Microsoft is readying a new feature for Exchange Online that will report, throttle, and block emails from unsecured on-prem Exchange servers.

Admins will be sent alerts if their on-prem exchange servers are deemed to be unsupported or are unpatched from security threats, complete with a reminder to update their infrastructure.

It marks a step towards reducing the risk of malicious emails reaching organisations, but also to encourage customers with unsupported or unpatched Exchange servers to secure their on-prem environments.

“We’ve said many times that it is critical for customers to protect their Exchange servers by staying current with updates and by taking other actions to further strengthen the security of their environment,” said Microsoft.

“Many customers have taken action to protect their environment, but there are still many Exchange servers that are out of support or significantly behind on updates.”

Exchange Online is set to receive a new mail flow report in the Exchange admin centre. This will provide admins with information about unsupported or expired Exchange servers in their environment.

The report will inform admins of any messages that are throttled or blocked, and what will happen if the server isn’t updated or taken out of service.

If the server’s issues haven’t been addressed then Exchange Online will throttle messages from it. The throttling will increase progressively over time and is designed to raise awareness of the issue with admins to try and get them to fix the server. If the issue isn’t addressed within 30 days, then emails will begin to be blocked.

Microsoft is adopting what it calls a “progressive” enforcement approach, where throttling will slowly increase over time, followed by gradual blocking, and then resulting in blocking all non-compliant traffic. The actions will escalate until the server is removed from service or updated.

The company said that the new system is set to be applied to all Exchange Server versions and all emails coming into Exchange Online. However, for now, the tech giant is starting with Exchange 2007 servers.

“We have specifically chosen to start with Exchange 2007 because it is the oldest version of Exchange from which you can migrate in a hybrid configuration to Exchange Online, and because these servers are managed by customers we can identify and with whom we have an existing relationship,” Microsoft explained.

The new system will then be incrementally introduced into other Exchange Server versions, until all versions are included.

Microsoft is aiming to address the problem of emails sent to Exchange Online from unsupported and unpatched Exchange servers. It said these servers present a security risk as once they are no longer supported, they don’t receive security updates.

“Once a security update is released, malicious actors will reverse-engineer the update to get a better understanding of how to exploit the vulnerability on unpatched servers,” said the tech giant.

The company said that emails messages coming from servers that are unsupported or unpatched are “persistently vulnerable” and can’t be trusted. This means these servers can increase the risk of an organisation experiencing attacks like malware, security breaches, or hacking.

Rampant Exchange Server issues

Microsoft Exchange Servers have been repeatedly abused by malicious actors over the years.

In November 2021, compromised servers were used to spread a SquirrelWaffle malspam campaign after targeting unpatched instances. The malspam hijacked inboxes and set malicious emails responding to existing email chains.

Following other exploration attempts of Exchange Server earlier that year, Microsoft was forced to delay the technology's development roadmap.

The company admitted in June 2022 that it needed more time to strengthen its security following China-linked Hafnium attacks.

This was followed in December 2022 by a researcher who said that a ransomware attack on Rackspace may have been down to an attacker taking advantage of an out-of-date Exchange cluster.

Security researcher Kevin Beaumont suggested that the attackers exploited the server clusters which hadn’t been patched since August 2022, before the ProxyNotShell patches had been released.

Microsoft has announced it will retire Client Access Rules (CARs) in its Exchange Online platform by September 2023.

CARs allow Microsoft 365 administrators to filter client access to Exchange Online by combining conditions, exceptions, actions, and priorities.

"Today, we are announcing the retirement of CARs in Exchange Online, to be fully deprecated by September 2023," the Exchange Team said.

"We will send Message Center posts to tenants using client access rules to start the planning process to migrate their rules."

Per reports, beginning October 2022, the company will disable client access rules for unused tenants. By September 2023, Microsoft will assist all remaining tenants in migrating from CARs to newer access control features such as continuous access evaluation (CAE)

"Now with new features, like Continuous Access Evaluation (CAE) that allows Azure Active Directory applications to subscribe to critical events, that can then be evaluated and enforced in near real time; you can have better control while also adding resiliency to your organization," the Exchange Team added.

As part of its effort to bolster Exchange Online’s safeguards, Microsoft has also warned customers that basic authentication will be disabled by October 1, for randomly selected tenants.

German email provider Tutanota has publicly called out Microsoft for allegedly blocking users using Tutanota email addresses from registering a Teams account.

The company had discovered that anyone who attempts to sign up for Microsoft Teams with a Tutanota email address is shown an error message reading “[email address] hasn’t been added to your organization’s directory. Contact your admin or try a different email.”

Tutanota has been in a back-and-forth with Microsoft for weeks over the issue, but was repeatedly told by Microsoft that it is “currently not feasible for the domain to become a public domain”.

Disputing this claim, Tutanota has taken the issue to the public and accused Microsoft of engaging in an anti-competitive practice.

With millions of users worldwide, the company maintains that its customers have a right to privacy that should not be compromised through a requirement to use a secondary email provider.

The problem, according to TechCrunch, appears to be linked to the fact that Teams recognises Tutanota addresses as corporate emails, hence the request for denied users to contact their administrator.

At the time of writing, IT Pro has been informed, that emails using the Tutanota domains tutanota.com and tutanota.de now work with Teams registration. This follows a Twitter exchange that the company believes improved the situation behind the scenes.

Three other domains, tuta.io, keemail.me and tutamail.com, remain blocked.

"To us it is very frustrating that such a step is needed to get an issue resolved by Microsoft. In our view it is negligence on Microsoft's part that does result in antitrust issues,” said a Tutanota spokesperson.

Unlike many email providers, Tutanota encrypts its entire mailbox and address book and allows users to send end-to-end encrypted emails to any email address via the use of a password. For these reasons along with a whole host of other privacy features, it is considered one of the most secure email services available.

“This severe anti-competitive practice forces our customers to register a second email address – possibly one from Microsoft themselves – to create a Teams account,” said Tutanota co-founder Matthias Pfau, in a blog post.

“When asked to change the current situation, a spokesperson for Microsoft simply said it would not be possible for them to allow people to register a Teams account with a Tutanota email address. Period. We repeatedly tried to solve the issue with Microsoft, but unfortunately our request was ignored.”

IT Pro has approached Microsoft for comment.

State-sponsored cyber attacks on Microsoft Exchange servers throughout 2021 are the reason why the latest version of the on-prem mail and calendaring server will be delayed by four years, Microsoft said.

A new version of Microsoft Exchange Server was originally on course for an H2 2021 release but Microsoft has updated its roadmap delaying the release to H2 2025 due to the time it took developers to improve security in the wake of the Hafnium attacks.

Hafnium is a state-sponsored hacking group Microsoft has previously said is linked to China. In 2021, Hafnium attacked Microsoft Exchange servers consistently using a flurry of zero-day vulnerabilities to exfiltrate information from victims across various business verticals.

In addition to an extra four-year wait for the next version, IT admins can expect to hear more about the new features, pricing, requirements, and naming of the updated version in the first half of 2024.

Microsoft also said the latest version will require Server licenses and Client Access Licenses (CALs) and will only be accessible to customers with Software Assurance - a service pack that automatically provides customers with licenses to the latest versions of software.

The current support dates for Exchange Server 2013 (11 April 2023), Exchange Server 2016 (14 October 2025), and Exchange Server 2019 (14 October 2025) are unchanged.

The next version of Exchange Server will move to Microsoft’s Modern Lifecycle Policy which does not set end-of-life (EOL) dates for products or services but continues to offer support as long as there is demand for it in the market.

Customers running Exchange Server 2019 may have an easier time upgrading to the new version when the time comes, Microsoft hinted.

After resolving previously known upgrading issues relating to hardware requirements and mailbox migration, Microsoft is introducing an in-place upgrade capability to Exchange Server 2019 and recommends all customers upgrade to the version “as soon as possible”.

Hafnium’s server siege

Last year, the Chinese-linked state-sponsored hacking group exploited a chain of zero-day vulnerabilities in Microsoft Exchange, leading to hacks on hundreds of thousands of businesses.

Microsoft said at the time that the group was known for harvesting data from various types of organisations including those in the medical, education, military, NGO, and policy sectors.

Based in China but operating from US-based virtual private servers (VPS), Hafnium gained access to Exchange Servers, installed a web shell for remote control, and stole data.

The White House was especially concerned about the threat to national security and urged all businesses to patch their Exchange servers to the latest version as a matter of priority, at the time.

More than a month after the exploits became public knowledge, US government agencies were still finding unpatched Exchange Server vulnerabilities in their systems.

Experts said that if organisations hadn’t patched on the day of release, there was a strong chance that the environment was already compromised, and the web shell had already been planted.

It was later revealed that Microsoft first became aware of the zero-day exploits in January 2021, two months before Hafnium’s activity ramping up in March.

Hafnium’s exploit chain was ultimately used in separate attacks throughout the year, namely by the Qakbot and SquirrelWaffle malspam campaigns spreading via unpatched servers in October 2021.

Microsoft’s work so far

The delay to the latest version of Microsoft Exchange Server came as a result of Microsoft's security experts being forced to work throughout 2021 to combat the heavy attacks from the exploits used by Hafnium.

It said that work on the new release was stalled as the team was busy pushing out-of-band security updates, a one-click mitigation tool - which was later integrated as a core feature of Exchange Server and integrating other services to improve the security of the service for IT admins.

It also launched a bug bounty programme for Exchange Server and Office Server under the Microsoft Applications and On-Premises Servers Bounty Program to improve the company’s collaboration with the private sector and independent security researchers and ultimately improve the security of Exchange Server.

Microsoft 365 is the dominant cloud email and collaboration service, and the recent rapid move to hybrid and home working has increased its usage enormously. Unfortunately, this popularity has a downside: although Microsoft does provide built-in email security features, they are comparatively basic, making the platform a juicy target for cybercriminals.

It isn’t advisable to rely only on your cloud provider for security either, as businesses are ultimately responsible for the safety of their own data. So it makes sense to adopt a defence-in-depth strategy, and HornetSecurity 365 Total Security is one provider that aims to offer complete email security solution.

HornetSecurity 365 Total Protection: Features and on-boarding

HornetSecurity offers two packages: the Business option costs €2 per user per month and provides essential security services, such as spam and malware protection, content controls, compliance filters and live tracking of email, while the Enterprise package increases monthly costs per user to €4 but enables a heap of compliance features. In particular, while Microsoft 365 isn’t great at email archiving, HornetSecurity improves matters enormously with legally compliant real-time archiving, fast eDiscovery services, a whopping 10-year maximum retention period and unlimited archive space for each user.

Encryption comes as standard with both packages, with support for global S/MIME and PGP. Businesses working with partners that don’t normally use encryption will also appreciate the WebSafe service, which allows users to send encrypted emails that can be safely opened using a web browser.

Setup is fast too. HornetSecurity claims a 30-second on-boarding process, and we found this to be quite feasible. You simply need to change your domain MX records, go to the registration link provided, input your credentials and leave the automated setup routine to create the required connectors to route your inbound and outbound mail through the HornetSecurity servers.

HornetSecurity 365 Total Protection review: Instant protection

Full spam and malware protection starts immediately. The service is enabled by default, and the only options available are to decide whether dodgy messages should be quarantined or tagged for onward processing. The "infomail" filter uses over 15,000 heuristics to weed out nuisances such as newsletters or mass marketing campaigns, and this can be globally disabled or set so users can decide whether they want to use it.

The administrative cloud portal is easy to navigate, opening with a live email-tracking view which is far more informative than the Microsoft 365 reporting service. It shows all email activity for the selected period and assigns a colour code to each message to denote whether it has been classified as clean, spam or infomail, whether it contains malicious content or an infected attachment, or whether it has been rejected by custom filters.

You can drill down to find certain types of message by applying filters such as direction, delivery status or size; selecting the colour legend icons at the top instantly changes the view so you only see emails with those classifications. Any individual email can be inspected by selecting its icon, which opens a menu for viewing the header and content, releasing it, adding the sender to deny or allow lists and reporting it as spam.

Users can take advantage of the self-service features by logging in to a personal portal with their Microsoft 365 credentials, reviewing emails and releasing them if permitted. Along with graphical reports of mail activity in their portal, quarantine reports can be emailed out at regular intervals and show all spam activity plus quarantined attachments with quick links to review and deliver them.

HornetSecurity 365 Total Protection review: Security settings

The portal’s security settings page provides a single point for configuring all the HornetSecurity services. Both packages provide content control, which can remove attachments that are encrypted or contain executables and block Word, Excel and PowerPoint attachments with macros.

You can supplement this with custom lists of forbidden attachment file types, or restrict emails to a maximum size, and separate settings can be applied for inbound and outbound mail flows.

There's also a compliance filter, which uses inbound and outbound rules to look for specific keywords in messages, and reject them if found. Simple rules look for keywords in the message header or body, while advanced rules can be applied to senders, recipients, IP addresses, hostnames and attachments.

We tested this with an outbound rule and found it worked exactly as promised: any messages sent by our users that contained our keyword in the subject line showed as rejected in the live mail tracking screen. The senders meanwhile received a message stating that the recipient’s mail domain had rejected the message as spam, with no indication that HornetSecurity was working behind the scenes.

HornetSecurity 365 Total Protection review: Advanced features

The ATP (advanced threat protection) service in the enterprise package uses multiple methods to combat emails containing malicious URLs, content or attachments, along with spear phishing attacks.

For one, web links are automatically rewritten using a secure proxy to see what they connect to and scan for potential threats. When our users clicked on web links in our test emails, a browser opened with a stripped-down view of the web site: clicking on a link at the top allowed the site to be checked by the ATP scanner before the full web site was presented.

Then there's the ATP sandbox, a secure virtual environment where HornetSecurity opens suspect emails, checks their contents and sends back forensic reports including PCAP traffic dumps and screenshots. The targeted forensics filter protects against spear phishing by analysing message contents to determine intent and spot spoofed addresses.

Businesses caught out by 2020s four-hour Microsoft 365 outage will also find the enterprise continuity service of great interest. It’s enabled in the portal for entire domains or specific users, and kicks in when normal services go down; during these times, HornetSecurity routes all mail through its own emergency servers, retains copies for up to three months and automatically merges them back when services return.

HornetSecurity 365 Total Protection review: Verdict

We tested 365 Total Protection for nearly a month, and during this time absolutely nothing slipped past its mail defences. That's a very impressive performance, and it’s easy to deploy and manage too, with plenty of options for customisation. It's a true enterprise-class email protection service at a price SMBs can afford.

Microsoft’s Exchange mail servers have been targeted by a group of state-backed hackers operating out of China, according to the tech giant.

The threat actors took advantage of four previously-undetected zero-day vulnerabilities in its software that allowed hackers to access servers for Microsoft Exchange. These flaws were labelled CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Microsoft’s latest Security Response Center (MSRC) release.

The company said that it believes the attacks were carried out by the Hafnium group, which Microsoft described as “state-sponsored and operating out of China, based on observed victimology, tactics and procedures”.

Microsoft’s corporate VP of Customer Security & Trust, Tom Burt, said that “while Hafnium is based in China, it conducts its operations primarily from leased virtual private servers (VPS) in the United States”.

