Cisco Secure Email VS Email Threat defense?

[chenchen40]

Hi

I have recently purchased both Cisco Secure Email and Email Threat defense to protect my 100 users 365 emails.

From what i see, Email Threat defense actualy can do the whole process of protection (inbound+outbound+internal) without fighting with SMA and mx records.

Am i right?

[Ken Stieers]

Yes.

Cisco Secure Email is the ironport ESA, hosted by Cisco or on prem. You point inbound MX records at it so it can process mail before it hits your mailboxes.

Email Theat Defense doesn't require any mailflow changes. You journal all mail to ETD, and if its bad, it pulls it from the mailbox.

A lot of effort is being put into ETD with lots of new, interesting detections.

ETD is only usable if you have mail in the cloud.

[chenchen40]

thanks.

As an enterprise (using 365 mail) - does it make sense to implement both of them?

This is what the local integrator sold me, and I would like to make sure and double-check that.

[Ken Stieers]

You could... there's are reasons to do it, but you could legitimately deploy only one of them.

In my opinion, your integrator over sold you. If a customer KNOWS what the products are doing and how they work and ASKS for both, then sell them both.

[nloverin]

only O365 cloud email, correct?

[Ken Stieers]

Yes. GCP is in the "want list" but I don't know when it might come.

[José L. Dávila]

Hello there,

One of the main use cases for ETD is internal email analysis, which is not typically done by email gateways. 

If , for any reason, an internal email is deemed malicious, ETD can help you remediate it.

Hope it helps. 

[saliyev]

Hello there.
Using only one of them or both depends on the requirements.

Cisco Secure Email (ESA) is a Security Gateway for emails. It is deployed inline mode, provides more features with granular settings, scans messages in flow and takes an action on the messages before delivery. So this is in prevention mode.

Email Threat Defense is rather email threat Detection solution than prevention. It doesn't sit inline and act on messages in flow. It scans the copy of messages received by journaling or forwarded from ESA, provides detection visibility and is able to perform remediation from mailboxes by using an API.

We've seen Customers using both solutions as follows:
   ESA - main Security Gateway for incoming-outgoing emails.

   ETD - advanced integrated Email Threat Detection and Remediation for already delivered incoming emails/emails in mailboxes.

[fatalXerror]

Hi @saliyev , may I know how what do you mean by Advanced Integrated Email Threat Detection and Remediation? Can you provide specific use cases for this like how will ETD remediate? Thank you

[Ken Stieers]

ETD and CES (and ESA) all remediate the same way... if something is determined to be bad, they call MS graph APIs and delete the mail from the mailbox.