Best Anti-Spam/Virus/Firewall solution for small LAN

[complicated]

I'm working with 5 other guys in a start-up of sorts at the moment. As the only one who eventually bothered to set up our servers, I've been designated IT Manager and we're looking at a combined Anti-Spam/Virus and a hardware or software firewall system for the network. Could you throw up some ideas for what I should be looking at? We're looking for an enterprise-level solution with very complete protection and reporting capabilities, only that there will only be 6 users of this.

4 out of 6 are highly mobile, and all of us juggle multiple laptops. Although we're all highly tech literate, we don't always have time for good practices and the chances of one of these laptops becoming infested with nasties while outside are reasonable - so I'm looking for both inner and outer network protection for the LAN at the office.

Appliance or Software + purpose built PC, I'm not too bothered but the total cost should be reasonable (<$7K excluding license updates). I've been talking to various dealers and we're getting quoted either stupid amounts for completely enterprise setups (paying for a default 100-user license and silly things like that), or being quoted too cheap for inadequate solutions from guys that I know have no real clue about this sort of stuff.

I'm looking for excellent granularity in reporting problems, but an ability to operate largely hands-off with reliable automated updates and threat assessment / countering for network-borne malware/viruses/trojans, and Internet-borne Spam/malware/viruses/trojans (for our Exchange Server 2000, soon to be upgraded to 2003), while finally providing standard stateful packet inspection firewalling capabilities. Integrated VPN features a definite plus.

But wait, there's more! Since the hardware will reside in our single serviced office room, it can't be a noisy machine. We went to the trouble of buying servers with a custom spec so that they wouldn't be noisier than the PC's we already have. So excessively noisy appliances will be a no-no.

Is that enough of a challenge? All suggestions gratefully received, thanks.

 

[SagaLore]

Originally posted by: complicatedAs the only one who eventually bothered to set up our servers, I've been designated IT Manager

Sucks to be you!

 

[SagaLore]

Originally posted by: complicated
we're looking at a combined Anti-Spam/Virus and a hardware or software firewall system for the network. Could you throw up some ideas for what I should be looking at? We're looking for an enterprise-level solution with very complete protection and reporting capabilities, only that there will only be 6 users of this.

4 out of 6 are highly mobile, and all of us juggle multiple laptops. Although we're all highly tech literate, we don't always have time for good practices and the chances of one of these laptops becoming infested with nasties while outside are reasonable - so I'm looking for both inner and outer network protection for the LAN at the office.

Appliance or Software + purpose built PC, I'm not too bothered but the total cost should be reasonable (<$7K excluding license updates). I've been talking to various dealers and we're getting quoted either stupid amounts for completely enterprise setups (paying for a default 100-user license and silly things like that), or being quoted too cheap for inadequate solutions from guys that I know have no real clue about this sort of stuff.

I'm looking for excellent granularity in reporting problems, but an ability to operate largely hands-off with reliable automated updates and threat assessment / countering for network-borne malware/viruses/trojans, and Internet-borne Spam/malware/viruses/trojans (for our Exchange Server 2000, soon to be upgraded to 2003), while finally providing standard stateful packet inspection firewalling capabilities. Integrated VPN features a definite plus.

But wait, there's more! Since the hardware will reside in our single serviced office room, it can't be a noisy machine. We went to the trouble of buying servers with a custom spec so that they wouldn't be noisier than the PC's we already have. So excessively noisy appliances will be a no-no.

Is that enough of a challenge? All suggestions gratefully received, thanks.

Hmm... well for starters - what are you using for your Internet pipe? Are your file servers Linux or Windows based?

 

[complicated]

Internet is a leased line with two 1MB lines linked to a router provided by the ISP, presented to an Ethernet socket, currently wired up to a cheap firewall. Servers are all Windows (2000, partially migrated to 2003) Servers / PC's / laptops are all on the same LAN consisting of 5-port Netgear switches in a star configuration plugged into an 8-port Netgear switch, one per desk. I was tying to make a 24-port switch fanless, but gave up.