“Historically, Hafnium primarily targets entities in the United States for the purpose of exfiltrating information from a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defence contractors, policy think tanks and NGOs,” he said, adding that the group “engaged in a number of attacks using previously unknown exploits targeting on-premises Exchange Server software”.

According to Burt, the threat actors carry out the attack in three steps: “First, it would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access. Second, it would create what’s called a web shell to control the compromised server remotely.

"Third, it would use that remote access – run from the US-based private servers – to steal data from an organisation’s network."

Microsoft advised customers to update on-premises Exchange Server 2013, 2016 and 2019 systems immediately, adding that Exchange Online hadn’t been affected and that the attacks are in "no way connected to the separate SolarWinds-related attacks”. The company has been under intense scrutiny since it was found that an exploit in Microsoft 365 was used by SolarWinds hackers to access government and the private sector information, including MalwareBytes’ internal emails.

However, Microsoft maintained that it continues “to see no evidence that the actor behind SolarWinds discovered or exploited any vulnerability in Microsoft products and services”.

Burt added that the Hafnium group-led attack is the eighth case in the last 12 months of a nation-state group targeting critical institutions to be disclosed by Microsoft.

Despite the rise of business messaging and collaboration apps such as Slack and Microsoft Teams, email is not ready to be killed off just yet. In fact, you might want to hold off on deleting your Gmail account, regardless of how much it annoys you. Email is still considered to be the most popular way of communicating about work-related matters, with some people being capable of spending an entire day just going through their inbox. A recent survey by Mail Manager found that 90% of respondents indicated that they use email to communicate with their clients, while Skype and WhatsApp, by comparison, were used by 55% of those surveyed. Just 15% of those surveyed said that Slack was their go-to communication platform.

Although it definitely has its faults, email is here to stay as a form of formal correspondence. Jacob Wardrop, commercial director at Mail Manager, went as far as to describe the Gen-X staple as the "letter of today".

"While tools like Slack and WhatsApp are great for informal correspondence and chat, email remains the core correspondence method for formal communication. Before the digital era, companies would send formal correspondence as letters, which would be physically stored. Now, email is the tool for formal correspondence, but the need for filing and securely storing this communication remains, even though it's digital," he said.

There are many reasons as to why emails continue to be popular among users. One of the central reasons could be the Simple Mail Transfer Protocol, also known as SMTP. This is one of the main mechanisms underpinning the technology behind email communications. SMTP has been a crucial aspect to the long reign of the email, and has been a main component of electronic messaging for over 40 years.

It’s easier to think about SMTP as some kind of structure or rules which clarify how information can be moved between different email servers. You probably don’t know this but it’s also used as a foundation for data transmissions by most of the main email providers, like Microsoft’s Outlook or Gmail. This ensures that emails are able to be sent away from their own sites, a key aspect of this electronic form of communication.

As for the history of SMTP, it can be traced all the way back to the computer scientist John Postel in the year 1980. It was initially known as RFC 821 and RFC 2821. Ever since its inception, SMTP has been changed a number of times but its main idea remains more or less the same. It contains four main components which are called “agents”, which make up this framework. These are mail transfer agent (MTA), mail user agent (MUA), mail delivery agent (MDA), and mail submission agent (MSA). SMTP functions by simply transferring an email from one device’s MTA to a different machine’s agent. Emails are reliant on all parts of the process, especially since the other agents all have similar jobs within the framework.

It depends on how users configure their email systems, but the Internet Message Access Protocol (IMAP) or Post Office Protocol 3 (POP3) can also be utilised to help collect and send emails to their final destinations.

As you might have guessed, these protocols have their advantages and disadvantages. However, most businesses usually decide to choose the IMAP protocol since their emails have the ability to be stored on a server instead of individual user hardware. Be aware that if you do decide to utilise IMAP, ensure you configure it to choose which server should save the messages. This will prevent your emails being received with a delay or mistakes by all the devices that need to have access to them.

What is the SMTP server?

An SMTP server is just a computer running SMTP. Once messages are picked up they are sent to this server for passing onto recipients.

Six steps to (email) heaven

An email is sent from sender to recipient using six steps.

1) The email is submitted by an MUA to a mail server's MSA.

2) This email is transferred to the server's MTA via port 25 (the MTA and MSA are typically hosted on the same SMTP server).

3) The MTA confirms the MX record of the recipient domain and transfers the message to another MTA (this can happen many times until the message is received by the destination server).

4) The email is given over to the MDA, which saves the message in the correct format for retrieval by the receiving MUA.

5) The receiving MUA requests the message from the MDA via POP3 or IMAP.

6) Lastly, the email is delivered to the receiving MUAs inbox.

How to use MIME to send attachments

SMTP is a very reliable protocol, but it is constrained to sending text only. This would make email very limited as we wouldn't be able to send any attachments. This is where MIME comes in.

MIME stands for Multipurpose Internet Mail Extensions. This is an extension to SMTP that allows users to send different kinds of files over the internet, such as audio, video, images, application programs, etc. It also allows for non-Latin characters and emails that contain multiple parts (such as an email with a plain text element and an HTML element).

What is SMTP Authentication?

Another extension to SMTP is SMTP Authentication. This enables email clients to authenticate when connecting to an SMTP server using a username and a password. This prevents unauthorised users from sending email through an SMTP server.

Microsoft's Outlook is still experiencing some issues for European customers, though it appears to be back up and running again in the UK after widespread outages yesterday.

A Microsoft spokesperson told IT Pro: "Intermittent connectivity is affecting our free email service for customers in some European countries, which we are working to resolve as soon as possible."

Downdetector shows that European users were heavily affected by the outage yesterday, with customers in the UK, France, Belgium, the Netherlands, and Spain impacted.

The outage began on Monday morning, with 1,577 reports on Downdetector by 3pm, but seemed to have been fixed by 10pm. However, some users are still experiencing problems with the service, according to comments in Downdetector.

Some are having problems sending and receiving emails and deleting emails, and some reported seeing no trace of emails that were meant to have been received yesterday, according to Downdetector.

Despite this, Microsoft's service status page states "Everything is up and running", suggesting it's fixed in the UK, at least.

The last post on the page posted a final status at 1:25am UTC: "We've verified that new mails are being sent and received as expected, and the previous queue has returned to normal. A very small number of messages sent during the incident may be delivered over the next few hours as the last remaining messages are processed."

Microsoft last suffered a major Outlook outage in January 2016, when problems extended into a ninth day following a faulty update.

Picture: Bigstock

The Zimbra Collaboration Suite (ZCS) is a Linux-based groupware system designed to provide your staff with unified email, calendar, contacts and basic file-sharing. Both commercial and open source versions are available. We've looked at the open source version as a cost-effective alternative to commercial server-based products such as Microsoft Exchange Server and Software-as-a-Service (SaaS) systems such as Google Apps for Work.

An added advantage that locally-hosted email and groupware systems have over SaaS products is that you are in full control of your own data, and can ensure that it's kept within the EU, or indeed your own business premises, making it easy to comply with legal and contractual obligations regarding confidential customer and financial data.

The paid-for version of Zimbra has extra features, most notably ActiveSync for mobile devices and a plugin for Microsoft Outlook. Standard comparative pricing is not available, as the company provides quotes on a per-client basis.

Basic configuration

We installed Zimbra on a vanilla Ubuntu 14.04 system. It's a simple process, thanks to an installation script that's provided with the download that checks for all the required system packages. However, rather than automatically installing missing packages, it lists them and exits.

Armed with this list, installing the missing dependencies was just a matter of a few minutes and a handful of apt-get commands. With that done, installation proceeded smoothly. We left most options, such as install locations and services, on their default settings, but had to correct the domain, as the installer attempted to use the hostname as the domain.

At the final stage, the script gives you a chance to review all the settings and options chosen, correct any missing elements in the configuration, and save the config to a file before committing it to the system. With that done, all we had to do was set a password for the admin account. Once the script finished installing all the required components, the comprehensive installation documentation directed us to the administration web interface. When you connect to the web interface for the first time, you'll get a certificate warning from your browser, as you won't yet have had the opportunity to upload an appropriate signed certificate to the server.

Web administration

The web administration interface has a refreshingly clean layout, with a simple menu on the left and a central pane for editing settings. When you first connect, the home screen lists 3 sets of tasks needed to get the server running, but you'll have already taken care of most of the first two stages during installation.

Zimbra's admin screen helps guide you through configuration when you first log into it

At this point, it's important to check the default Class of Service (COS) settings. This screen contains all the settings used as defaults when adding new users, such as language and time zone, enabled features, and themes. The system defaults to internal user management, but you can alternatively set it up to use an external Active Directory or LDAP server to manage your users. This is set individually for each email domain configured on the system.

Additional commands are available from a drop-down menu at the top right of the settings window. This replaces the options that would normally appear as a right-click context menu on systems such as Microsoft Exchange.

Accounts are configured from the accounts page in the Manage menu. Adding a new account brings up a window with a large number of options, but once the basic user details are entered, the remaining options will all be preset to the values set in the default COS, so it can be left as is if no specific customization is required for the user in question.

Zimbra's global admin settings are automatically applied to all accounts

This is also where you'll go to set or reset a user's preferences, for example if they've accidentally changed something in their own account configuration settings that's preventing them from using their account properly.

You can disable user access to their account preferences, either on a per-user basis or via the default COS setting. However, although this means that users won't be able to tinker with advanced options such as trusted address settings, it'll also prevent them from setting signatures, filters and out of office auto-replies. We'd have preferred to be able to control which preferences a user could access rather than it being an all-or-nothing choice.

ZCS can also be extended through the use of third-party plugins, called Zimlets, which can be installed through a dedicated area in the admin interface's configuration settings. These can provide extra functionality such as instant messaging, Dropbox integration, and video conferencing control. Some Zimlets have been adopted by the Zimbra developers, and are pre-installed, such as email archiving and the ability to ring phone numbers using Skype. There's also a JavaScript API, so you can develop in-house Zimlets if required.

You can add Zimlets - community developed extensions to ease integration between Zimbra and other services

User experience

Like the web-based admin interface, the user web interface is clean and well thought out. Zimbra's capabilities as a polished and professional webmail client set it apart from most Linux-based email systems. The menus are logical and reasonably intuitive for anyone who's used any kind of webmail before, with everything pretty much where you'd expect it to be.

We're big fans of Zimbra's uncluttered and well designed web interface, which provides webmail, calendar, contact book and file sharing capabilities

The interface is split into separate tabs for mail, calendar, contacts, tasks, briefcase and preferences. The briefcase tab provides an online file store for each user, with the option of sharing folders with other users or groups on the system, and even allowing external users to view shared content. Most of the sharing controls are available via a context menu in the Briefcase itself and in individual user's preferences. The admin can enable and disable the feature on a global or per-user basis, however.

The Briefcase allows users to store and share files with colleagues and contacts

Zimbra uses standard POP3 and IMAPS mail protocols, so you can use any standard desktop or mobile client to access your email. However, there is no official mobile support at all for any of the other features of the system, such as your calendar, contacts or shared files. The Zimbra web interface admittedly scales well to mobile browsers, giving full access to your contracts, shared files and calendar. However, without proper support for syncing data with your mobile OS, push notifications or even official dedicated calendar and contacts apps, mobile integration is poor overall.

Zimbra works well with mobile browsers but a web-based calendar is no substitute for proper integration with your phone calendar and contact books

Although both the commercial and open source versions of Zimbra are popular alternatives to Microsoft Exchange, you can't actually access the open source version's calendar and contacts from Outlook at all. The paid-for version relies on an Outlook plugin to make its extended features function properly with Microsoft's email client.

Zimbra Open Source Edition provides support to desktop users only through their browser or Zimbra's own free desktop client for Windows, Mac OS X and Linux. The desktop client is basically a carbon copy of the web interface, with its layout and overall appearance duplicated almost exactly. The only notable difference is that users can't configure filters from the desktop client, and are instead directed to the web interface. All other functions and settings are available.

Note, however, that the open source edition of Zimbra does not support autodiscover, so admins will need to either set up the desktop client for their users or give them the login details and server connection settings they'll need to set up the desktop client themselves.

Zimbra's desktop client replicates almost all the user features of the web version, except filter creation

Conclusions

The Open Source Edition of Zimbra Collaboration Suite is an excellent web-based groupware system. However, both its lack of mobile device support for any feature beyond basic email and its meagre desktop support for popular email clients other than Outlook doesn't exactly mesh with its claim of being a complete, next generation messaging and collaboration system. Although its web client works remarkably well from most mobile browsers, the lack of true calendar syncing to smartphones means that missed appointments are always going to be a risk if you have staff who rely heavily on mobile synchronisation while on the road.

If you're looking for a glossy, open-source webmail and collaboration system that'll run on your own servers then Zimbra is a capable and easy-to-use option. However the lack of granularity when it comes to controlling which preferences users can and cannot modify is disappointing, and the absence of any autodiscover support can make the process of rolling out the desktop client time consuming unless your users can be trusted to do their own basic configuration.

Verdict

A good groupware system, but it's behind the times when it comes to mobile support

Server requirements

1.5GHz 64-bit processor

8GB of RAM

minimum 5GB disk space

Iceotope today announced a new technique of cooling servers, which it claims can make fans redundant and cooling costs non-existent.

The launch happened at this year's CeBIT conference in Hanover, Germany, with the company also saying the solution cuts 75 per cent of the mechanical costs associated with cooling servers.

Cost savings on the maintaining side might be plentiful, but the set-up price is no drop in the ocean

The product uses 3M's Novec liquid as a coolant, which Peter Hopton, founder and chief technology officer (CTO) of Iceotope, called the "environmentally friendly little brother" of Fluoroinert 3M's previous coolant incarnation.

A water jacket containing Novec wraps around components and travels through the servers in fast currents at a rate of centimetres per second. With its low surface tension, the coolant "gets into all the cracks" to absorb the heat from servers and take it away to heat exchanges, where the liquid can either be cooled or used to heat other buildings and water within the complex.

The technology can not be incorporated into existing servers, however, and businesses would have to buy new servers or modules as Iceotope refers to them to install the technology.

Cost savings on the maintaining side might be plentiful, but the set-up price is no drop in the ocean.

Customers can buy cabinets, featuring six server modules which look like blades as well as the pump and heat exchanges, for 19,995. However, the cabinets can house up to 48 modules, which start at 3,995 for fully configured servers containing two six core Xeon E5 processors, 64GB RAM, 40Gb Infiniband and SSD storage. Users are able to choose between AMD and Intel processors.

Hopton told IT Pro the technology could soon roll-out across the data centre, with products for switches, routers and GPUs in the pipeline. He defended the upfront prices though, saying the overall benefits would save a lot more money in the long term.

"No chiller equipment is needed so when you are kitting out a new data centre, you don't need to buy it," he said.

"It is not massively expensive and if you need new servers it is cost effective when you start to look at the money saved on energy consumption."

Although he couldn't confirm any UK customers yet, Hopton did say it was being implemented within UK data centres and the test company would be revealed soon.

EMC today launched VFCache, a flash caching module for servers announced last year under the Project Lightning moniker.

It marks another foray away from the storage array for EMC as it looks to bring its flash expertise to the server space.

Testing showed a three times throughput improvement and a 60 per cent dip in latency, the storage giant claimed.

If that means bringing storage to the compute makes sense, that's what we'll do. And that's kind of what we're doing with VFCache.

