Microsoft Antigen nails viruses but stumbles on spam
Malware protection impresses, but optional anti-spam module can't hack it
Viruses and spam both pose an increasing threat these days, and not just to your data or productivity. Rather than hackers trying to break security systems for their own amusement, most current threats are financially motivated and can cost a company millions. And with viruses and phishing attacks growing increasingly more criminal in intention every day, securing financial, customer, and other critical data requires a rock-solid system of defense.
With all of the anti-virus and anti-spam vendors out there, many administrators may not be aware that Microsoft has its own product in this space: Antigen for SMTP Gateways Version 9.0, with Antigen Spam Manager (an optional module). (Microsoft picked up the Antigen technology when it acquired Sybari Software in 2005.)
Antigen’s anti-virus component proved effective in my testing, stopping all live and test viruses received. And the product allows for flexibility, as admins are free to decide whether to cover their bases thoroughly by activating all nine included filters or to speed up processing by enabling only one or two.
The anti-spam component, however, was a disappointment, identifying only 82 percent of spam. Worse, it misidentified far too many legitimate messages as spam.
Installation of Antigen requires only Windows 2000 or 2003 Server for the SMTP version; the Exchange version can be installed on an Exchange 2000 or 2003 server. The latter offers additional functionality, such as allowing users to create and maintain their own anti-spam whitelists rather than requiring the administrator to intervene and add addresses to the allowed-senders list.
Click for larger view.
One issue I had with default installation is that it sets the anti-virus component to update once a day, and in the case of the anti-spam filter, only once and never again, unless you manually change the settings. If you don’t set this to once an hour or once every 15 minutes, you may very well find your network infected with a new virus or barraged by a new spamming method.
You can create multiple rule sets and set each to filter using different anti-virus engines or different anti-spam rules. The anti-virus engines are Antigen Worm, CA InoculateIT, CA Vet, Command, Kaspersky, Microsoft Anti-Virus, Norman Data Defense, Sophos Anti-Virus, and VirusBuster. Using all of them increases the odds of catching a new virus, although at the cost of boosting scan times and latency considerably.