The antispam/antivirus/firewall software (if we go for a software solution as opposed to appliance) will run on a separate PC between the server and the router as well as sitting on the LAN itself (I presume... or are we better off running two separate solutions for LAN and WAN?)

 

[AMDZen]

For the Firewall, I would look at Kerio WinRoute Firewall. I'm not sure, but this might have some spy/spam protection built in. I use the personal firewall right now, and it has all sorts of web protection you can enable. From disabling java scrips and ActiveX to referral and cookie protection. Also try Agnitum Outpost Office Firewall. I have used their personal Firewall as well and I think the Kerio and Outpost firewalls are the best. This costs $35.00 for the first 35 licenses. Lastly, I suppose you can try Black Ice defender. Thats what the company I work for uses, but I don't like it. And what little I've seen of WinRoute, its a lot better for corportate networks. Outpost has been very strong for me too, haven't tried their Office version though, that doesn't mean I'd hesitate for a minute to use it.

As for an Antivirus, I would use Symantec Corporate. Its cheap (I think $29.99 per license for the first 20 or so), reliable and has all the auto-updating/auto-scan stuff to help IT people such as yourself. Also, Anti-Vir is good and its free. I don't know if Kaspersky has an enterprise version of its anti-virus, but I've been impressed with it.

EDIT with UPDATE: Looking at Kerio's site, it looks really expensive. So I think that is out at $400 when you won't even be using 4 of the licenses your buying.

Agnitum looks much more reasonable. And Symantec Corporate version 10 is $19.07 at Buy.com

EDIT AGAIN: Nevermind, it looks like Agnitum has a minimum purchase of 10 license's also. But its $350 as opposed to $400 for Kerio. I guess I wasn't too much help. But I guess you can always look at Black Ice Defender, I couldn't find any individual license pricing for thier enterprise Firewall on their site. I don't know of any other good firewall you can use for a small corporate LAN.

 

[SagaLore]

Originally posted by: complicated
Internet is a leased line with two 1MB lines linked to a router provided by the ISP, presented to an Ethernet socket, currently wired up to a cheap firewall. Servers are all Windows (2000, partially migrated to 2003) Servers / PC's / laptops are all on the same LAN consisting of 5-port Netgear switches in a star configuration plugged into an 8-port Netgear switch, one per desk. I was tying to make a 24-port switch fanless, but gave up.

The antispam/antivirus/firewall software (if we go for a software solution as opposed to appliance) will run on a separate PC between the server and the router as well as sitting on the LAN itself (I presume... or are we better off running two separate solutions for LAN and WAN?)

I don't understand why you don't have a server closet under lock&key. That would solve your noise problem right there, and definitely add some physical security to your hardware and data.

Your original post is kind of confusing to read, let's make a list of what you need and let me know if this is right:

• Security implementation for 6 employees
• Multiple laptops and servers (how many systems total?)
• Antivirus/Antispyware
• Spam filtering
• Any hardware appliance must be quiet
• How much is your total budget for this?

 

[SagaLore]

Originally posted by: AMDZen
And Symantec Corporate version 10 is $19.07 at Buy.com

That's to pre-order version 10, it hasn't come out yet. You almost got met excited for a moment, I've been waiting months for it to be released (they're overdue...)

 

[complicated]

Originally posted by: SagaLore

Originally posted by: complicated
Internet is a leased line with two 1MB lines linked to a router provided by the ISP, presented to an Ethernet socket, currently wired up to a cheap firewall. Servers are all Windows (2000, partially migrated to 2003) Servers / PC's / laptops are all on the same LAN consisting of 5-port Netgear switches in a star configuration plugged into an 8-port Netgear switch, one per desk. I was tying to make a 24-port switch fanless, but gave up.

The antispam/antivirus/firewall software (if we go for a software solution as opposed to appliance) will run on a separate PC between the server and the router as well as sitting on the LAN itself (I presume... or are we better off running two separate solutions for LAN and WAN?)