"This is a product that extends EMC's FAST technology into the server. It is a combination of hardware and software, the hardware being a PCIe card, which is a very exciting technology because if really changes the performance landscape it's even faster than flash inside a storage array," Barry Ader, EMC's senior director of storage product marketing, told IT Pro.

"We marry the hardware with some software intelligence that sits inside of the server, the operating environment, to determine exactly what data is hot and make sure we keep the hottest data in the server, closer to the application, closer to the CPU complex."

Data held in the cache is still pushed out to the storage array for added security, Ader said.

"This is a very nice complement to the VMAX and VMX storage devices," he added.

"VFCache will work with a variety of servers that are out there. We've qualified this with IBM, Dell, HP and our Cisco UCS partners. We have qualified VFCache with the majority of server vendors that are out there."

VFCache will either be sold to IT departments directly via EMC to line up with the vendor's storage products, or through channel partners, including server and storage companies.

The main competition for EMC in this area will be Fusion-io, which has been pushing out PCIe cards to the industry a few years ago.

"The difference here is that they [Fusion-io] went after the early adopters," Ader asaid. "They sold these cards as DAS [direct-attached storage] cards rather than cache devices. So that caused a lot of problems for their customers.

"Really mainstream customers weren't able to leverage this it didn't solve their scalability, shareability protection problems."

VFCache will also be getting deduplication technology added to it in the coming months.

Thunder coming

EMC also revealed plans for an entirely separate appliance, which will essentially do the same job as VFCache but considerably quicker.

"It's for those high-end use cases. A good example might be a high-end trading application... it might not be for the mainstream."

The first Thunder devices will be trialled with early adopters in the second quarter. Wider adoption will be opened up later in the year

EMC in server space?

Ader would not be drawn into saying whether this foray into the server space would mark EMC's eventual move into actually manufacturing servers.

"As our customers are looking for different ways to manage their information, of course EMC is going to look at these different ways that we can leverage technology like flash disrupting types of enabling technology.

"There are ways for EMC to enhance value to customers by not just going into the server space. That's not the intention. The intention here is, there are different ways to create value. In some cases that might mean bringing storage to the server.

"If that means bringing storage to the compute makes sense, that's what we'll do. And that's kind of what we're doing with VFCache."

Companies such as Cisco and HP are trying to pack more into servers, whether with networking or storage capabilities.

Dell, meanwhile, recently broke off its storage relationship with EMC, hinting it would be dallying in smarter servers with potentially greater storage integration.

A T-Mobile gaffe has led to claims the company was intercepting customers' secure email correspondence.

Customers had complained of not being able to send TLS-secured SMTP email over T-Mobile 3G.

One user noted in a forum in November that when connected to Wi-Fi, emails were sent instantaneously. Despite T-Mobile support teams attempting to solve the issue, the affected user continued having issues.

We have worked with our supplier to fix this issue and it has now been resolved.

T-Mobile has revealed a botched firmware upgrade was to blame.

"We would like to reassure our customers that we do not use our network to access the content of their emails nor are we doing anything that would jeopardise their data security," a T-Mobile spokesperson said.

"Following a firmware upgrade we were made aware of a fault by a small number of our customers in December. This fault was mistakenly preventing certain SMTP traffic. We have worked with our supplier to fix this issue and it has now been resolved. A small number of customers will have been affected by this error and we apologise for any inconvenience caused to them."

A T-Mobile spokesperson said the firmware upgrade took place in September.

T-Mobile blocks certain traffic, such as spam and blacklisted websites typically coming through unauthenticated SMTP. The vendor claimed it was attempting to continue blocking such traffic.

Nevertheless, the mistake was not fixed for between three to four months.

VPN issues?

Web developer and security researcher Mike Cardwell complained about the SMTP traffic blocking earlier this month, but also claimed he was unable to access his VPN via his phone.

"With the new SIM, no matter which port I configure OpenVPN on, the RST [reset] packets appear. IMAP over SSL on port 993 works fine, but if I switch that off and configure OpenVPN to listen on port 993, it is blocked," Cardwell said in a blog post.

"So the blocks aren't even port based. They've got some really low level deep packet inspection technology going on here."

However, T-Mobile said it had not seen any issues with VPN access.

"The majority of our customers are able to access VPN's providing the proposition they have bought has been set up in this way," the spokesperson added.

"Customers requiring VPN access can check with us before making a purchase, all details will also be included in the terms and conditions."

All customers who breach the fair use policy will be blocked for VPN usage, T-Mobile said.

As part of its newly-announced BBX platform, RIM will deliver a new version of the BlackBerry Server with a host of security-focused additions.

This includes features to simplify management of personal devices at work, bringing the BlackBerry Balance service to PlayBook and adding private enterprise app distribution.

With the consumerisation of IT, the conundrum is IT wanting to manage and the end user wanting to have one device that gives them access to all their experience.

Balance is included with BlackBerry 7 smartphones, allowing IT admins to encrypt, manage and delete company data on the phone without affecting personal content like photos. BBX will combine that with business app deployment through BlackBerry Enterprise Server.

"We're going to take Balance all the way down to the metal of the OS," said Alan Panezic, RIM's head of enterprise product development. "When you have a PlayBook with Balance and it's provisioned against a BlackBerry server, it gets a new secure area and any app pushed by the business is automatically stored there.

"With the consumerisation of IT, the conundrum is IT wanting to manage and the end user wanting to have one device that gives them access to all their experience. CIOs are saying I'm ok with that as long as I can be sure that data is protected.' Security and compliance is critical."

These enterprise apps will appear in a new tab in the PlayBook OS, labelled Work, and they'll support single sign-in with the user's existing corporate password. Employees won't have to use a password on the PlayBook itself (unless that's set by a separate policy), so they won't have to type in a corporate password until they open an enterprise app.

On the next version of the PlayBook OS, enterprises will also be able to provision their apps directly to the PlayBook through BlackBerry App World without having to upload their apps publicly. When the PlayBook is connected to a BlackBerry server that pushes apps to devices, a new Work section appears inside App World, showing only the enterprise apps they can install from the server. To the PlayBook user, they appear and install like any other application in App World.

This allows enterprises to virtualise the full Windows desktop or to package up and stream individual PC applications, using existing Citrix infrastructure. The Receiver interface is written in AIR and supports single sign-on, multitouch and multitasking, so users can run multiple virtualised apps or multiple remote desktop connections on the PlayBook, alongside other PlayBook apps.

Just over a year ago, Michael Dell didn't have the full confidence of his company's shareholders.

A quarter of them withheld voting for the founder's re-election, as Mr Dell received less support than any other executive re-elected to the board.

The central issue facing the chairman and CEO was over a US Securities and Exchange Commission (SEC) investigation into how Mr Dell and his firm failed to adequately disclose information to shareholders over payments from Intel. The chip maker effectively paid Dell to keep using its processors, rather than switch to AMD.

The payments from Intel made it seem as though Dell was meeting or surpassing results expectations, the SEC said. Without them, however, the company would not have done so once between May 2001 and January 2006, the regulatory body claimed.

Dell was told to pay $100 million as part of the settlement, whilst the company founder personally paid out $4 million. It was not a pretty end to a murky story.

The legal investigation was not Dell's only problem. Some were calling for fresh blood, for a chief who could take Dell into a new era of IT in the cloud and thinner clients, as the desktop market falls.

This all came just after three years of Michael Dell's return as CEO of the company he founded, having stepped down in 2004.

Like a nerdy kid hitting the gym in earnest, Dell has bulked up to become a full data centre solution company.

He has made some bold attempts to answer questions surrounding his ability to take Dell forward over the last year, however. He has re-envisioned his company, whilst keeping a firm grip on the client market, as others namely HP have chosen to move away.

Has the company-coined "new Dell" brought him back from the brink and secured his place as the leader of the business he created?

Welcome back

From the outside, it appears so. Dell has been a confident company of late.

Back in February, it posted some solid results, as its fourth quarter smashed Wall Street expectations. Many pointed to a Dell revival, as the company shifted into higher margin business, including a greater focus on servers, storage and services.

In August, the company again posted some decent figures as net income went up 63 per cent year-over-year. However, it reduced its revenue expectations for the year down to between one and five per cent. Yet it would be harsh to slam Dell for this mixed showing, given the entire market is being hit by reduced demand, added to the fact it is going through a major transitional period. We can forgive this faltering for now.

Highlighting its commitment to change, Dell has spent a penny or two. As part of its redefining of its business to focus on overall solutions, moving away from a hardware-centric model, Dell has bought a raft of companies.

The acquisition of Perot Systems for around $3.9 billion kicked off the spending spree in 2009, marking a notable moment in Dell's services commitment. Then came KACE Systems in 2010, providing hardware-based systems management appliances, followed by storage company Compellent, having missed out on 3PAR. Its latest move was to get hold of Force10 Networks to provide some prowess in the networking space. Like a nerdy kid hitting the gym in earnest, Dell has bulked up to become a full data centre solution company.

"Finally, some of the power brokers in Dell have accepted that pile them high, sell them cheap' has had its day, and the acquisitions Dell has been making are all aimed at moving it into a much more complex, full hardware stack sell, with the software coming from solid relationships, mainly with Microsoft, but also on the Linux side as well," said Clive Longbottom, founder of analyst firm Quocirca.

"I do believe he has now seen that Dell could not go on as it was. New blood has been brought in, new approaches are being brought to the fore, and Dell is looking stronger than it has done for a while."

Lingering issues

On the face of it, Mr Dell has helped create a new company ready for today's IT world. Yet significant stumbling blocks remain. Number one is the declining PC market and Dell's falling position within it.

During its inaugural Dell World conference in Austin last week, Lenovo became the number two PC seller, pushing the US firm down into third place. Given the PC industry is already in decline, the Texan firm will not want to fall from the upper echelons of the market.

Exacerbating things is Dell's performance in other client segments. In tablets, one of the causes of the PC market's contraction, Dell has failed to impress. Its lineup of Streak devices have performed poorly, with the Streak 5 model ditched earlier this year. It has plans for a global release of 10-inch consumer-focused tablets, but they have not emerged in the West yet.

Dell hasn't made much of a mark on the smartphone space either. Despite producing a quality phone with the Dell Venue Pro, its market share remains infinitesimal. According to Gartner, its not even in the top 10.

Michael Dell may have to face up to the reality it shouldn't bet on the consumer segment as much as it currently is. Cisco has proven how disastrous major gambles in the consumer sphere can be, especially if you don't have the relevant acumen or experience.

By turning his ship towards a cloudy horizon and building hardware for the entire stack, Dell is looking like a considerably more attractive proposition.

In tablets, Dell will have to create something with top-level design quality and some significant power, as well as a low-entry price point if it wants to have any chance at succeeding. Whilst it can certainly create quality hardware, offering low costs looks unlikely. For starters, it won't be able to rely on apps and software sales like Amazon can.

Furthermore, no matter how much Dell says smartphones are part of the end-to-end solution for businesses, it can't deny the devices are primarily targeted at consumers. When you think of smartphones though, you do not think of Dell.

Simply looking at the most recent results, which showed much of the positives were coming from the enterprise segment, it should be clear to Michael Dell that placing considerable emphasis on the consumer is a big risk.

Let's get positive

Yet Mr Dell has done well. By turning his ship towards a cloudy horizon and building hardware for the entire stack, Dell is looking like a considerably more attractive proposition for companies who want a full business package.

"As long as Dell retains focus and manages to keep fighting with its broadened arsenal of compute, storage, management, network hardware, brought through with professional services and being sold as a solution sell, rather than a portfolio sell, I believe that it will begin to take business away from a wounded HP, and could also chip away at IBM where some organisations see IBM as being too expensive and cumbersome to deal with," Longbottom told IT Pro.

Michael Dell's second reign as CEO won't be of Steve Jobs proportions. He will not turn Dell into a cult-inspiring, behemoth of a tech provider, but there is little doubt he has steered the business in the right direction. All he has to do now is keep firmly on course hopefully steering away from consumer clients - amidst turbulent seas.

As IT spending looks set to diminish over the next year, Dell will have to look to those markets it knows will provide it with solid income.

Fujitsu is currently celebrating the 10th anniversary of its ScanSnap document scanner range and the N1800 network scanner is the top of the range model. It's a compact device, slightly smaller than an entry-level personal laser printer, with just two buttons and a huge colour touchscreen almost as large as an iPad's. The comparison is apt: Fujitsu says that the 'intuitive' screen helps to make the N1800 easy to set up and operate.

The N1800 can integrate with your network's existing SMTP, fax and print servers, allowing users to email, fax or print material directly from the scanner.

It needs to be, as this is a complex device with lots of features. Scans can be saved directly to a network share, or you could set several up for various projects or departments and allow users to choose which to target. The N1800 can integrate with your network's existing SMTP, fax and print servers, allowing users to email, fax or print material directly from the scanner. There's also direct integration with SharePoint, and the ability to authenticate users with LDAP, but oddly not Active Directory.

Fujitsu makes much of the N1800's security features. Access is controlled by password-protected accounts that can restrict the features available to users. Scans are encrypted while being processed internally and are deleted as soon as they're saved or transmitted all this should make it impossible to analyse and intercept them. To this end, there's also no USB port or any other such interface. As an additional precaution, unused memory is overwritten each time the scanner is initialised.

While this is no production scanner, it's designed for reasonably active duty of 400-2,000 pages per day. The 50-sheet input and output trays should be enough for most everyday jobs, but the output tray in particular feels less robust than we'd like on this class of device. We're also unimpressed by the 127gsm maximum recommended paper weight, which rules out cardstock and even some heavy-duty inkjet papers.

As a stand-alone device the N1800 doesn't need a host PC. Instead it's set up by following a wizard on the resistive touchscreen, which in use turns out to be accurate and quick to respond. The setup wizard is fairly self-explanatory, but the complexity of the scanner means that if you intend to implement all of its features you could spend some time working them all out. The full operators' guide, supplied as a PDF, has more than 500 pages.

Administrators are catered for with a network scanner admin tool... it's possible to connect to any N1800 in the network and access all of its administrative functions.

Administrators are catered for with a network scanner admin tool, which is downloaded directly from the N1800 via a web interface that doesn't work properly in Chrome we had to switch to Internet Explorer. Using the tool, it's possible to connect to any N1800 in the network and access all of its administrative functions, during which time would-be users are locked out it's important to remember to logout when finished.

From a user's perspective, the N1800 is far more straightforward. Once authenticated, staff simply load up a document and use the touchscreen to select a scan destination from those that you've configured. Once a document has been captured, they can if they wish use the screen to review each page before accepting the result and sending it to the destination. Scans are acceptably fast, with a 10-page simplex job taking 47 seconds at 200dpi. A 20-side duplex scan combining a mix of colour and black and white originals took just under one and a half minutes to complete.

We were much more impressed by another feature which detects text that's been marked out with a highlighter pen and can add it as keywords in a searchable PDF.

While we like the touchscreen interface, it's likely that it contributes to slightly higher power consumption than we've measured in other scanners. While a peak consumption of 48 watts isn't anything to worry about, this only dropped to 37 watts when idle, and 15 watts when sleeping with the screen off. Those looking to minimise power use may want to configure a short sleep timeout and encourage their users to use the power button, which reduces consumption to a more palatable 3 watts.

