encryption Appliance encrypts targeted messages and sends them to recipients as an HTML attachment, which the vendor opens directly (locally) in their own browser. The recipient is prompted for a password, and upon authentication success is provided with the encryption key enabling them to view the message. The key repository and authentication server portion of the platform can be hosted by the vendor or run on-site by the customer.

New to the IronPort line is the introduction of service-based E-mail security offerings, where some or all of the E-mail security infrastructure can be hosted/managed by the vendor (note that the E-mail security is hosted by the vendor; not the actual E-mail mailboxes). Three levels of services are now available: A fully managed offering wherein all hardware is located in the vendor's data centers (co-management is allowed; customers have management access to the gear); a "Hybrid" offering where some gear is in the vendor's data centers and some resides on-site (the vendor states that typically the Hybrid approach is deployed such that the vendor handles security on all inbound E-mail, while the customer handles outbound E-mail security concerns); and a service wherein all gear is located on the customer's premise, but with the ability to be remotely managed by Cisco personnel.

The IronPort Secure E-mail product line is available now. Visit the IronPort sub-site of Cisco Systems for further information.