In this video, we get to chat about email security
with an eye on the Email Security Appliance
from Cisco Systems, and let's use
this technology as a backdrop.
So we have Bob the user, one of my favorite users
ever, right there at computer 2, and Bob is an email user.
And as an email user, he has a client piece
of software referred to as an MUA, that's a mail user agent,
like Outlook or some other email client,
and it's interacting with an email server.
So let's imagine the email server's up here.
So Bob's computer in the background WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So Bob's computer in the background
is using an IMAP or a POP3 between the client
or the PC he's running on and the email server,
and that's what he uses to retrieve email
from the email server.
So if this represents the email store,
where all the email is sitting, Bob's
going to use his client software and IMAP or POP3
to pull that down to the local computer.
Or if he's using a web based interface,
he might just be using a browser to view that email as it
sits on the server.
And if Bob sends an email to Lois, that's no problem.
That data stays all local on the email server WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That data stays all local on the email server
within the same organization.
And then Lois would use IMAP or POP3
with her client to go ahead and retrieve it and look
at that data.
And if Bob is going to send outbound email,
Bob's computer is going to be using SMTP.
That's the simple mail transfer protocol
that's being used to send the email from Bob's computer
over to the email server.
So let's imagine Bob's domain is ogit.com.
So Bob's email is like Bob@ogit.com,
and if he wants to send an email to some other domain, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and if he wants to send an email to some other domain,
maybe over to acme.com, maybe it's
Lois@acme.com in a different organization,
he sends it to his email server, and then
the email server is going to be forwarding that over
to the email server responsible for acme.com.
We'll call this server 2 over here,
and the email server is also going to be using SMTP
to forward that email.
Now, there's a lot of details that we'll take a closer look
at as we proceed here about what goes
on when those emails are sent.
But in the process of taking that email and sending it,
this email server is also referred to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this email server is also referred to
as ab MTA, a mail transfer agent,
or an email server that can talk to other email servers.
And the way that this email server
would find the appropriate email server on the internet,
for example, to forward that email to,
it's going to do a lookup for a special type
of DNS record called an MX record, a mail exchange record.
So in server 1, does an MX record look out for acme.com.
It's going to give a list of server,
such as server2.acme.com, maybe server3.acme.com and so forth.
And then, once he has a list of the MX servers for that domain, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then, once he has a list of the MX servers for that domain,
he can then go ahead and resolve the individual name to an IP
address with an A record.
Then with that IP address, he can
establish a session with SMTP, and then forward
that email over to that server.
And the same thing happens in reverse
when acme.com, their mail servers need to send an email
or to the email servers responsible at ogit.com.
They would do an MX record lookup for ogit.com,
and then from the list provided of names of servers there,
they would then do an A record lookup for the individual IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they would then do an A record lookup for the individual IP
address of a server.
They would establish an SMTP session,
and then send the email message.
And over here, if we had a client like Jill
over at acme.com, who is running a client,
and she wanted to retrieve a message that
was sent to her from the email server,
her software would once again use
POP3 or IMAP to retrieve the email messages from the server.
So a question that might come up is, OK, Keith,
where does the Email Security Appliance fit in this mix
here for on-prem solution?
Let me show you.
What we would do is we would put the Email Security
Appliance between the real email server and the outside world. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Appliance between the real email server and the outside world.
And so in DNS, we would create our MX records,
and let's call this esa.ogit.com.
So our MX records ogti.com would point to this server's name.
So the MX record would say esa.ogti.com, and then
the A record, this is what the IP address is for that device,
it would be like 23.1.2.72 or what of the address
is that's reachable for that device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that's reachable for that device.
And in many environments, that's likely
going to go to an outside IP address on a firewall
or some type of firewall service,
that then is doing translation to the internal address
on that server.
So the place that the email security appliance fits in,
we just basically tell the rest of the world
that is our email server.
So the rest of the world is interacting directly
with our email security appliance,
and then the ESA is going to deal directly
with our internal email server.
So from the perspective of users,
they still get their email from the email server.
It's just we're adding a middleman, the ESA,
the email security appliance, that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the email security appliance, that's
going to do a whole bunch of filtering and reduction of spam
and malicious emails, so that they never make it
to the inboxes of our users.
And one last thought on this overview
is that the security appliance doesn't just
have to be an on-prem solution, there's
also cloud-based email security or CES, which could also
be-- so if you're using an online email server,
you can use cloud-based Cisco Email Security,
and get the same types of features
and functionality for filtering and blocking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and functionality for filtering and blocking
phishing attacks and malware attacks and spam
and other nasty emails that otherwise might show up
in our users mailboxes.
So in this video, we've taken a look
at where the security appliance, the email security appliance,
would fit in as a middleman between our email server
and the rest of the world.
And the next thing I'd like to chat with you about is, OK,
if this guy is the middleman, this email security appliance,
what can it do for us?
What's the logic as far as when traffic is coming in
or when emails are coming in, what does it
do to really help our users?
And that's what I'd like to discuss with you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's what I'd like to discuss with you
next in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.