Although limited to A4 originals, Fujitsu supplies a carrier sheet for scanning A3. Originals must be folded, but with the relevant options selected the N1800 will scan both sides and stitch them together into a single document. This failed on our first attempt, but worked after we rotated the original by 180 degrees and tried again. Even then, our stitched document had a grey band separating its two halves. We were much more impressed by another feature which detects text that's been marked out with a highlighter pen and can add it as keywords in a searchable PDF. Predictably this added a few seconds' processing time, but the results were accurate.

While the N1800's scans are good enough for general office use, we've seen better. Colours appeared a little undersaturated, while the distinction between dark shades had been lost in the darker regions of our test documents. Unusually, duplex scans suffered from bleed through of content from the opposite side of the page. We've not seen this before, although for fairness we should point out that the originals we tested had been printed onto comparatively thin 75gsm paper.

So what's our verdict?

Verdict

While the N1800 is full of useful features, administrators might initially find it tricky to master. Most users will find it easy to use, however, and in practice it's likely to cost less to buy and support than a document scanner attached to a host PC – particularly given that everything except paper jams and maintenance can be dealt with remotely. Deploying the N1800 can provide a low-fuss way to distribute scanning throughout the enterprise, but it's not perfect, and we wish it felt a little more robust.

A4 duplex network scanner Optical resolution: 600x600dpi 24-bit colour Scan speed: 20ppm/40ipm scan speed Power consumption Sleep 15W Standby 37W Scanning 48W Part code PA03609-B001

Microsoft may rule the roost when it comes to desktop operating systems, but Apple has been staging a strong fight back with the combination of OS X and its desirable hardware. Now, with the latest version of the Unix-based OS, 10.7 or Lion, we thought it was time to compare the two to see what they have to offer and find out which is best for business.

It's a little strange to compare the two operating systems directly, as Apple's OS can't be divorced from its hardware and you can't buy Lion separately to install instead of Windows 7. That said, if you're looking at changing the computers you've currently got you may be wondering if it's time to switch people over from Windows to OS X, or vice versa.

Licensing

Microsoft offers discounts for Volume Licensing for businesses, with a wide variety of different options. It can be a little tricky to navigate the confusing website to find out which package you need, but prices for Windows 7 Professional start at 123.53 per license for 20 PCs. These licenses aren't actually full versions, but upgrade versions of the OS, requiring that your existing PCs already have a licensed version of Windows already installed.

OS X Lion costs 21 per computer to upgrade.

By comparison, OS X Lion costs 21 per computer to upgrade, which sounds considerably cheaper. For companies purchasing Lion through Apple's Volume Licensing scheme, there is a minimum 20 seat order. However, OS X 10.7 Lion can only be upgraded from 10.6 Snow Leopard, which is itself a 26 upgrade. This means the actual price of Lion costs between 21 and 47 a computer depending on which version of OS X you have. There are no further discounts from Apple, and there's just the one version of OS X for consumers and businesses alike. It's fair to say that Mac hardware is more expensive than standard PC hardware, so you need to factor in this cost, too.

Installation

Installation of Windows is one of its strong points, particularly for businesses. With slipstreaming, it's possible to create new installation media that contains the latest updates, while Microsoft's own Automated Installation Kit tools let you create custom automatic install discs. For businesses, this is extremely important, as it means that getting the OS to install is no longer a pain-staking process. Once you've got your install disc set up, it's pretty easy from there on.

Lion is the first OS X update that is distributed exclusively through the App Store.

With OS X Lion, installation is a little bit trickier. Technically speaking, OS X Lion requires an OS X Snow Leopard installation, as it's distributed using the Mac App Store (or with a new computer), which was only introduced with Snow Leopard. In addition, the license agreement states that only Snow Leopard computers can be upgraded to Lion; if you don't have this version of the OS, you have to upgrade to Snow Leopard first.

There is a way round this, as once OS X Lion has been downloaded from the App Store, the image can be extracted and burnt to DVD. This DVD can then install Lion on any compatible Intel-based Mac with any version of the OS (apart from the new Sandy Bridge Mac Mini and MacBook Air models). For copies of Lion purchased through the Volume Licensing scheme, Lion can be deployed using a mass deployment/installation tool. Regardless of these short-cuts, you'll need to have a valid Snow Leopard license for the computer you're upgrading.

User Management

The one thing that's clear about Windows 7, and previous versions of Windows, is that it's designed to be used in corporate environments and managed centrally. Add a Windows 7 computer to a domain and the administrators can completely lock it down using the Group Policy Editor, centrally manage permissions to network resources and even remote install software.

If you want to lock down your client versions of Lion, you'll need the Server edition of 10.7 and its Profile Manager feature.

In its default state, domain users only have restricted use of the computer that prevents them from messing with settings and installing new applications. It's a reliable and rugged system that's been refined and developed over the years.

Windows allows for some flexibility in the way it works. Domain users can be added to the local administrators group of a PC. This way, a user can be given rights to their own computer, but prevented from logging on to another computer and changing settings and installing applications on that computer. With Windows Server 2008, updates to the OS can be downloaded centrally and distributed over the network, saving bandwidth in the process.

By comparison, while Apple computers can be added to a Windows domain, there's not the same level of control that you get with a Windows computer. Domain users can be restricted in what they can do, but security isn't as good as with Windows. So, a restricted user may not be able to install an app to the Applications folder, but they can usually just drag and drop an application package into a folder they do have access to - completely bypassing security.

OS X Lion Server can help improve the situation. It's a simple upgrade to an existing Lion computer that costs just 35 and gives administrators more control over the Apple computers connected to the network. Of key interest is the Profile Manager, which restricts what Apple users can and can't do on their computers. It's effectively the Mac equivalent of the Group Policy Manager and gives administrators that extra control that's missing. In other regards, OS X Lion Server is a little bit too simplistic for many environments, particularly as there's no rack-mountable hardware available. As a result, a large organisation may just want one or two Lion servers for Profile Manager.

User Interface

Both Windows 7 and OS X Lion are advanced operating systems with largely equivalent features, despite what either camp may have you believe. The differences between them will only matter depending on the tasks that you want to use your computer for.

Launchpad is Apple's attempt to make applications easier to find and open, but it's a bit too simplistic.

Both operating systems have fast searching built in. With Windows this is directly in the Start Menu - just click it and start searching to find files and applications. With OS X Lion, it uses Spotlight, which you can access by pressing Command+Space or clicking the Spotlight icon in the menu bar. Both search tools will also search through email messages and contacts.

The Start Menu has long been a strength of Windows, giving you quick access to all installed applications. With Windows 7, it's gone one step further, and supported applications, such as Office, now have sub-menus from their shortcut icons that give you access to recently accessed files.

OS X has always been comparatively poor in this regard, with applications sitting in the Applications folder although programs can also be launched using Spotlight. Apple has attempted to fix this with Launchpad in Lion, which brings an iOS-style apps home screen to OS X. We find it rather simplistic to use and it doesn't have any of the advanced features of the Windows 7 Start Menu, such as the recently accessed documents list. Recent files and folders can be viewed in the Finder and Go menus respectively, but this is system wide and not specific to an application.

Dock/Task Bar

Applications that you use a lot on OS X can be pinned into the Dock, which also doubles as a Task bar for running programs. It can be hidden out of view and the size reduced, magnifying just the part that your mouse hovers over. We like the way that file stacks can be added, giving you quick pop-up access to folders of your choice.

Jump Lists let you access an application's features quickly.

Windows 7's Task Bar is a more complicated version of this. Any app can be pinned to the Task Bar, giving you a quick shortcut to run it. Hover the mouse over any open application and you get a thumbnail view (Aero Preview) of every open window, which can make switching tasks easy. It's what you can do with the right-click and Jump Lists that's particularly impressive, though.

On any supported open or closed application, right-clicking an icon gives you a Jump List. This can include recently accessed documents, or access a program's features, such as starting an Incognito window in Chrome. Once you start using them, they're a valuable and fast way of interacting with applications and their extra features. Application icons in the OS X Dock can have contextual menus similar to Jump Lists, but few applications actually do.

Windows Management

One of Windows 7's strengths is its clever windows management and support for multiple monitors. With the latest graphics cards, you can even run up to six monitors from a single computer.

Aero Snap - Windows 7's windows management is fantastic and well suited to multiple monitors.

As Windows 7's applications have their title bars integrated into each window, working on multiple monitors is easy and natural; by comparison, with OS X Lion, each application's title bar appears on the main display. Working on a second monitor means frequent trips back to the primary display to access menus.

Windows 7 also has the advantage when it comes to managing open windows. Apple may have finally added the option to resize a window by dragging any side, rather than the bottom right, but Windows has had this for ages. In addition, in Windows 7 you can maximise a window to any monitor and use Aero Snap to resize windows automatically. Using the keyboard shortcuts or dragging a window to either side of the monitor you can make it fill half the screen; dragging to the top maximises it. The result is that it's easy to compare two windows side-by-side, which becomes extremely useful for some tasks, such as copying files from one window to another.

With OS X Lion, arranging windows is still a laborious manual job, although with Lion it's now possible to resize a window from any edge, rather than just the bottom-right corner. There is now the option for full-screen applications, but these work on just a single monitor and aren't as easy to manage as applications in Windows.

Task Switching

That said, for the most part OS X Lion doesn't require its window management to be as good as in Windows, as its task switching is far superior. With Mission Control (the replacement for Expose) you can quickly zoom out and view all of your open applications and windows, quickly switching between them. It makes Windows 7's antiquated task switching or poor Flip 3D look antiquated in comparison. We find it a little strange that Apple turns off Lion's App Expos switching by default, which lets you view just the windows belonging to the application you're currently using. It's easy enough to turn on and is brilliant, for example, for switching between two spreadsheets quickly.

Mission Control lets you switch between tasks easily.

OS X Lion's task switching comes into its own when you've got a touchpad, either on a laptop or on the desktop using the Magic Trackpad. Using multi-touch gestures you can access Mission Control, switch between full-screen applications and scroll without having to touch a scroll bar or reach for the keyboard. Once you get used to this, using a Windows 7 laptop where you don't have these features suddenly feels very old fashioned.

For Lion, Apple has changed the way that the Dashboard works. Rather than a screen overlay, Dashboard now sits as its own special full-screen application although you can revert to the overlay mode if you wish. It lets you add new widgets, such as for checking flight details and a calculator. It's a similar idea to Windows 7's Gadgets, although by housing them on a single screen, Apple's implementation looks a little neater. In practice, both systems are as easy to use - in Windows 7 pressing Windows+G brings all Gadgets to the foreground.

Desktop

OS X's Mission Control also gives you quick access to multiple virtual desktops. These can all have their own individual wallpaper and contain their own running applications. Having virtual desktops can help segment and organise different work tasks.

By default Windows 7 doesn't have this facility at all, although it's not hard to find a free application that gives you these features. Even so, even the best add-on isn't quite as smooth as having the option built in from the start.

Bundled apps

It's hard to beat Apple when it comes to bundled applications, particularly when it comes to work support. In particular, Mail, Address Book and iCal all work with Exchange servers natively; with Windows 7, you're forced into buying the full version of Outlook.

It's hard to beat Apple when it comes to bundled applications Mail, Address Book and iCal all work with Exchange servers natively.

It's important to note that Apple's clients only support Exchange Web Services (EWS), rather than the full ActiveSync protocol. This requires Exchange Server 2007 or newer to work. It's the same restriction that Microsoft has put on Outlook 2011 for Mac, as well.

There are ways round this, both for PC and Mac, with the free DavMail Gateway. This small utility lets you connect an IMAP email client via DavMail to the Exchange webmail interface to get your email. It also supports CalDAV and LDAP for calendars and address books respectively.

In other regards Apple is way ahead of Microsoft, with iPhoto and iMovie providing much better photo and video editing than the optional Windows Live Photo Gallery and Windows Live Movie Maker applications. However these apps are only bundled for free with new Macs they're separate purchases if you download Lion from the Mac App Store to upgrade older Macs.

Auto Save and Versioning

One of the best new features of OS X Lion is Auto Save. This automatically saves documents in compatible programs, and maintains versions that can be browsed in a Time Machine-style user interface. The only downside of the system is that an application has to support Auto Save and Versions. Sadly, Microsoft Office 2011 currently doesn't although it does have its own auto save function.

With Auto Save and Versions-enabled applications, Lion protects your files with ease.

Talking of Time Machine, Apple's backup software is surprisingly easy to configure and takes a complete image of a computer, along with every document and file. Windows 7 has its own backup tool, but the imaging and file backup components have to be configured and scheduled independently and manually. For Windows, it's more likely that you'd want to rely on network shares or a network-manageable application, such as Norton Ghost.

Resume

Apple completely changed the way that applications are handled now, automatically saving the last state used. After a reboot or shut-down applications restore to their exact last state complete with files and windows open as they were. It's a brilliant way to save on battery life and means that rare system restarts are less painful to deal with. Restarts can take a little while for all of the windows and applications to restart properly, but it's possible to turn off the feature using the Shutdown menu option, so you can quickly give your computer a clean restart. By comparison Windows 7's closest feature is Hibernate, which saves system state to hard disk, but isn't immune to reboots.

Backwards Compatibility

Microsoft has the clear upper-hand in terms of backwards compatibility for applications and has done so for a long time. In part, this is because it's evolved each version of Windows from compatible code and has had the safety of using the same hardware instruction set for years. As a OS that has traditionally been used in business, Microsoft knows the value of making sure that old software continues to run on its new operating system.

...and you'll never see Rosetta, or your PowerPC applications again, if you upgrade from Snow Leopard to Lion.

Many applications will simply run on Windows 7 in the same way they did previous versions of Windows. However, if that's not the case Windows 7, as with older versions of the operating system, has Compatibility settings that can be applied to any installed application. This lets you fool an application into thinking it's being run on an older version of Windows, down to Windows XP. It can even be used to reduce the number of screen colours, lower the screen resolution and disable advanced desktop animations and graphics.

Should any of these settings fail, Windows 7 has a trick up its sleeve with Windows XP Mode. This feature of Windows 7 Professional, Enterprise or Ultimate creates a special XP virtual machine that's pre-configured. The clever part about it is that any software installed in the virtual machine is automatically made available via the Windows 7 Start Menu. It's a simple and effective way for companies to upgrade and ensure that their old software will continue to work.

Unfortunately, backwards compatibility wasn't high on Apple's list for OS X Lion. In fairness to the company, in the last 10 years it has moved its OS codebase and switched from PowerPC to x86 processors, complicating the matter. Still, with Lion Apple isn't helping and has removed support for Rosetta, which allowed PowerPC apps to run on Intel hardware. Even more annoyingly, it did so silently without making any announcements informing existing OS X users who may still use many PowerPC programs which can't be upgraded for a variety of reasons.

For home users, this isn't likely to be much of an issue and there are bound to be new versions or replacements to old apps available. At work, it's a different situation, particularly if your company is relying on a bit of bespoke software. Unless you're willing to get this replaced or rewritten, upgrading to Lion will completely break any software that was written for PowerPC.

Virtualisation isn't necessarily going to help, either. While Apple changed the license agreement to allow virtual instances of Lion to be run, the same doesn't apply for Snow Leopard. Snow Leopard Server can be virtualised, but this is an extra step that will require a license upgrade for every computer.

