#Secure postbox software

It takes corresponding action pretty quickly. Collectively, it seems to be doing a pretty good job, especially when combined with Threat Grid because it's quickly able to identify files by hashing them and figuring out within the databases that Cisco owns, as well as open source threat intelligence databases, whether that particular hash is found in those databases. We have also used AMP for Network and Email. Its ability to integrate with other Cisco portfolio tools is helpful because then you can tie in and quickly view what malicious files might've been found in your environment regardless of what Cisco security solution you are using, whether it's AMP, Email Security, Cisco Secure Email Cloud Mailbox, or anything else.ĪMP for Endpoints is something that I've used extensively. From that perspective, Threat Grid is definitely a very good solution. I don't have to test it on enterprise systems. Threat Grid also gives us a sense of safety because I don't have to test it or build out custom virtual machines to do the testing.

While there are other sandboxing solutions out there, I use Threat Grid quite a bit and I find it to be extremely useful and very usable.

#Secure postbox software

Likewise, the software that I uploaded for sandboxing is immediately validated and checked against all other client submissions as well as open source and Cisco Talos Threat Intelligence Sources. It also ties in with various threat intelligence sources, e.g., detonating/testing our particular software or file in the sandbox can immediately identify indicators of compromise and share them with other clients that leverage Threat Grid. For that particular use case, Threat Grid works really well. Threat Grid is a capability which allows for running or executing software in a special sandbox environment where it's not affecting your enterprise or corporate systems. There was a quick deployment document that you skim through, and it's fairly easy to both deploy as well as start using. It is an easy to use, single web page, SaaS application.Ĭisco Secure Email Cloud Mailbox’s user interface is intuitive. All that information is easily identifiable and quickly accessible as soon as you log in. Likewise, the search capability is easily accessed and usable as well as provides the first initial information that you need about messages identified, categorized, and total volumes. Then, there are a small number of clicks necessary to get at the information you need. It's just a single pane of glass, single screen web page that you access. Any of the mail gateways really do not have any method or way of seeing this traffic since it's not leaving the environment. Effectively, that email message never leaves the tenant. Someone can then use that internal compromised account to email additional accounts with either malicious software or links, but internal within that Office tenant. That can typically give us visibility into if there's an internal compromised account (for example).

With Cisco Secure Email Cloud Mailbox, it's able to quickly identify, track, tag, and categorize emails that are internal. The ability to see east-west traffic is its most valuable feature. Traditionally, email defense focuses on north-south, inbound-outbound, egress-ingress traffic. Because we haven't had any detections, which is a good thing, we don't really need to dedicate any additional resources in terms of generating an incident response process. We set the solution, then check it daily. Our administrative overhead costs are low, both for time and dedicating human resources. Cisco Secure Email Cloud Mailbox seems to be working well. This speaks to the system's ability to detect these and fairly quickly categorize them as spam, which is good. Even internal email forwarding, where an internal enterprise account will forward a spam message to another internal account.

However, we have seen some spam being detected. This just means that our traditional use cases of egress-ingress type monitoring work pretty well. So far, we haven't had any detections, which is a good thing. Insiders are typically the hardest to detect, including in an email environment. We haven't seen any specific events yet, but certainly having another layer that's able to give us visibility and detect malicious email from an insider is definitely useful. Having Cisco's solution gives us a fast way to track and identify.