Cisco secure email gateway thoughts anyone?

Posted by JasonShoes@reddit | sysadmin | View on Reddit | 13 comments

Long story short we had a vendor a few years before I started who added CISCO secure email gateway to our EA we never knew we actually had it until we started negotiating our renewal and it’s never been implemented. We are looking into a secure email gateway service with the main players, Proofpoint, Abnormal, mimecast etc. Has anyone had experience good bad or indifferent with Ciscos offering? Is it even worth setting up as a POC or just drop it from the EA?

Reply to Post

13 Comments

[-]

Ctrl_Alt_Defend@reddit

Honestly, I'd be pretty cautious about Cisco's email security offering at this point. Having worked with various email gateways over the years, Cisco's solution feels like they're trying to check a box rather than actually compete with the specialists. The fact that it was sitting unused in your EA for years and nobody even knew about it kind of tells you something about how much mind share it has in the market. When I was doing CISO work, we evaluated it briefly but it just didn't have the advanced threat detection capabilities that Proofpoint or even newer players were bringing to the table. The interface was clunky and the reporting wasn't great either.

[-]

danieIsreddit@reddit

My last place used Checkpoint (formerly Avanan), and my current place uses Abnormal. Abnormal is great, but I think it's the most expensive. Both Avanan and Checkpoint's email security solutions & POCs take less than 15 minutes to deploy if you're using Office 365 (hybrid/full cloud).

[-]

DeathTropper69@reddit

Avanan (Checkpoint Harmony Email) is fantastic and would be my first choice over everything else. If you get it go through Solutions Granted. Best pricing out of all the channels i’ve seen and it’s the legacy portal so you don’t have to deal with infinities bs.

[-]

RussianBot13@reddit

Another positive recommendation for Checkpoint. It's working well for us. Don't go with Barracuda.

[-]

Kyky_Geek@reddit

I didn't know Cisco even had that. Interesting!

[-]

iSunGod@reddit

We ditched ProofPoint for CheckPoint after doing an Abnormal, CheckPoint, and Mimecast POCs. Didn't bother with Cisco because it did a different POC at a different company & it was straight up trash. Don't waste your time with them there are much better service offerings. That said.. PP pissed me off with their support (or lack there of) & like 10 different portals to manage everything. We had services that they never told us about that they randomly added to our package & after changing sales reps 5 times in a year I had enough. Abnormal was nice. We're a Google shop & at the time of the POC they didn't do any outbound protection. Their "AI" stuff was decent but they missed a lot & that was even with ProofPoint inline. They were also significantly more expensive than ProofPoint & seemed to be more reliant on support implementing changes & teaching their AI. Solid webUI & all their features were on that portal. The breakdown of messages was nice too but as an admin of the tool it seemed a bit unnecessary. CheckPoint has pretty much all the same features as Abnormal but they do outbound, encryption, and DLP. Their Harmony Portal is nice, simple to use, but imho a bit slow at times. You can tell they're geared more towards M365 with some features but it works great for Google. I like that it can scan Mail & Drive for malware, DLP, permissions, etc. The two biggest downfalls that I've come across for CP is that users can't manage their blocklist, only allow, and their quarantine portal isn't seamlessly integrated. Users have to click a Google or Microsoft OAUTH link to get in even though admins can use SSO to authenticate. If you're looking at Abnormal you should 10000% be looking at CheckPoint. They both use APIs to integrate so they can be run together behind ProofPoint. Abnormal needed support/SE to configure & get up/running. CheckPoint was like 7 clicks as a Google Admin to get it up/running in detect mode.

[-]

JasonShoes@reddit (OP)

Thanks for the extensive advice, I worked previously with Proofpoint at a previous job and it was ok but yea all of the portals and modules were obnoxious. I’m definitely leaning towards either Abnormal or Checkpoint.

[-]

iSunGod@reddit

No problem. Also, with Abnormal, they're going to 100% give you smarmy comments about CheckPoint journaling messages. They do journal while in the POC. When you're live, and inline (Prevent mode), CheckPoint does not journal.

[-]

hftfivfdcjyfvu@reddit

Cisco email gateway (iron port) sucks. However their new cloud email defense product that is api works great. If not abnormal is super easy. Proof point and Mimecast are great, have all the bells and whistles but you will pay for it (in price and complexity)

[-]

Current_Anybody8325@reddit

Go Proofpoint or Mimecast. Cisco is great for network hardware, but that's usually where I draw the line with them as there are almost always better options out there.

[-]

bageloid@reddit

If my org wasn't on-prem I would drop it.

[-]

KStieers@reddit

It's worth setting up a POC, especially if you don't have anything in place at the moment. What else is in your EA?

[-]

CaesarOfSalads@reddit

Personally, I'd drop it and look at Proofpoint (Enterprise). Been a happy customer for the last 8 years and about to sign another 3 year agreement. Is it expensive? Yes. Does it work? Absolutely. I have a lot of things to worry about when it comes to keeping our users and organization safe, but email is not one of them that keeps me up at night.