1

An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That being said, I would like to know :

1) What is the difference between an email security gateway and firewall ? Could an email security gateway be considered as an smtp proxy ?

2) Does an email security gateway run an MTA or a UA?

3) How does it detect spams and phishing emails?

closed as too broad by Xander, Jedi, Xiong Chiamiov, WhiteWinterWolf, TheJulyPlot Jul 20 '17 at 7:09

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Please edit the question to limit it to a single question. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. – Jedi Jul 19 '17 at 18:32
3

The term firewall describes a broad category of products for a variety of use cases. There are simple packet filter firewalls using iptables or similar but also so called Next Generation Firewalls which do application level analysis. And there are Intrusion Prevention Systems, Unified Threat Management products, Industry Firewalls ... and also Secure Gateways. Sometimes these names refer to their task, sometimes to a technology and sometimes they are just marketing lingo. But all of these various kinds of network firewalls have in common that they are used for separating networks at various kind of layers: from packet to application layer.

1) What is the difference between an email security gateway and firewall ? Could an email security gateway be considered as an smtp proxy ?

Mail Gateways or Secure Mail Gateways provide a separation at the Application Layer by analyzing the context of mail delivery and the content of mails transferred through a network boundary. This way they help to protect the inner network against malware, phishing, spam etc but can also help to detect data leakage from inside to outside using emails. While there are standalone Secure Mail Gateways or cloud based solutions the necessary functionality is often included in modern enterprise firewalls too. But, like with firewalls in general the quality of the solutions can vary a lot even between products which claim to have the same general features.

2) Does an email security gateway run an MTA or a UA?

Secure Mail Gateways are commonly implemented as MTA, i.e. explicitly configured as MX for incoming mail and as the outgoing mail server in the mail clients. But, there are also products which can be used in a transparent way, i.e. which are setup in front of an existing MTA with no additional configuration in DNS or at the clients.

3) How does it detect spams and phishing emails?

This by itself is a broad question. But, to mention some techniques: there is blacklisting of IP addresses which are known to deliver unwanted or harmful mails (DNS-BL - DNS based blacklists). There is Greylisting to temporarily deny receiving some mail in the hope that spammers will just give up. There is the use of SPF, DKIM and DMARC to detect sender spoofing. There are various content based filters which for example compare received mails with known bad mails received in honeypots or check if they contain links to known spam or phishing sites. And while these are probably the most used and well known techniques this is by far not an exhaustive list of techniques used.

0

The email security Gateway is like a smtp proxy every mail come from outside to your lan or every email come from your lan to outside could be analyze by this device. This application will analyze the email with some signature and you can even define some rules. For example if some words matched in the email you can add modify the subject to add "[Suspect]". So this is really different from a Firewall.

I know CISCO have their own solutions (http://www.cisco.com/c/en/us/products/security/email-security/index.html?stickynav=5) maybe you can find others information in their resources.

Not the answer you're looking for? Browse other questions tagged or ask your own question.