I don't understand why you don't have a server closet under lock&key. That would solve your noise problem right there, and definitely add some physical security to your hardware and data.

Your original post is kind of confusing to read, let's make a list of what you need and let me know if this is right:

• Security implementation for 6 employees
• Multiple laptops and servers (how many systems total?)
• Antivirus/Antispyware
• Spam filtering
• Any hardware appliance must be quiet
• How much is your total budget for this?

The servers are stuffed into a corner and in fact one of the machine's on top of another. We don't really have the room for a dedicated cabinet IMO. What I'm not worried about is physical data security. I am worried that trojans and malware we might pick up while working elsewhere despite Symantec suite being loaded on them might work their way into our servers once we come back into the office and dock the laptops. If we're in countries without reliable internet access for example, it's possible that we won't update signatures on the laptops for a while.

I think I've made it as clear as I can, but we're looking for anti-virus/trojan/malware for the LAN and WAN (i.e. not just workstation-based solutions), then an anti-spam for email as well as a firewall, with VPN facilities a plus. It would be nice if it could be done in a single box. If it's an appliance, yes it should be quiet or better still, fanless. If it's software, then we'll build a quiet PC to run it.

We've got one email server and one file server, as well as one terminal services server, all Windows Server based. About 10 laptops in all, all 2000/XP, everyone has a desktop too and a spare (7, all XP). All the laptops and workstations already have the Symantec suite.

Total budget is under $7K.

 

[SagaLore]

Originally posted by: complicated

Originally posted by: SagaLore

• Security implementation for 6 employees
• 3 servers
• 10 laptops
• 7 laptops
• Antivirus/Antispyware
• Spam filtering
• Any hardware must be quiet
• How much is your total budget for this?

I think I've made it as clear as I can, but we're looking for anti-virus/trojan/malware for the LAN and WAN

LANs and WANs are the same thing - they are networks, but one is localized and another is regional. Perhaps you are trying to say Systems versus Network based.

I'll get back to you today on a good solution. You'll need 20 licenses at the least.

 

[Brazen]

Get the NeatSuite from TrendMicro, and use a linux firewall if you need to save money, or Cisco PIX firewall if you want to go all out.

 

[SagaLore]

Trend Micro NeatSuite (Small Business) - 25 licenses $1500

The suite includes antispam and antivirus for desktops, servers, and the gateway. Exactly what you need. Their corporate scanning engine has been getting really good reviews.

Sygate Personal Firewall Pro - 10 licenses $360

I would not recommend using any of the antivirus vendor personal firewalls, they just don't cut it. Sygate has helped me stop numerous outbreaks, because the IDS signatures will stop exploit attempts that viruses use. Now I use the enterprise edition, which includes adaptive policies (rules for different locations and different adapters, like vpn, wireless, ethernet, modem, etc.) and centralized management and reporting. But it will cost more.

Watchguard Firebox X-Core - firewall, gateway av/ids, vnp

Here is an example of a model and how much it costs: CDW - Firebox X50 $859

The gateway scanning features (av/spam/web) require additionally licensing costs.

 

[SagaLore]

Originally posted by: Brazen
Get the NeatSuite from TrendMicro, and use a linux firewall if you need to save money, or Cisco PIX firewall if you want to go all out.

Beat me to the punchline. I was already typing up my reply before I saw yours - I guess that is two votes for NeatSuite.

 

[Monoman]

make the 3!

 

[Brazen]

Originally posted by: SagaLore

Originally posted by: Brazen
Get the NeatSuite from TrendMicro, and use a linux firewall if you need to save money, or Cisco PIX firewall if you want to go all out.

Beat me to the punchline. I was already typing up my reply before I saw yours - I guess that is two votes for NeatSuite.

