Item: Cisco Secure Web Appliance
Rating: 9
Author: Kuntal Das

Use Cases and Deployment Scope

Cisco Web Security Appliance (WSA) or Ironport is our primary email security tool. All emails that are sent to our users pass through a server running Cisco Web Security Appliance (WSA) or Ironport. The security team uses this tool in accordance with the email management team. However, we serve all the departments of our organization. The main objective of this software is to drop emails with malicious attachments, low reputation IP, banned senders, globally blacklisted emails based on their signatures, etc. Although it doesn't ensure flawless detection, it does a great job at the initial phase of narrowing down our hunt for malicious emails. It led to almost a 60% reduction of attachments containing malware, thereby helping us in securing our assets.

Pros and Cons

It does a great job of filtering emails based on IP reputation. This feature works particularly very well. Cisco has a vast database of IP reputation scores and therefore offers very few false positives and negatives.
It checks each email thoroughly without any compromise of privacy. Any malicious link present in the body of the email makes its way to the quarantine. The IP reputation scores also help in this case.

The default metrics on the dashboard visualization are not that useful. It is not much customizable too. Some of the dashboard features like load, volume, etc. can have a hide option.
The false negatives are more than false positives. A lot of the times, it verdicts the same email as malicious and non-malicious. This can be reduced.

Return on Investment

The machine infection rate by downloading malicious attachments went down by 60%.
Phishing went down by 25%. This directly reduced user account compromise by 30%.

Alternatives Considered

Mimecast Secure Email Gateway

Cisco Web Security Appliance (WSA) is a potent tool. When it comes to handling emails and links from blacklisted IP, Cisco Web Security Appliance (WSA) does a better job. However, considering the price to performance ratio, Mimecast is way ahead of Cisco Web Security Appliance (WSA). Mimecast has an excellent spam filter, unlike the Cisco Web Security Appliance (WSA). However, as said, Cisco Web Security Appliance (WSA) or Ironport has been chosen for our organization due to its tenacity and the power to handle a very high volume of email.

Support Rating

Our experience with Cisco's support was terrible. Other than the fact that they don't respond to service-related emails with urgency, they also keep on changing the policies that affected us. Recently, they came up with a new look for the same software, which was insanely slow. Renewal of keys for the old interface took months. Overall, the support was not very friendly from the users' point of view.

Key Insights

Do you think Cisco Secure Web Appliance delivers good value for the price?

Are you happy with Cisco Secure Web Appliance's feature set?

Yes

Did Cisco Secure Web Appliance live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Cisco Secure Web Appliance go as expected?

I wasn't involved with the implementation phase

Would you buy Cisco Secure Web Appliance again?

Other Software Used

Mimecast Secure Email Gateway, Cisco Advanced Malware Protection (AMP) for Endpoints, Cisco Umbrella, Cisco Threat Grid, Wolfram Mathematica

Likelihood to Recommend

Cisco Web Security Appliance (WSA) or Ironport is well suited for large organizations with a high volume of email flow and a high budget. For low or mid-scale industries, it is not that useful as the email client's own security solution like Office 365 or Gmail can do the job. Although quite accurate, email security needs to be flawless as it marks the beginning of every cyber attack. Cisco Web Security Appliance (WSA) or Ironport does narrow down the search space by dropping emails. But, skillful workers are still needed to ensure the verdict. In the case of spam, it is often not detected. An organization with a high budget, that can afford several employees too along with the tool is a good fit for it

Cisco Web Security Appliance (WSA) or IronPort, your one-stop email solution

Overall Satisfaction with Cisco Web Security Appliance (WSA)