The difficulty with Apple's decision is that new hardware will come pre-installed with Lion and can't be downgraded. If your business relies on older Mac hardware and software, moving to Lion could be a step too far.

So what's our verdict?

Verdict

It's very hard to pick a winner from the two operating systems, as both have their strengths and weaknesses. Apple's OS X is generally a bit easier to use, particularly on a desktop, but its support for multiple monitors and backwards compatibility is inelegant and clunky at best. OS X Lion is cheaper than Windows 7 per license, but Apple's hardware is more expensive. For that reason, Windows computers are generally a bit cheaper to buy. If you've got users that just need email, word processing and web browsing, Windows 7 computers are probably the best bet: they'll be cheaper, and the domain integration makes them easier to lock down. If you've got Mac-specific applications, OS X Lion is a great operating system, but make sure you get a Lion server on the network to help lock the machines down.

WINDOWS 7 Processor: 1GHz or faster 32-bit (x86) or 64-bit (x64) processor RAM: 1GB (32-bit) or 2GB (64-bit) Hard disk space: 16GB available (32-bit) or 20GB (64-bit) Graphics card: DirectX 9 compatible with WDDM 1.0 or higher driver BitLocker requires Trusted Platform Module (TPM) 1.2 Windows XP Mode requires an additional 1 GB of RAM and an additional 15 GB of available hard disk space. MAC OS X LION 10.7 Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7 or Xeon processor RAM: 2GB minimum Operating system: Mac OS X v10.6.6 or later (v10.6.8 recommended) Hard disk space: 7GB available

Server software isn't the first thing that comes to mind when you think about Apple, but it has a long history. In fact, Mac OS X Server 1.0 was released in 1999, almost a year before the public beta of the client version.

Since then, every release of OS X has had an equivalent server version, and every release has combined simple configuration with increasingly powerful, enterprise-ready features. It combines file sharing to Mac and Windows, email, web and Jabber-based IM services, as well as calendar and address book servers.

With Lion, though, Apple appears to be taking a break from this tradition. What it has produced is, instead, a server OS which is easier and faster to get up and running, but sacrifices some of the more advanced services which had been added to it over the years.

Installation

It's clear even before you have Lion Server installed that Apple has focused on making the process of getting up and running as streamlined as possible. Like its client sibling, Lion Server is only available as a download from the Mac App Store This means, of course, that you need to be running the Mac App Store, so an up-to-date version of Snow Leopard Client or Server is essential. Lion Server is in fact bought as a download that installs on top of the Lion client.

Lion Server is available exclusively as a download from the Mac App Store.

Unfortunately, this also means there is no supported way of installing Lion Server from a bootable DVD. You can, though, create a bootable external hard drive which you can install from.

Almost everything in Lion Server is configured through a single application, Server.

Set up reflects this focus, too. Even with a minimal amount of server admin knowledge, you can be up and running with a basic server configuration in minutes. Once up and running, almost all of the configuration is done through the new Server app, and most configuration options are extremely simple. The Wiki server's options, for example, consists of a single switch to turn it on, plus an option to limit which users can create wikis.

Profile Manager and iOS

For larger customers, the single biggest new feature in Lion Server is the Profile Manager. Essentially, this allows you to create configuration profiles for Macs and iOS devices and push them out automatically. These profiles include obvious features like VPN, networking and email settings but also group-based permissions for things like access to the Mac App Store and even access to external storage devices so, for example, you could remotely prevent Macs from accessing external hard drives or USB flash drives.

Profile Manager is a powerful way of remotely configuring both Macs and iOS clients, with configuration files pushed to machines.

Configuration is easy and fast, and the 'push' aspect is handled by Apple's tried and tested backend. The only caveat is that the Mac clients you're configuring need to be running Lion (Managed Preferences, the much-less-powerful equivalent from Snow Leopard server, is still included for configuring older machines).

Lion Server also includes additional services for iOS users, such as file sharing via WebDAV (configuration of which can be pushed direct to iOS devices) and push email, calendar and contacts, all of which is handled through Apple's Push Notification service.

You can easily set up share points which iOS clients can access through WebDAV, making it easier to share files to iPad and iPhone.

Missing in action

The drive to simplify Lion Server has had some less fortunate consequences, including the complete removal of some features. QuickTime Streaming Server, for example, is gone completely.

Perhaps more importantly, so is the Print Server, which is "replaced" by CUPS for printing. Yes, that means Lion Server has exactly the same support for shared printers as the client version of OS X. What you lose is the kind of enterprise-level print features which higher-end customers require, such as the ability to set quotas for individual users and prioritise printers in a pool.

Strangely, some features are still there but have had GUI access to them removed. For example, neither FTP nor NFS have any GUI-based configuration tools. Both still exist, but you need to configure them using the command line. MySQL has been replaced by PostgreSQL, but again it has to be configured through the command line.

Lion Server's Wiki server is an example of how Apple has simplified configuration options: there's virtually nothing to configure.

Other services have had their GUI-based configuration options limited, in some cases severely. The Web server is still industrial-strength Apache, for example, but like the Wiki server it's now little more than a switch to turn it on and off and optionally add support for PHP. Anything else requires the command line.

Small business? Enterprise?

For small business customers, the removal of these kinds of feature are unlikely to be noticed. And I think this illustrates exactly what Apple is attempting to do with Lion Server: create a robust, flexible server operating system that works out of the box for small businesses, taking away anything which might make configuration more complicated. Enterprise customers are expected to be able to handle more complex admin tasks via the command line.

For small business customers, the removal of these kinds of feature are unlikely to be noticed but occasionally it makes the life of enterprise admins more difficult.

This works for most things, but occasionally it makes the life of enterprise admins more difficult. For example, consider the simple process of accessing users' access rights to shares. You can't pick from a list of users; instead, you have to search for an individual user or group.

That's fine if you've only got a handful of users, but when you have over a thousand people with multiple nationalities, trying to ensure you've spelt a name correctly isn't easy. You might not know which group you need without scrolling though a list of them all. If your users and groups are in a third party directory such as Active Directory, you can browse the list of users and groups from within System Preferences - but not from within the Server app

Conclusions

Lion Server is a bit of a mixed bag. It remains an incredibly easy server operating system to set up, and the new Profile Manager is extremely powerful (if your installed base runs Lion, of course). But compared to its predecessor, some standard server management processes are actually harder to achieve, and there are elements which used to be catered for by a GUI but which you'll now need to go to the command line for.

compared to its predecessor, some standard server management processes are actually harder to achieve.

For enterprise users, particularly ones who have not upgraded their user base to Lion, there's little to recommend Lion Server over Snow Leopard unless you need Profile Manager. Although there are some nice new elements, more things have either been pushed back into CLI-land for configuration, or simply removed altogether.

These customers, of course, are also the ones most likely to be concerned about the lack of a rack-mounted server from Apple, and least persuaded by the options of using either Mac Minis or Mac Pros. Given, though, that Lion Server can live happily as part of an Active Directory, Windows-based server environment it's arguable that some Lion Servers could find a home even in the enterprise, simply for Profile Manager.

For small and medium business customers, Lion Server is more attractive, particularly for companies without full-time systems administrators who nevertheless need server capabilities. Buy a configured Mac Mini Server, and you can be up and running services for your users with an hour, with minimal configuration afterwards. You'll have something that, out of the box, is more capable than a simple Network Attached Storage device, and can be expanded a lot further too.

In some ways, I wonder if Lion Server isn't Apple trying the same trick that it pulled with Final Cut Pro X: ignoring its existing high-end user base, even taking features out, in order to build the foundations of something better.

So what's our verdict?

Verdict

For small medium businesses, Lion Server is a bargain-priced and easy to configure server operating system. For enterprises, it's not as clear cut given Apple's numerous odd design choices and lack of rack mountable hardware, but the Profile Manager alone may make it worth deploying a single Lion server in an otherwise Windows or Linux-dominated environment. Lion Server won't be suitable for everyone, but at this low price there's little to lose in trying it out for yourself.

Processor: 64-bit dual core Intel processor Memory: 2GB or greater Operating system: MacOS X 10.6.6 or later Hard disk: 7GB required for installation Broadband internet connection

Anonymous has announced its intention to target the Royal Bank of Scotland as part of an operation campaigning against "big oil."

The hacktivist group said Exxon Mobil, ConocoPhillips, Canadian Oil Sands and Imperial Oil were also in its sights.

Those companies have been involved in developing the Alberta, Canada oil sands, an operation which has caused controversy amongst environmentalists.

Anonymous did not go into any detail on what it would do as part of Operation Green Rights.

"Anonymous now joins the struggle against "Big Oil" in the heartland of the US. We stand in solidarity with any citizen willing to protest corporate abuse," the group said.

"Operation Green Rights will always support the rights of the people to live in an unpolluted world, and aim to help safeguard it for the future. One way or another."

Anonymous has also claimed a hit on international agricultural business Monsanto.

The hacktivist group said it had released addresses, emails and phone numbers of more than 2,500 Monsanto workers and affiliates.

"Anonymous didn't release details on types of systems, flaws or anything else that might explain how they acquired the stolen information. They claim to have taken down Monsanto web assets and mail servers," said Sophos senior security advisor Chester Wisniewski, in a blog post.

"Anonymous mentioned port 6666 being open on a Monsanto server, implying that they might set up an IRC channel on the compromised host. Anonymous also stated they intend to create a wiki for sharing and organising their stolen information."

Anonymous has claimed another significant strike on an official US body, posting over 90,000 email addresses purportedly of military personnel.

The hacktivist group said it had compromised a server of US Government contractor Booz Allen Hamilton.

"We infiltrated a server on their network that basically had no security measures in place," Anonymous said in a preamble to its release on The Pirate Bay.

"We were able to run our own application, which turned out to be a shell and began plundering some booty. Most shiny is probably a list of roughly 90,000 military emails and password hashes."

The hacking crew said it had stolen 4GB of source code, which it subsequently deleted from the server.

"Additionally we found some related datas on different servers we got access to after finding credentials in the Booz Allen System. We added anything which could be interesting," Anonymous added.

"And last but not least we found maps and keys for various other treasure chests buried on the islands of government agencies, federal contractors and shady whitehat companies. This material surely will keep our blackhat friends busy for a while."

Senior security advisor at Sophos Canada, Chester Wisniewski, said one big problem for Booz Allen Hamilton was that it stored passwords for the email addresses using only an SHA hash - a cryptographic hash function used as a standard for federal information processing in the US.

"The passwords are not salted, which will likely lead to the majority of the passwords being exposed," Wisniewski said in a blog post.

"While this should certainly be embarrassing to Booz Allen Hamilton, the real impact is on the US military. These 90,000+ individuals will need to reset their passwords, and ensure any systems that they shared these passwords with are changed."

On its Twitter feed, Booz Allen Hamilton said: "As part of @BoozAllen security policy, we generally do not comment on specific threats or actions taken against our systems."

After a request for comment, the company did not offer any more than the above tweet.

Most UTM products use one or more third-party components for essential tasks such as web content filtering, anti-spam or virus scanning but Websense's latest Triton Security Gateway Anywhere (TSGA) is completely home grown. It only uses technology which the company has either developed itself or acquired over the years.

TSGA benefits from Websense's innovative TruHybrid service which combines both on-premises and SaaS cloud services for web content and email scanning.

TSGA benefits from Websense's innovative TruHybrid service which combines both on-premises and SaaS cloud services for web content and email scanning. This allows businesses to deploy appliance-based scanning at the head office and use the SaaS component to extend the same levels of data security to branch offices and remote workers.

Competing products only offer either on-premises or cloud scanning and generally rely on third party vendors to provide these services. Uniquely, both TruHybrid components are managed from the same management console and can be configured using a single security policy.

TSGA has a wide range of options that can be purchased separately and the v10000 appliance on review runs everything on one platform. The appliance is based on a good quality Dell PowerEdge R610 server with enough grunt to handle all security services for up to 2,500 users.

To test the v10000 appliance we slotted it into the lab network which had Dell PowerEdge servers running Windows Server 2008 R2 domain and internal email services. Windows 7 clients were configured to use the appliance as their proxy and to test the email DLP (date leakage prevention) feature we added another server providing external mail services.

All management is via the intuitive Unified Security Center (USC) web interface which uses three separate tabs for the web, data and email components. Customisable dashboards are provided with each one showing details such as detected security risks, threats, viruses and so on.

Security policies for web access can be applied to a range of criteria including AD users and groups, IP address ranges and individual machines. Websense provides a remarkable choice of categories where you can block or allow certain keyword searches and file types as well as apply quotas that restrict browsing time.

Websense provides comprehensive lists of web categories and protocols which can be combined in the same security policy.

This section also includes a comprehensive range of protocol filters so the same policy can be used to control apps such as IM and P2P, file transfer tools and web mail. There's even a bandwidth optimiser that can be applied to individual web categories and protocols within a policy where they will be blocked if usage goes above a set percentage of bandwidth.

Default policies for inbound and outbound mail are ready to use and messages are subjected to a barrage of tests. TSGA scans the message body, runs heuristics and applies its LexiRule scanner which looks for specific word patterns. It'll also classify any URLs in the message and calculates a message fingerprint which it compares to its spam database.

The TruHybrid portion is easy to configure and for the web component you decide which locations, based on IP addresses and subnets, are to be filtered using the cloud service. Policies created locally can be applied to remote sites and workers and, as TSGA can identify their physical location, it can apply different policies based on whether they are on-site or off-site.

The data security module is designed to stop data leakage and works with both the web and mail components. It's fully compliant with data protection regulations and Websense includes over 4,000 predefined policies for standards including PCI-DSS, HIPAA and SoX. These are simple to apply as you merely choose the country of operations and it'll pick the most appropriate ones for your DLP policy.

DLP policies can include regulatory compliance checks where selecting the region activates the most appropriate standards.

Mail DLP policies can enforce message size limits, search for patterns or phrases in the message body and attachments and apply predefined dictionaries of terms unacceptable for business use. Confidential files can be protected by creating fingerprints and even if only a partial match is found TSGA can stop them from being sent.

We tested this by sending messages between our mail servers and were able to use policies to block Word attachments containing banned words and phrases. Even email image analysis is provided and we tested this by sending a selection of photos as attachments where all the dubious ones were successfully blocked.

We also tested general throughput using a Spirent Avalanche 290 appliance. With all scanning services enabled we saw Spirent report a sustained throughout of 2,000 HTTP transactions per second showing the appliance is quite capable of handling the demands of the intended user base.

The TSGA impressed us immensely during testing and is an ideal choice for companies that want to consolidate all their network security into a single platform. It has a superb range of security measures, TruHybrid makes it highly versatile and everything can be managed from a single, centralised web console.

So what's our verdict?

Verdict

Mid-sized business and enterprises looking for a single appliance to take care of all their network security needs will find Websense’s TSGA ideal as it combines a remarkable range of web, mail and data security features with excellent performance. Websense’s TruHybrid is compelling with both the on-premises and SaaS cloud services seamlessly integrated into the well designed central management console.

Chassis: 1U Dell PowerEdge R610 rack server CPU: Dual quad-core Xeons Memory: 24GB DDR3 Storage: 2 x mirrored 10K 300GB SAS SFF (data/logging), 2 x mirrored 146GB SAS SFF (cache) RAID: Dell PERC 6/i Network: 6 x Gigabit Ethernet Power: 2 x 270W redundant hot-plug power supplies Management: Web browser

The server market has seen its fifth consecutive quarter of revenue growth, according to research from IDC.