That's why I don't go into detail

By the way, OfficeScan (included in NeatSuite), has a personal firewall, and anti-spyware -malware -greyware

 

[SagaLore]

Originally posted by: Brazen
By the way, OfficeScan (included in NeatSuite), has a personal firewall

I don't care - he should still get Sygate and keep trend's firewall disabled. If not Sygate, then Kerio, in fact I'd even suggest installing the free edition of ZoneAlarm before going with any of the personal firewall products bundled with antivirus software.

It's not really the firewall features I am concerned about - if that's all you want, then use the windows SP2 firewall. But it's the IDS signatures that will really save your butt. It's not just to prevent hackers and d.o.s., but it will stop unidentified viruses as well and often spyware that installs through a browser exploit.

 

[Brazen]

Originally posted by: SagaLore

Originally posted by: Brazen
By the way, OfficeScan (included in NeatSuite), has a personal firewall

I don't care - he should still get Sygate and keep trend's firewall disabled. If not Sygate, then Kerio, in fact I'd even suggest installing the free edition of ZoneAlarm before going with any of the personal firewall products bundled with antivirus software.

It's not really the firewall features I am concerned about - if that's all you want, then use the windows SP2 firewall. But it's the IDS signatures that will really save your butt. It's not just to prevent hackers and d.o.s., but it will stop unidentified viruses as well and often spyware that installs through a browser exploit.

OfficeScan's firewall includes IDS/IPS

 

[SagaLore]

Originally posted by: Brazen

Originally posted by: SagaLore

Originally posted by: Brazen
By the way, OfficeScan (included in NeatSuite), has a personal firewall

I don't care - he should still get Sygate and keep trend's firewall disabled. If not Sygate, then Kerio, in fact I'd even suggest installing the free edition of ZoneAlarm before going with any of the personal firewall products bundled with antivirus software.

It's not really the firewall features I am concerned about - if that's all you want, then use the windows SP2 firewall. But it's the IDS signatures that will really save your butt. It's not just to prevent hackers and d.o.s., but it will stop unidentified viruses as well and often spyware that installs through a browser exploit.

OfficeScan's firewall includes IDS/IPS

That doesn't mean it's any good - plus, by putting all your eggs in one basket, i.e. if your install of Trend were to fail, you're completely vulnerable.

 

[Brazen]

Originally posted by: SagaLore

Originally posted by: Brazen

Originally posted by: SagaLore

Originally posted by: Brazen
By the way, OfficeScan (included in NeatSuite), has a personal firewall

I don't care - he should still get Sygate and keep trend's firewall disabled. If not Sygate, then Kerio, in fact I'd even suggest installing the free edition of ZoneAlarm before going with any of the personal firewall products bundled with antivirus software.

It's not really the firewall features I am concerned about - if that's all you want, then use the windows SP2 firewall. But it's the IDS signatures that will really save your butt. It's not just to prevent hackers and d.o.s., but it will stop unidentified viruses as well and often spyware that installs through a browser exploit.

OfficeScan's firewall includes IDS/IPS

That doesn't mean it's any good - plus, by putting all your eggs in one basket, i.e. if your install of Trend were to fail, you're completely vulnerable.

For me, that is what perimeter security is for.

 

[SagaLore]

Originally posted by: Brazen
For me, that is what perimeter security is for.

When you're outside of your network and have to use another company's network, or hotel broadband, the personal firewall is your perimeter security.

 

[Brazen]

Originally posted by: SagaLore

Originally posted by: Brazen
For me, that is what perimeter security is for.

When you're outside of your network and have to use another company's network, or hotel broadband, the personal firewall is your perimeter security.

Fine, I'm not going to continue with this because I don't necessarily disagree with you, I just think you are going a tad too far. You have to quit somewhere you know. I guess the decision of where is up to the system administrator himself. Eventually you'll be running Symantec Client Security, TrendMicro OfficeScan, AVG antivirus, 2 dedicated personal firewalls in addition to the Windows Firewall, 2 antispyware apps, the Win32 port of Snort,.... Don't get me wrong, I'm not making you out to sound that rediculous, just showing that you have to draw the line somewhere, and you apparently advocate drawing the line one step further than I do.

