North Hertfordshire Homes correctly blocks 93 percent of spam email with Cisco IronPort

(18/09/2009)

North Hertfordshire Homes (NHH) is the largest Registered Social Landlord in Hertfordshire, providing approximately 8,700 homes for rent. NHH employs in excess of 300 staff across a network of offices in the North Hertfordshire region.

In common with many organisations, email plays a critical part in the day-to-day operations of NHH. However, by the spring of 2009 it had become clear that the email content filtering software deployed to separate junk mail from genuine business communications was failing on a number of levels. Firstly, the everyday maintenance was taking far more time than anticipated. As the software didn’t allow for the creation of black lists and white lists by the end user, NHH had to tweak the rules every day, adding words to the filtering dictionaries and revising scores allocated to each word. Also “bins,” for items such as viruses, profanities and bandwidth draining media, had to be manually monitored to ensure that legitimate mail had not been incorrectly quarantined.

“It would take several man hours every single day to go through the logs and ensure that we had no false positives,” recalls Toufik Moumen, Senior IT Engineer with NHH.

In addition to the problem of false positives, the filter was not effective in blocking unwanted or unsolicited traffic. “It couldn’t handle HTML Spam at all, this would escape quarantine and it was also easily fooled by spoofed email”, according to Toufik. The result was a number of complaints about unacceptable content appearing in the user’s inbox who then had to delete between 10 and 20 spam emails every day.

This situation led NHH to look at alternative email content filtering technologies. NHH’s research at a trade show led them to the Cisco IronPort C160 Email Security Appliance.

Cisco IronPort recommended that NHH work with Nebulas Solutions Group to determine the most effective way to deploy and integrate the appliance into the NHH network infrastructure. From the start, NHH was extremely impressed with Nebulas Solutions. “I did some research and liked the fact that Nebulas had a strong track record in local government as well as the commercial sector. I was also impressed by their professional, flexible approach,” comments Toufik. “They struck me as being very serious about their business and really understood the technology and how to implement it effectively.”

Working with Nebulas Solutions, it was agreed that NHH would evaluate a Cisco IronPort C160 Email Security Appliance in parallel with its existing email content filter. This allowed NHH to determine the accuracy level of the Cisco IronPort Reputation Filters™ compared with the existing solution.

The evaluation went live in June 2009 and the contrast between the two email content security solutions was immediately obvious. “On average we get around 20,000 emails entering our network every day”, says Toufik. “Cisco IronPort immediately and correctly blocked just over 93% of them.” After a couple of weeks, it had become evident to the IT team that the new solution was a dramatic improvement over the current spam filter software. The decision was made to deploy a Cisco IronPort solution permanently.

The benefits realised by NHH are already apparent. Perhaps the biggest benefit has been the reduction in man hours required to administer and maintain email content security. “We’ve easily gained 5-10 hours a week,” says Toufik. “That means we can resolve other issues a lot more quickly.”

Because the rule base of the incumbent solution had become so unwieldy, the process of consolidating and migrating those rules to the Cisco IronPort appliance is still in progress. “Because the Cisco IronPort Reputation Filters™ cut spam off at the connection level, when we switch our old software off, we’ll see a massive drop in network traffic,” adds Toufik. A reduction in network traffic of this magnitude typically leads to a significantly more reliable and less costly network.

Overall, NHH is delighted with the new solution. “We’re really pleased; it’s doing a great job.”

One of the reasons NHH decided to partner with Nebulas Solutions was the Group’s ability to provide wide-ranging expertise, which spans IT security, acceleration and virtualisation. Long term, NHH plans to migrate its hardware infrastructure to a blade system, but in the meantime the organisation is working with Nebulas Virtualise on a desktop virtualisation project.

Customer Needs Met:
* Elimination of spam from corporate network
* Gaining 10-15 hours a week by drastically reduced administration burden, which lead to improved IT response times
* Improved network performance due to major reduction in traffic levels
* Smooth integration with anti-virus engine has reduced exposure to risk from email borne malware giving improved operational continuity
* Productivity gains amongst end users, who no longer need to read and delete multiple junk mails leading to productivity gains across the company

Related topics:  Internet and Web security   Virus, Worm, Email security, spyware and malware 

Print version | Email to a friend | Related articles

Data breaches: Trends, costs and best practices gives you all the latest information on securing personal and corporate data, key recommendations for immediate action to improve data security, and how to respond to data breaches.

Other Security news and resources