The analyst firm claimed revenues were up 12.1 per cent year on year, reaching a total of $11.9 billion (7.3 billion) for the first quarter of 2011.

Shipments also blossomed with a rise of 2.5 per cent to 1.9 million units. This was the second highest number of shipments ever recorded by IDC for a first quarter.

Midrange enterprise servers saw the most success, with revenues rocketing by 28.3 per cent compared to the same quarter last year. However, with high-end and volume servers both increasing revenues by 14.2 per cent and 8.7 per cent respectively, Q1 2011 was the first time in two years all three sectors grew simultaneously.

"Meaningful enterprise infrastructure refresh occurred across all geographies in the quarter," said Matt Eastwood, group vice president of enterprise platforms at IDC.

"Although the public sector weakened, worldwide demand for servers across hosters, SMBs and enterprise customers remained strong."

HP managed to keep hold of the top spot when it came to server sales by vendor. It held on to 31.5 per cent of market share and increased revenues by 10.8 per cent to $3.75 billion.

IBM showed the most impressive growth. The company's market share increased by 2.3 per cent to 29.2 per cent and revenues exploded, going up 22.1 per cent to almost $3.5 billion.

The majority of application delivery controllers (DLCs), or server load balancers, are priced way beyond the means of SMBs but Kemp Technologies is one of a growing number of vendors that aim to make this technology far more affordable. In this exclusive review we look at its latest LoadMaster 3600 which represents the higher end of a family of four general purpose appliances and with a price tag of 7,250, looks particularly good value.

The 3600 provides server load balancing, Layer 4/7 content switching, SSL acceleration for up to 5,000 transactions per second (TPS) and supports 1,000 physical and 1,000 virtual servers out of the box. It supports a number of deployment methods where a single-arm mode uses one network port with all physical and virtual servers on the same network subnet.

We opted for the two-arm mode which keeps physical and virtual servers separated on different subnets. The appliance has eight Gigabit Ethernet ports and for high availability you can use two appliances for failover purposes.

Initial installation is simple as you have three methods of access. The CLI (command line interface) can be accessed with a serial port connection, you can plug in a local monitor and keyboard or simply point a browser at the appliance's default IP address.

The 3600 adheres to the standard concepts for server load balancing as you create farms using multiple physical servers and assign these to virtual servers. For testing we used a VMware ESX Server 4 system to present multiple real' servers running web, FTP and mail services. Creating virtual servers was simple as we provided an IP address, port number and protocol and then assigned physical servers to them using their real IP addresses.

Kemp has seven load balancing schemes with the default round robin mode intercepting incoming requests and distributing them to each server in strict rotation. Weighted round robin mode allows priorities to be assigned to each server in the farm thus ensuring the better specified servers are kept the busiest.

Traffic distribution can be based on real servers with the least number of connections. Weightings can also be applied to further control which servers in the farm are used most. Weighted response time is a new scheduling method where the weights for each server are automatically adjusted based on their response times.

An agent can also be used to allow load balancing to adapt to server performance. The agent presents a numerical value between 1 and 100, which defines how busy the server is, to a LoadMaster query. The only drawback is that each real server must be running IIS, rather than an alternative such as Apache or even if it's not being used as a web server, as the LoadMaster expects a web page containing the value.

Kemp should look at adding load balancing features for VM-based server farms. In our sister title PC Pro we exclusively reviewed Coyote Point's Equalizer E250GX and were impressed with its VLB (virtualisation load balancing) feature which uses parameters such as VM availability and utilisation data to load balance.

For connection persistence the 3600 can use Layer 4 inspection which uses source and destination addresses to ensure traffic from a particular client is always sent to the same physical server. Kemp offers a good range of L7 connection persistence methods which includes cookies, session IDs and URLs along with rules for inspecting HTTP content.

Kemp provides a good range of L4 and L7 persistence controls to ensure users are handled by the same real server during their session.

For SSL acceleration the 3600 uses a Cavium Nitrox hardware accelerator card. Normally, the appliance decrypts SSL traffic and sends it to the internal servers in the clear to improve performance but another new feature allows traffic to be re-encrypted by the appliance before passing it on.

To test the appliance we created a virtual web server with three real servers assigned to it with round robin weighting applied. Using a client system on the external side we pointed a web browser at the virtual IP address and were rewarded with the standard web site we had configured on the real servers.

Paessler's Webserver Stress Tool and configured it to simulate 2,000 users each clicking on a web page every five seconds. With the load ramped up we could see from the LoadMaster's statistics page that all requests were being evenly distributed across the real servers and during this test Paessler detected no errors.

We also created a virtual FTP server using our three real servers each with an identical download folder containing 6GB of test data. We logged on to the virtual server from three different clients using the FileZilla utility and while downloading the test folder saw that each had been sent to a different real server.

Using the Kerio Connect mail software we also created a virtual server for web mail. Our clients were able to connect normally to the virtual server where they were presented with the standard secure login page and were none the wiser that they were being load balanced.

Other useful features include the option to cache static web content in RAM for faster responses and the ability to apply GZIP compression to HTTP objects. Basic intrusion prevention is also available as the appliance uses SNORT rules to check incoming web traffic and block anything malicious from reaching the real servers.

The 3600 can cache and compress web content and uses SNORT rules to provide intrusion prevention measures.

For the price, the LoadMaster 3600 is a well specified application delivery controller that beats Barracuda's Load Balancer 640 hands down on value. It's easy enough to deploy and offers an impressive selection of features for controlling load balancing and connection persistence.

So what's our verdict?

Verdict

The LoadMaster 3600 beats most of the competition at the value end of the server load balancing market as it offers an excellent range of features. A traffic throughput of 3.4Gbit/s and 5,000 TPS SSL acceleration rates are also exceptionally good at this price point. Our only gripe is the need for Kemp to address the use of VMs as physical servers and bring in some load balancing features specifically for these environments.

Chassis: 1U rack CPU: 2.67GHz Intel Core 2 Quad Q9400 Memory: 4GB DDR3 Storage: Transcend 512MB DOM Network: 8 x Gigabit Ethernet Other Ports: VGA, serial, 2 x USB2 SSL Acceleration: Cavium Nitrox PX CN1610 PCI Express card Power: 200W fixed supply Management: Web browser

Android may potentially pose a serious threat to the success of Apple's mobile devices, but we've still to see an Android smartphone that could compete on equal terms with the iPhone 4. At the risk of giving the game away before this review is even underway, however, the Samsung Galaxy S II might just be the model that can.

This smartphone is something special and that is apparent straight from the box. Its most striking feature is its thickness or lack of it. If not for a small bulge at the bottom end and around the rear camera lens, the Samsung Galaxy S II would measure a mere 8.7mm front to back and the slight 116g weight only adds to the allure.

Sadly, while Samsung clearly knows how to design a premium smartphone, it's yet to figure out how to make it and the all-plastic case feels cheap and slippery in the hand. Of particular concern was the flimsy back panel that has to be awkwardly prised off to get at the battery, SIM and microSD card slots, but this snaps back into place with such a snug fit that it's unlikely to cause a problem.

That said, we soon forgot about the preponderance of plastic when we switched on the Samsung Galaxy S II. The front is one vast expanse of Gorilla Glass screen that's 4.3in from corner to corner and the Super AMOLED Plus display beneath it is a marvel to behold. The Plus' denotes an improvement over the old PenTile Matrix technology used on the Samsung Galaxy S and other AMOLED phones. In short, this improved display technology uses a full complement of RGB sub-pixels to create a gloriously crisp, vibrant image, with pure whites and inky blacks.

The screen is so brilliant that we had to reduce the brightness to a very low level to avoid being dazzled.

A thin power button on the left of the case also provides quick access to various profiles (silent, flight mode, and so on) with a long press, while a volume rocker button sits on the opposite side. The only other mechanical button is the one below the screen that performs the same Home' function as in iOS and this is flanked by backlit, touch-sensitive spots for Back' and context-sensitive Menu' functions.

A 1.2GHz dual-core ARM processor with 1GB of RAM makes the Android 2.3.3 Gingerbread' operating system run very smoothly indeed. Everything from application animations to streaming video is very fluid. In terms of raw performance, the Samsung Galaxy S II scored 2977 in the Android Quadrant Standard benchmark, which makes it over twice as fast as the Nexus One. Performance with the SunSpider benchmark was similarly impressive at 3423.3ms, making it about 1.3 times faster at processing JavaScript in the web browser than the iPhone 4 with iOS 4.3.

The stock Android user interface hasn't been too heavily modified and the Home screen still consists of the usual set of sideways-scrolling desktops'. These can contain a mix of resizable widgets for at-a-glance information, along with shortcuts to everything from apps to contacts a degree of personalisation that just isn't possible in iOS. The ability to embed background-updating feeds for email, social networking services and news sites is also a very welcome feature and again, Apple has nothing even remotely similar. Samsung has tweaked the shortcut bar that runs along the bottom of all Home desktops though, and this does looks very iOS-like with its default set of four app shortcuts.

There's also a useful Kies Air app that turns the Galaxy II S into a mini server that can be accessed over a local Wi-Fi network. A Java-enabled PC web browser can then be used to manage various features and settings, such as the call and SMS logs, file system and contact list. This interface can also be used to upload music and videos, download photos and control media playback on the smartphone itself, which goes some way to make up for the lack an Android equivalent to iTunes, although the interface is nowhere near as sophisticated as Apple's application.

You can manage the contents of the Galaxy S II over WiFi using the Kies Air web interface

Kies Air is not meant as a mass deployment utility, but it is definitely handy for individual users in daily use. Motorola's Android phones have had a similar web interface, but Motorola's latest models have only just gained the ability to work over both USB and WiFi.

The Samsung Galaxy S II packs digital sensors for just about everything, but there's no near-field communication (NFC) chip for UK models a feature that oddly is present in the Google Nexus S which is manufactured by Samsung. The well-saturated and impressively detailed photos captured by the 8-megapixel camera are among the best we've seen from any smartphone. While we had some doubts about sound quality from the tiny rear-mounted speaker, speakerphone calls were loud and clear, even with the phone face-up on a desktop.

In terms of hardware alone and quibbles over the cheap feel aside the Samsung Galaxy S II is an extremely impressive smartphone and we have no hesitation in recommending it alongside the iPhone 4. When it comes to the bigger picture, however, Apple still has the edge when it comes to features such as a higher screen resolution and a broader selection of apps via iTunes. Its track record for timely operating system updates is far better than that of Google's hardware partners, but Android fans probably don't consider these to be serious issues. Frankly, after spending some quality time with the Samsung Galaxy S II, we're prepared to overlook them, too.

So what's our verdict?

Verdict

Although it would benefit from a build quality that befits its premium price, that’s the only real complaint we can level at the Samsung Galaxy S II. This is by far the best Android smartphone we’ve seen and anyone currently eyeing up an iPhone 4 should give it some very serious consideration.

Connectivity: GSM 850/900/1800/1900, 3G 850/900/1900/2100 Display: 480 x 800 pixels, 4.3 inches OS: Android 2.3.3 with TouchWiz Camera: eight megapixels rear facing, two megapixels forward facing GPS: A-GPS Processor: Samsung Exynos 1.2GHz Bluetooth: 3.0 Wi-Fi: 802.11 a/b/g/n Storage: 16GB internal RAM: 1GB Dimensions: 125.3 x 66.1 x 8.49mm Weight: 116g Battery: Lithium Ion 1650 mAh

With the sheer volume of Android 3.0 tablets coming out this year, Asus has done the smart thing with its Eee Pad Transformer and made it completely different to everything else. With its keyboard docking station, this is a tablet that can also be used as a netbook when you're on the move.

The really smart move Asus has made is keeping the price down

The really smart move Asus has made is keeping the price down, with the tablet and dock costing 358 excluding VAT. For a 16GB tablet and keyboard that's a remarkably low price - without the dock the Transformer is around 20 cheaper than the 16GB Wi-Fi only iPad 2.

Fortunately, the Eee Pad Transformer is only cheap in terms of price. Although the case is plastic and can't match the build quality of the all-aluminium iPad 2, the build quality is really good. It feels tough and the screen doesn't flex under pressure. We like the metal surround to the screen, as it gives it extra rigidity and protection. Using plastic also means that the weight is kept down, so the tablet alone weighs 680g, which is 80g heavier than the iPad 2.

We're pleased to see that Asus has used a 1,280x800 IPS panel for the touch screen. It has excellent viewing angles, as you'd expect, and produces rich and vibrant colours. We placed the tablet side-by-side to the iPad 2 and there's very little difference in terms of image quality. In many ways we prefer the Eee Pad Transformer's screen. Its higher resolution makes browsing websites more pleasant, as you can fit more on screen at once.

Inside, the Transformer is powered by a 1GHz dual-core Nvidia Tegra 2 chipset. Running the Quadrant Android benchmark, we got a score of 2,146, making this one of the fastest Android tablets we've seen. The SunSpider JavaScript benchmark completed in 1,878ms, which is slightly faster than the iPad 2.

iOS on the iPad 2 still feels like a more mature and complete operating system.

That's not to say that there's not a lot to like about Android 3.0. For tablet use it is miles ahead of the smartphone edition, making better use of the high resolution screen. We love the fact that you can put widgets on any of the five customisable home screens, giving you quick access to information from apps, such as your latest email and upcoming appointments.

With Android 3.0 Widgets are placed using a grid system that keeps the rough location of objects you place in both landscape and portrait mode. So, if you place your email Widget at the top right of the screen, it remains there in both orientations.

It's good to see that the Email and Gmail apps have both been overhauled. In landscape mode you get a list of emails and a preview window, making it quick work to go through all of your email. In portrait mode the list of emails disappears out of view when you're reading email, but it's easy enough to bring it back to select another message to look at.

As with Android 2.3, the Email app supports Exchange servers, complete with access to the Global Address List (GAL), appointments in your calendar and contact synchronisation. If your company uses Google Apps instead, the Gmail app is the one you'll use for messages, although contacts and calendar appointments are also synchronised.

Google has completely overhauled the browser, adding proper desktop-style tabs, a home button (this is hidden under bookmarks for some reason) and bookmark synchronisation with Chrome. With Flash support, you can browse pretty much every website. However, while we were testing we had the browser crash a couple of times, so work still needs to be done on stability.

All owners of an Asus Eee Pad Transformer automatically get one year's worth of unlimited WebStorage.

Asus has also installed some of its own apps on the tablet. All owners of an Asus Eee Pad Transformer automatically get one year's worth of unlimited WebStorage after which it costs 29 per year. This lets you synchronise data across all of your computers and the free storage space isn't limited to just your PC. On the Transfomer you access your files using the MyCloud app's My Content section. It's simple to use and lets you download files from your cloud storage or upload ones from your tablet. It works well enough, but aside from the year's free storage there's little reason to choose this in the long-term over other online storage services such as Dropbox, which also works with Macs unlike WebStorage.

MyCloud also lets you remote control your PC, provided you've installed the server software on it. Unfortunately, this software only works over a LAN at the moment, although an update for internet use is due to be released in the future. At the moment, then, another VNC remote control app or LogMeIn would be a better choice.