 

[SagaLore]

Originally posted by: Brazen

Originally posted by: SagaLore

Originally posted by: Brazen
For me, that is what perimeter security is for.

When you're outside of your network and have to use another company's network, or hotel broadband, the personal firewall is your perimeter security.

Fine, I'm not going to continue with this because I don't necessarily agree with you, I just think you are going a tad too far. You have to quit somewhere you know. I guess the decision of where is up to the system administrator himself. Eventually you'll be running Symantec Client Security, TrendMicro OfficeScan, AVG antivirus, 2 dedicated personal firewalls in addition to the Windows Firewall, 2 antispyware apps, the Win32 port of Snort,.... Don't get me wrong, I'm not making you out to sound that rediculous, just showing that you have to draw the line somewhere, and you apparently advocate drawing the line one step further than I do.

You can't run multiple (realtime) antiviruses, and it's not recommended to run multiple firewalls. We'll just agree to disagree about the personal firewall part and leave it at that.

 

[DaveSimmons]

spam:

www.SpamStopsHere.com - the service acts as a filter to discard spam and virus attachments before they even reach your server.

It's at least 99% effective with zero false positives if you use their own database-driven filtering, or 99.99% with some false positives if you let them also use blacklists from spamhaus, spamcop, etc.

Free/paid server-side packages that use simple rules and the blacklists miss a fair amount of spam and generate a large number of false positives so you can't safely discard spam without looking at it.

With SpamStopsHere the email that matches their database can be (and is) safely deleted without you needing to look at it, you only need to have the "spam" caught by blacklists forwarded to you to check for false positives.

 

[SagaLore]

Originally posted by: DaveSimmons
spam:

www.SpamStopsHere.com - the service acts as a filter to discard spam and virus attachments before they even reach your server.

It's at least 99% effective with zero false positives if you use their own database-driven filtering, or 99.99% with some false positives if you let them also use blacklists from spamhaus, spamcop, etc.

Free/paid server-side packages that use simple rules and the blacklists miss a fair amount of spam and generate a large number of false positives so you can't safely discard spam without looking at it.

With SpamStopsHere the email that matches their database can be (and is) safely deleted without you needing to look at it, you only need to have the "spam" caught by blacklists forwarded to you to check for false positives.

Not bad, that will cost them about $100 per year. :thumbsup:

Doesn't seem to have a spam digest feature though. Your options are either to discard it, tag it, reject it, or forward it. With a company that small though, they could just setup a quarantine@ mailbox and check it for false positives every once in a awhile.

 

[Brazen]

Originally posted by: SagaLore

Originally posted by: Brazen

Originally posted by: SagaLore

Originally posted by: Brazen
For me, that is what perimeter security is for.

When you're outside of your network and have to use another company's network, or hotel broadband, the personal firewall is your perimeter security.

Fine, I'm not going to continue with this because I don't necessarily agree with you, I just think you are going a tad too far. You have to quit somewhere you know. I guess the decision of where is up to the system administrator himself. Eventually you'll be running Symantec Client Security, TrendMicro OfficeScan, AVG antivirus, 2 dedicated personal firewalls in addition to the Windows Firewall, 2 antispyware apps, the Win32 port of Snort,.... Don't get me wrong, I'm not making you out to sound that rediculous, just showing that you have to draw the line somewhere, and you apparently advocate drawing the line one step further than I do.

You can't run multiple (realtime) antiviruses, and it's not recommended to run multiple firewalls. We'll just agree to disagree about the personal firewall part and leave it at that.

oops, I fixed it, I meant to say "I don't necessarily disagree with you." Kinda changes the spirit of my post...

 

[SagaLore]

Originally posted by: Brazen
oops, I fixed it, I meant to say "I don't necessarily disagree with you." Kinda changes the spirit of my post...

:beer: