In our company we use a hosting provider for e-mails and it seems they don\'t sc

Question

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus infections from time to time. (TorrentLocker and Cryptolocker nowadays)

I would like to do virus scan at network level, and I expect this appliance/system to stop infected incoming e-mails which are stored/managed in our hosting providers servers before they can reach our employee computers.

How can I scan hosted incoming POP3 or IMAP e-mail for viruses? Can I use UTM/proxy appliance or software for this purpose (Sophos UTM Essential, Endian etc. there are several free ones for business use)?

Does anyone use such system?

Explanation / Answer

Scanning POP3 traffic for viruses is mostly easy, because the mails are transmitted in full. There are free solutions which can traffic (provided that you have a virus scanner which is mostly not free) and most better (deep inspection) firewalls are able to do this.

IMAP instead is much harder, because mail clients often don't get the full mail at once but only the parts they need at the moment. Typical examples are Thunderbird which gets big attachments in parts and Apple Mail which gets first the mail structure and then each part separately. If you only do passive network analysis (like most firewalls do) you are missing context like the content-transfer-encoding which is important for scanning the attachments.

Therefore lots of firewalls either don't support IMAP at all (like Sophos UTM), have documented limits which point to serious implications in real usage once you understand them (see "Understanding IMAP Antivirus Scanning Limitations" for Juniper Firewalls) or claim to have support for IMAP but probably don't know what they are talking about (or are silent about the limits). Secure inline IMAP scanning instead needs application level gateways (ALG) which not only inspect traffic but can manipulate it so that they have enough context. The passive deep inspection you have in most NGFW (Next Generation Firewall) or UTM (Unified Threat Management) might be sufficient for demonstrations but not for real life.

Some firewalls don't offer inline IMAP scanning but instead mirror the IMAP accounts, scan new mails and provide the mails with an IMAP server at the firewall itself. In this case the credentials of the original IMAP account need to be stored at the firewall and the user gets different credentials to access the firewalls IMAP server.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.