For working on the go, Polaris Office is included. This Microsoft Office compatible office suite has word processing, spreadsheet and presentation apps. It's not bad, if only because it can create and edit PowerPoint presentations, but it can be annoying and frustrating to use. For example, it uses its own gestures for copying and pasting which are not only inconsistent with other Android 3.0 apps but don't work well the keyboard dock accessory there aren't any keyboard shortcuts and you can't use the cursor keys to select text. We'd suggest using an alternative but there's a very limited selection of Android 3.0-optimised apps available at the moment.

We were pleased to see that a GPS receiver is installed, so you can use location-aware applications when you're out and about. If you need a data connection, you'll need to tether this tablet to your mobile phone using either its 802.11n Wi-Fi or Bluetooth adaptors, as a 3G version is not currently available.

It's the physical keyboard accessory that's likely to garner the most attention. For the most part, it's a really good add-on. It's the same size and weight as the tablet, so it effectively doubles the thickness and weight of your computer to 26mm deep and 1.32kg. As an entire unit it has similar dimensions and weight to that of a regular netbook.

The keyboard was really well made with a metal surface that offers a decent amount of protection. The tablet clicks into place and is held firm by a strong catch. It's good that the screen can fold flat like a regular netbook, as this protects the screen and makes it easier to carry around.

Oddly, when the Transformer is plugged into the keyboard dock, an onscreen warning appears informing you that you have to switch the layout for the onscreen keyboard from Google's default to Asus' own otherwise the hardware keyboard won't work properly in all apps. It would be far better if this happened automatically. There is another strange thing about using the onscreen keyboard with the Asus layout, rather than the regular Google layout. Asus' layout adds a row of numerical keys at the top of the QWERTY layout, which makes everything feel cramped when you have to use it. Fortunately, it's easy enough to switch back to the Google model when you're using the Transformer in tablet mode.

The keyboard dock has a secondary purpose to it: it has an additional battery.

The keyboard dock has a secondary purpose to it: it has an additional battery. With the tablet by itself we managed to get 8h 37m out of a single charge when playing a video; plugging in the dock gave us an additional 7h 6m. This combination is very similar to the total battery life we got from the iPad 2.

With the dock connected you also gain a full-size SD card slot and two USB ports. Both recognise connected storage and we could copy files to and from these devices using the pre-installed file manager. In this way the Transformer feels like a real computer that you can use for any job.

So what's our verdict?

Verdict

In terms of Android tablets, this is the best that you can currently buy and the keyboard dock gives it the edge if you want a device that you can really work on. That said, the iPad 2 is still that bit slicker and smoother to use. It also has a much wider selection of apps and also has a dock option, making it the better tablet. The iPad 2 also has better battery life – the Transformer can only match it when connected with the keyboard dock which also doubles its weight and adds bulk too. Nevertheless, if your tablet computing needs aren't met by the iPad and its more tightly controlled operating system, the Asus Eee Pad Transformer is the tablet to buy.

Connectivity: N/A Display: 1,280 x 800 pixels, 10.1in OS: Android 3.0 Honeycomb Camera: five megapixels rear-facing, 1.3 megapixels forward-facing GPS: non-assisted GPS Processor: 1GHz Nvidia Tegra 2 RAM: 1GB Bluetooth: v2.1 + EDR Wi-Fi: 802.11 b/g/n Storage: 16GB internal Ports: keyboard dock connector, mini HDMI Slots: microSD card Dimensions: 271 x 171 x 13 mm (WxDxH) Weight: 680g Battery: Lithium Polymer

RSA - the security arm of EMC - has admitted to having a number of its servers hacked, as data on its two-factor authentication product SecurID was compromised.

The firm warned the data could be used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

RSA executive chairman Art Coviello said the firm's security systems had been targeted by an "extremely sophisticated cyber attack."

It is believed the attack was in the Advanced Persistent Threat (APT) category, which may indicate a well-funded group of individuals were responsible.

APTs involve significant intelligence research and the use of numerous techniques to hack targets. They need serious investment to be carried out.

RSA is now in the process of informing customers about the dangers and how to strengthen SecurID implementations.

"We have no evidence that customer security related to other RSA products has been similarly impacted," Coviello said in an open letter to customers.

"We are also confident that no other EMC products were impacted by this attack. It is important to note that we do not believe that either customer or employee personally identifiable information was compromised as a result of this incident."

In an advice note to customers, RSA listed a number of recommendations for customers to follow, with the first point being to increase focus on security for social media applications and the use of them by anyone with access to critical networks.

RSA has a wide range of customers, ranging from high profile private companies to government bodies.

A sad day'

The breach will be damaging for RSA and it could take some time for the EMC division to recover, said SecurEnvoy co-founder Steve Watts.

Watts said it was a "sad day" to see a company with the reputation of RSA being hit by such a significant attack.

"Anyone with an RSA token doesn't know if they're going to be compromised. The industry is a bit concerned," Watts told IT PRO.

"This isn't just a bit of a marketing booboo, this is a major strategic issue. The problem is that it will take quite a long time to get over it."

If RSA has to initiate a recall of a large chunk of its tokens, then this would lump the firm with a costly logistical nightmare, Watts added.

"Is it going to be as extreme as changing every token that is sent out into the marketplace? Is it as far as to send out replacement tokens for every user? That's just beyond measure," Watts added.

Earlier this week, Jim Fulton, vice president at DigitalPersona, told IT PRO many companies were struggling with token deployments as it was.

"I've heard people say that if they could, they'd throw them underneath a lorry and crush them because they hate them so much," Fulton said.

After a tough few years for the server market, thanks to the recession hitting refresh budgets, Gartner has claimed things were looking much healthier for hardware.

In the analyst firm's latest quarterly tracker, server shipments rose 6.5 per cent year-on-year globally and worldwide revenue jumped an impressive 16.4 per cent.

These numbers boosted the yearly figures as well, with shipments rising 16.8 per cent for the 12 month period when compared to 2009. Revenues leapt by 13.2 per cent.

"2010 was a year that saw pent-up x86-based server demand produce some significant growth on a worldwide level," said Jeffrey Hewitt, Gartner's research vice president.

"The introduction of new processors from Intel and AMD towards the end of 2009 helped fuel a pretty significant replacement cycle of servers that had been maintained in place during the economic downturn in 2009."

Whilst the Europe, Middle East and Africa (EMEA) region showed good revenue growth of 10.4 per cent, it was notably behind North America's 24.5 per cent, Asia Pacific's 22.4 per cent and Latin America's 12.3 per cent. However, it did exceed Japan, the only region which showed a decline in revenue.

"The fourth quarter rounded off an encouraging year for the server market in EMEA with each quarter seeing positive year to year growth rates for both shipments and revenues," said Adrian O'Connell, research director at Gartner.

"EMEA was particularly badly hit by the downturn in 2009 and, although economic concerns continue across much of the region, the server market has shown good momentum during 2010."

IBM held the top spot for market share, rising to 35.5 per cent and raking in revenues of $5.2 billion (3.2 billion). This helped Big Blue edge further ahead of its nearest rival HP, which had a small drop in market share down to 30.4 per cent. However, it did still grow revenue by 12.8 per cent to $4.4 billion and remained the largest company by shipments.

At the other end of the scale, both Oracle and Fujitsu lost market share down to 5.5 and 3.8 per cent respectively as well as revenue. Fujitsu only fell by 0.5 per cent year on year, giving it revenue of $560 million, but Oracle plummeted 16.2 per cent to $805 million.

With cloud-based email, firms now have a way to tune their email costs to the actual needs of their workforce. The easiest way to get started is to host some mailboxes on-premises and others in the cloud. While firms with fewer than 15,000 employees can almost always save money by moving all mailboxes to the cloud, every firm can save money by moving their occasional users workers that can get away with a Web-based email client to a cloud-based email provider. How much money? For these occasional users, as much as $63 per user per year.

There are many ways to cut email costs. For example, you can upgrade to a newer version of Microsoft Exchange, Lotus Notes, Novell GroupWise, or Oracle Beehive and save money on servers, storage, and administrative costs. You can move email filtering to a cloud provider like Google Postini, Microsoft, or Symantec MessageLabs and save money on servers, staffing, bandwidth, and software. You can consolidate your email systems, thus reducing administration and support costs.2 You can deduplicate your attachments and save money on storage.3 And some organizations can also move mailboxes for some or all of the workforce to a cloud-based email service like Google Apps Premier Edition, hosted Exchange, Microsoft Exchange Online, or hosted Oracle Beehive.

Click the link below to read the full report.

Most security appliance vendors use proprietary hardware platforms which cannot be upgraded to cope with increased demand and will need to be completely replaced. UK-based Winfrasoft avoids this extra expense as all its Microsoft powered appliances are delivered as Tier-1 platforms that can be field upgraded.

On review is the Gateway Appliance 9500-DE which comes with Microsoft's Forefront TMG (Threat Management Gateway) 2010 loaded on a Dell PowerEdge R710 rack server . It has enough horsepower to manage a large number of users. As long as you use Dell certified hardware you can upgrade it without invalidating the warranty.

Whereas most competing vendors only have a one year RTB warranty, the 9500-DE comes as standard with three-year, on-site service from Dell. This can be upgraded to Silver or Gold support if you want a quicker response. The 9500-DE on review came supplied with Windows Server 2008 Standard 64-bit and TMG Workgroup Edition but it's powerful enough to run any of the five versions of TMG.

For installation you connect a local monitor, mouse and keyboard, fire up the appliance and follow Winfrasoft's wizard. This assists with setting up the four Gigabit Ethernet ports for LAN, WAN and DMZ duties and starts Winfrasoft's monitoring agent which manages software updates and remote support connections.

For ongoing management we left the appliance headless and managed it via RDP. The WAM (Winfrasoft Appliance Management) utility provides swift access to the main TMG console where you can run its own setup wizard. This provides four templates which cover all the main deployment methods and we chose the edge firewall option which uses two network ports.

The price includes Paragon's Drive Backup 10 Server Edition software for appliance backup and restore facilities. It runs scheduled file and image based backups and, along with file and disk recovery tools and supports bare metal system restores.

Standard features are extensive as TMG has Microsoft's ISA Server 2006 at its foundation which provides an inbound and outbound security gateway with IPsec VPNs, forward and reverse web proxies and web caching. TMG builds on these by adding an SPI firewall, HTTP and HTTPS inspection as standard and the NIS (network inspection system) which scans traffic for specific Microsoft exploits.

Wizards help create firewall policies which can contain multiple rules using source and destination networks or hosts, allow or deny actions, protocols and AD groups and users. We recommend deploying the TMG agent to clients as this configures the host's proxy settings and provides enhanced logging and HTTPS inspection notifications.

We did come across one issue although, to be fair, this isn't Winfrasoft's fault. Microsoft's TMG SP1 update screws up the reports so they appear to be blank. Winfrasoft provided us with a script fix from Microsoft but it advised this won't be fully sorted until early this year.

Another reporting problem is TMG still uses the Dailysum utility from ISA Server which can only run once a day so you can't see reports on current activity until the following day. We also discussed this with Winfrasoft which said it was currently looking at offering a third party reporting tool to improve on the features offered by TMG.

You can add anti-virus scanning and URL filtering to TMG but these are optional and require a separate subscription to Microsoft's Web Protection Service. Costs will depend on your current Microsoft support agreements, but we think they are well worth having.

A barrage of virus scanning engines is available as the subscription includes those from Kaspersky, Authentium, Norman, VirusBuster and Microsoft. These can be applied to inbound and outbound traffic and you can choose which ones you want active.

Optional anti-spam measures are supplied by Microsoft's ForeFront Protection for Exchange (FPE) which doesn't support third party mail servers. However, it snaps neatly into the TMG console and provides wizards to help with specifying Exchange servers and mail domains.

FPE applies a spam confidence level scoring system to email and offers three actions where you can delete, reject or quarantine messages. File attachment filters can be applied to inbound and outbound traffic and message bodies scanned for specific keywords and phrases.

With mainstream support for ISA Server 2006 ending less than a year from now, it makes sense for existing users of that product to think about upgrading to TMG 2010. However, this can't be done in place as the two products are not compatible with each other. The most cost effective method is to deploy TMG as an appliance rather than install it all yourself and the 9500-DE is a good choice for larger businesses. It comes with everything ready to go straight from the box, Winfrasofts extra software adds a lot of value and its quality hardware means you're not locked into a proprietary solution.

So what's our verdict?

Verdict

Businesses planning on deploying Microsoft’s Forefront TMG 2010 will find Winfrasoft’s appliances a far easier way of doing so than sourcing their own hardware and installing it all themselves. There are a lot of choices on the market, but the 9500-DE stands out with its classy hardware platform and superior warranty. Winfrasoft’s open-box policy means you can upgrade as required and the extra backup and VPN software makes it even better value.

Chassis: 2U rack CPU: 2 x Xeon E5640 2.66GHz Memory: 16GB RDIMM DDR3 Storage: 4 x 146GB 10K SAS hard disks in hot-swap carriers RAID: Dell PERC H700 with 512MB cache Array support: RAID-10 Expansion: 4 x PCI Express slots Network: 4 x embedded Gigabit Ethernet Power: 2 x hot-plug supplies Management: iDRAC6 Enterprise with 10/100 Software: Windows Server 2008 R2 Standard (64-bit), Forefront TMG 2010 Workgroup Edition, Paragon Drive Backup Server 10 and VPN-Q 2010 5-user

It's taken Microsoft a long time to get serious about its Internet Security and Acceleration (ISA) Server with the last update occurring in 2006 and comprising nothing more than a service pack. Its latest Forefront Threat Management Gateway (TMG) 2010 is its long awaited successor and Celestix' new MSA 3200i appliance delivers it ready to go out of the box.

Supplied to us by Wick Hill, the 3200i is one of a large family of MSA threat management gateways from Celestix and is aimed at businesses with 100 to 500 users. It has TMG Workgroup Edition installed but if you want load balancing, failover and centralised management of multiple appliances then the 3200b model is the one to go for as this has the Branch Edition loaded.

At its foundation TMG provides the same core features as ISA Server so you get an inbound and outbound security gateway, support for IPsec VPNs and forward and reverse web proxy services. A big difference is that TMG is 64-bit only, but it also offers a lot more security features than ISA Server ever did.

It comes as standard with an SPI firewall, HTTP/HTTPS traffic inspection and Microsoft's NIS (network inspection system) which scans traffic looking for Windows exploits. Options include web filtering and virus protection which are both activated with a subscription to Microsoft's Web Protection Service. Email security and anti-spam measures are also now available with the optional Forefront Protection for Exchange which doesn't support any third-party mail servers.

The appliance has Windows Server 2008 Standard 64-bit and TMG preloaded. For the quickest deployment we suggest connecting it to a network with DHCP services. If you want to assign a static IP address immediately you'll have to do this using the jog dial and LCD panel on front of the appliance.

You'll also need to use the dial and screen to create a base firewall rule to allow remote management access. We found the dial a pain to use for setting addresses but at least once we'd finished it could be locked down and secured with a PIN.

With a DHCP-enabled network, you can go straight to web browser management where you'll be greeted with the Celestix Comet interface. This has been designed specifically to remotely manage TMG and it starts with a wizard to help get you up and running.

