Do I Want Gwava or Guiveviere or Something Else? 1

[rhpen]

Netware 5.1 | GW 6.5.5 | one domain | one server

I'm looking for opinions on what to use for anti-spam on our GW system. My main concern is blocking spam and preventing dictionary-type attacks from flooding our GW server to a standstill which prevents real e-mail from getting through. Currently, I'm just using a bunch of free real-time blocklists on the GWIA. These do a pretty good job usually, but can have their own set of problems at times. My company wants to look at other options that are available such as the GWAVAs, etc. Question is which one to get. I have no experience with them. Do I need GWAVA or GUINEVIERE or both? What's the difference? Or do I want neither and want something like GeeWhiz or GWGuardian? Or do I want one of the free systems such as mailscanner or spam assassin? I'm looking for advice.

Thanks

 

[marvhuffaker]

You should probably talk to GWava themselves about this just to make sure you get the correct story. I can connect you with someone if you want.

Here's an overview:
Gwava - works at the MTA level. It's a little confusing becuase messages still hit your mail server, come through the GWIA, and then go to the MTA. So you're still going to get dictionary attacks. When Gwava processes the messages, it will block based on RBL, SURBL, etc. But every single message will hit your GWIA and require processing by your system. So this can

Guinevier - runs from a workstation and monitors the incoming files as they come through the GWIA. It's more of a GWIA based solution, and although a good idea I don't like the implementation. I don't think you need Gwava AND Guinevier.


Gwava has released Gwava v4 (for linux only, Netware version coming soon) that is supposed to work at the GWIA level.

I personally prefer to have a separate box that processes spam prior to hitting my groupwise server. This keeps the load down on the server. I like GWGuardian from Messaging Architects.. they have a specific capability of identifying those types of repeat attacks and cutting it off.. Gwava won't do that. The downside is that it does require a separate box, Windows. Gwava runs on the NetWare server itself.




Marvin Huffaker, MCNE

http://www.redjuju.com

 

[marvhuffaker]

I just found out some additional information about Guinevierre.. I was talking with my Gwava folks and they said that Guinevierre is at end of life and is no longer going to be developed. So I wouldn't even consider buying it at this point.

 

[sstoppel]

After trying an antispam device at my perimeter I am coming to believe that service-based antispam is the way to go. It is about the same price, but you get spooling if your mail server goes down and many have portal access to the email as a disaster recovery service.

I have evaluated several. I am probably going to choose between Mailwise and MessageLabs.

 

[rhpen]

Sstoppel,

Would there be any concern with using a service as far as them being able to look all of your company's e-mail; some of which could contain sensitive information?

Thanks,

 

[sstoppel]

Well, e-mail is generally insecure by default. If you don't encrypt the message with PGP or something similar, it is simple plain text travelling over many hops on it's way to you. You could probably negotiate some kind of non-disclosure if they don't automatically include it.

Since it is the service's job to "read" the mail (for spam and virus control), even using automated heuristics, I guess there could be some concern.

As an IT manager I would be much more concerned with users sending sensitive info via e-mail at all. Anything classified, protected by privelege, or covered by HIPAA or SARBOX should be sent via another method.