You have four deployment options and we chose to position the appliance in the lab as an edge firewall. An advantage of having Windows Server on the appliance was it only took a few minutes to integrate it into our AD domain.

Firewall policies can be applied to AD groups and users which consist of source and destination networks or hosts, allow or deny actions and protocols. Wizards are also provided for securely publishing LAN resources such as Exchange web access, SharePoint sites or web servers. For the latter you also have an option for declaring server load balancers.

TMG's web security is vastly superior to ISA Server as malware inspection is carried out automatically whilst NIS uses a regularly updated signature database to watch out for known exploits. Web filtering gets a big boost as Microsoft now provides over seventy URL categories that can be blocked at the gateway.

We found the URL filtering worked very well with our test clients blocked from all manner of dubious sites including games and gambling. A new feature is an option to allow selected users to override a blocking rule. TMG's URL category query tool also proved very useful during testing.

The TMG reporting interface sees a modest redesign and the latest SP1 update brings in user activity reports so you can see what individuals have been up to and those that have used the rule override option. The reports can be very detailed and can be used to view traffic patterns, cache, protocol and application usage plus security alerts.

Basic real time monitoring is provided but we found it really annoying that no report on the current activity could be raised until the following day. TMG still uses the Dailysum utility from ISA Server which can only query the reporting database once a day.

Email security can begin once you've typed your Exchange servers and mail domains in to TMG and wizards are provided to create basic policies. This component snaps neatly into the TMG console and assigns SCL (spam confidence level) scores to suspect email.

Based on their SCL score, spam messages can be deleted, rejected or quarantined but no options are provided for tagging subjects and letting them through. TMG provides tough anti-virus measures as it uses scanning engines from Kaspersky, Authentium, Norman, VirusBuster and Microsoft.

Forefront TMG 2010 is a vast improvement over ISA Server as it provides a wealth of new features including web filtering, anti-malware, anti-virus and HTTPS inspection. Existing users of ISA Server would do well to upgrade but the change to a 64-bit operating system means they must do a clean install and migrate their settings to TMG.

The Celestix MSA 3200i looks a much more sensible choice as it has everything preinstalled and ready to run. It's also unlikely you'd save much cash by doing it yourself as you'll need to factor in TMG licensing costs plus the dedicated server hardware and underlying Server 2008 64-bit OS and, of course, your valuable time.

Verdict

It makes sense for existing users of ISA Server to move up to Forefront TMG 2010 as it has a wealth of new security measures. Our main issues are that TMG’s optional messaging security only supports Exchange and the separately licensed web filtering and anti-virus features will push the price up. Even so, the MSA 3200i takes all the hard work out of deploying TMG and will probably work out better value than trying to do it all yourself.

Chassis: 1U rack Processor: Intel Core 2 Duo Memory: 4GB DDR2 RAM Network: 6 x Gigabit Ethernet Storage: 1 x 320GB SATA hard disk Ports: VGA, 2 x USB2 Software: Windows Server 2008 Standard 64-bit, Microsoft Forefront TMG 2010 and Celestix Comet preloaded Options: Annual support from Wick Hill, from £419 ex VAT

Oracle has announced two new servers to add to the Netra line, continuing the work of Sun Microsystems.

The servers are designed for telecoms companies, ensuring they can deal with the accelerating growth of data in current times whilst claiming to provide essential high availability.

"The launch really shows and reinforces the continued and sustained investment Oracle is making into this line," Gordon Rawling, senior director of regional marketing, told IT PRO.

"Processing requirements continue to grow [and] it is imperative the network performs."

The first product is the Sun Netra CP3270 ATCA Server. The x86 blade server supports 32GB of memory through eight DIMM slots and claims to increase application performance whilst lowering power and cooling needs.

The second product is the Sun Netra X4270 Server. There is support for eight processors, doubling the number of threads from the previous generation, and 18 DIMM slots. Oracle again claimed the server reduced power and cooling requirements, in turn lowering the cost of running.

Customers of the Netra line have included BT, Vodafone and Nokia Siemens Networks, said Rawling.

Both servers are available from today.

AMD's launch of its Opteron 6100 processors throws the gauntlet down to Intel as it aims to remove the price barrier that has traditionally held SMBs back from moving up to 4-socket systems.

Intel's Xeon 7500 processors certainly deliver a host of features and a massive core count but as we've seen in our exclusive reviews of IBM's System x3850 X5 and Fujitsu's Primergy RX600 S5, their price point puts them way beyond the means of the majority of SMBs.

The R815 shares the same behavioural design concept offered by all the latest PowerEdge servers. The use of many similar components means that if your support staff know how to service one PowerEdge server then most components should be easily recognisable on all other models.

In fact, this server takes many features from the higher-end PowerEdge R810 which we exclusively reviewed in our sister title,PC Pro. It comprises the same 2U rack chassis where the front panel is split into two sections horizontally with the lower half providing a clear air flow through the chassis.

You have six hot-swap SFF disk bays in the upper half of the front panel and Dell offers a choice of SATA, SAS and SDD drives. The review system looks even better value as it included a quintet of 147GB 6Gb/sec SAS SFF hard disks plus Dell's PERC H700 RAID card.

Power redundancy is on the cards as the review system includes both 1023W hot-plug supplies. This is a key area of focus for AMD and the R815 delivered the goods in our power tests.

The Opteron 6174 processors in the review system have a low rating of 80W and our inline meter recorded 335W with Windows Server 2008 R2 Enterprise in idle. With all cores pushed to the limit by SiSoft Sandra we saw this peak at 618W.

AMD has the edge over Intel's 6500 and 7500 Xeons in the power department as a PowerEdge R810 with a pair of 2GHz X6550 Xeons and twice the memory pulled 392W in idle and 558W under peak load. Considering the R810 had 16 physical cores as opposed to 48 in the R815 the benefits of the Opteron are clear.

For virtualisation duties the R815 sports Dell's unique internal SD memory card controller. Dell set the ball rolling by being the first to provide an internal SD card for booting into a hypervisor but it's gone one step beyond as you now get two.

The controller keeps an onboard copy of the boot media in case it fails and the process is fully automated. We tested this by removing and reinserting the second card and saw the boot up process resynchronise its contents with the primary card.

More unique features are provided as the R815 sports Dell's Lifecycle Controller and its 1GB of NVRAM memory. This comes into its own for OS installation as we were able to boot the server into Dell's UEFI (unified extensible firmware interface) environment and deploy an OS without needing to use any boot media.

There's more as the iDRAC6 Enterprise management controller in the review system provides a dedicated network port and full remote access to the server. Dell also includes it Management Console software which provides automated discovery of all SNMP devices, inventory and system monitoring.

The R815 offers a completely toolfree internal design making for easy upgrades and maintenance. The motherboard has four banks of DIMM sockets and the front pair are accessed by releasing the hard disk bay and sliding it forward.

Cooling is handled by a row of six hot-swap fans in the centre of the chassis and the entire assembly can be removed after releasing clamps on each side. During testing we also found the R815 to be commendably quiet.

Expansion potential is very good as the server offers six PCI-e slots. You probably won't need them all as the R815 already has quad embedded Gigabit ports and the RAID card has its own dedicated slot as well.

In the extensive server benchtests we ran in PC Pro we saw that AMD's Opteron 6100 kept pace with Intel's new 5600 Xeon and at the lower end of the market can hold its own against the 6500 and 7500 Xeons as well.

Add in the fact that the PowerEdge R815 costs less than half that of an equivalent Xeon 7500 server and you have a serious candidate for SMBs looking to consolidate their older servers.

Verdict

As the first 4P Opteron 6100 server to market, Dell’s new PowerEdge R815 sets a high standard for the rest to follow. Compared with the latest Xeon 7500 systems, the R815 and its quartet of 12-Core Opterons makes for a far more cost-effective option for SMBs looking to consolidate older 1U and 2U servers or provide a highly expandable virtualisation platform.

Chassis: 2U rack CPU: 4 x 2.2GHz AMD 6174 12-core Opteron Memory: 64GB DDR3 1333MHz RDIMM expandable to 256GB Storage: Dual 1GB SD cards; 5 x 147GB Dell 10K.3 SFF 6Gb/s SAS hard disks in hot-swap carriers RAID: Dell PERC H700 with 512MB cache and BBU Array support: RAID0, 1, 10, 5, 50, 6 Expansion: 6 x PCI-e 2.0 Network: 4 x Gigabit Power: 2 x 1023W hot-plug supplies Management: iDRAC6 Enterprise with VFlash/SD Card and 10/100 port Software: Dell Management Console

HP has become the best selling brand when it comes to servers, knocking IBM off the top spot.

Over the last year, the company gained 2.7 per cent of market share, according to the latest report from Gartner, leaving it with 31.5 per cent overall and $3.4 billion of revenue from its server products.

Conversely IBM managed to lose 2.1 per cent market share and fell to second place with 28.4 per cent and just over $3 billion of revenue.

The overall server market performed well, with worldwide shipments rising by 23 per cent in just the first quarter of 2010 coupled with a six per cent improvement on revenues.

That said, things are still not quite back to the dizzy heights once experienced by manufacturers.

"We've seen a return to growth on a worldwide level, but the market has not yet returned to the historical quarterly highs that were posted in 2008," said Jeffrey Hewitt, research vice president at Gartner, in a statement.

The European market had a slightly smaller than average growth in shipments of 19.7 per cent but managed to secure a 6.6 per cent growth in revenues.

Adrian O'Connell, principal research analyst at Gartner, suggested that the market didn't have as far to climb as other areas in the first place.

"Although the EMEA server market is returning to growth in shipment and revenue terms, we need to recognise that this is growth from a low base, as the first quarter of 2009 saw a decline of 27.1 percent in shipments and a decline of 34.2 percent in revenue year over year," he said in a statement.

"Nevertheless, current market levels remain below those seen at the start of 2008, indicating that there is opportunity for stronger penetration in the EMEA server market."

Virtualisation leader VMware has announced a 35 per cent increase in first quarter revenue over the same period in 2009.

The company's strong performance was proof that "virtualisation is becoming a cornerstone for customer's IT strategy", said Paul Maritz, president and chief executive officer at VMware, in a statement.

VMware expects total revenues in the second quarter to rise to between $635 and $665 million (413-433 million), compared to the first quarter figure of $634 million, explained Mark Peek, the company's chief financial officer.

He noted that part of the increased income will derive from the acquisition of Zimbra, which provides open source server software for email and collaboration, as well as assets from EMC, the majority owner of VMware.

A number of positive signs are emerging from the virtualisation market, indicating it is part of the wider IT recovery.

An IDC report has shown that 17.7 per cent of all new servers shipped in Europe, the Middle East and Africa (EMEA) in the fourth quarter of 2009 were virtualised, an increase of 16.31 per cent from the year before.

HP took the top spot for EMEA, taking 50 per cent of the market share of new virtualised server shipments, with Dell in second place.

Despite these positive signs, Robert Epstein, head of small and medium-sized businesses (SMBs) at Microsoft UK, warned firms about some problems involved with the use of virtual machines.

"Virtualisation of servers has brought about new challenges for IT pros - security being one of them." Epstein told IT PRO.

"If deployed and started, the out-of-date virtual machine might be vulnerable to attack or could be capable of attacking other network resources," he added. "IT groups must take measures to ensure that offline virtual machines remain up-to-date and compliant."

Piracy is a complicated issue, though that's not often acknowledged by the sides arguing about online copyright and internet freedoms - which is a problem as the Digital Economy Bill makes its way though parliament.

Should illegal file sharers have broadband connections cut off? Or is that just bowing to big music companies? Is freedom more important that copyright protection?

Regardless of whether the bill is passed - and it may very well be rushed through before the looming election - the issue of copyright protection and piracy online will remain complicated for some time.

We asked readers of our biweekly newsletter for their thoughts - and like any group of people, the answers were pretty varied.

David said online freedom is worth protecting. "It would be a sad day if net freedom was scuppered in order to legistate against piracy. [The bill] needs [to be] more finely nuanced."

Daz said copyright needs to be protected, but not in the way the bill puts forward. "To begin with, the Digital Economy Bill is a bad joke being hurriedly put together by people who do not even understand the problem and issues concerned," he said.

"Yes copyright should be protected, but by who? Is it really a governmental issue? Seems to me it is more to do with pressure from the music and film industries, potential losses of tax revenue and pushing the blame on to the general public for downloading this material whether they are aware that it is supposed to be illegal or not," he added.

"It is all nonsense. The music and movie industry should do their own dirty work and not waste tax payers money by making it a government issue," Daz said. Artists may think differently...

Claire is an artist, and wants her work protected. "I find piracy of any copyright material, whether software, literature or art or music totally wrong and deserving punishment," she wrote.

"I do not feel 'stalked' by the police when I walk the streets so why should I feel the same when using the internet? If we are innocent then we have no need to fear I would have thought," she added.

Michael is also an artist, and while he wants protection, doesn't think the Government is doing much about it. "The copyright laws do indeed need amending, but a great deal of debate and the involvement of all those affected by copyright protection need to be consulted, my MP certainly has not asked me my views - perhaps he should, it's his job after all."

"Any bill that is rushed through Parliament inevitably needs to be revised... the Digital Economy Bill is no exception," he added.

Mark said it's time the internet had to consider laws in the real world. "The gold rush is over. We now need to put real laws in place and make the internet as law abiding as the real world."

What about business costs?

Colin is the director of a small ISP and worried about how the bill could affect his business. "How can we be held responsible for what our customers do with the connections which we bill them for when we have no practical means of monitoring or controlling usage?"

"As a small organisation, it is tough enough meeting current legal requirements for retention of email logs for the service we provide through our mail servers," he said. "We get the feeling that big Government really wants to drive us out of business along with all the other small providers of internet services. It's tough enough for us to survive anyway without such onerous requirements."

"If ISPs are to be held responsible for what passes over their networks why doesn't the same rule apply to the Post Office or all the parcel companies out there which probably carry even more illegal material?"

Microsoft released Exchange Server 2010 earlier this month, nearly three years after the appearance of Exchange 2007 in November 2006.

Exchange 2007 was a major upheaval for administrators, introducing 64-bit and breaking a previously near-monolithic product into several distinct pieces: a mailbox store, a Client Access server, and a Hub Transport server. The goal was scalability, but it also increased the complexity of the product and presented administrators with a tough learning curve.

The changes in Exchange 2010 are less radical. At least on the surface. The management console will look broadly familiar, and the same server roles exist. That said, there are some big changes underneath, once again aimed mainly at improving scalability and availability. In Exchange 2007, high availability was based on Windows failover clustering, which was complex and expensive.

Exchange 2010 has been re-engineered with a focus on mailbox databases, which can now be continuously replicated to one or more additional servers without needing a cluster. Even a two-server setup can make use of this effectively. A further benefit is that you can use cheaper storage, if you trust the new resilience features to fix things up in the event of a failure.

This right-click dialog lets you add a replicated mailbox for high availability.

Another feature of the new architecture is that you can move a mailbox between servers in the background, without loss of service. This is possible because the Client Access server now handles all client operations, whereas previously some clients talked directly to the mailbox store. Microsoft also claims to have optimised the Exchange database engine, called the Extensible Storage Engine (ESE), with more efficient schema and fewer input/output operations (IOPS).

For years Microsoft has muttered about migrating Exchange from ESE to SQL Server, but there is still no sign of this happening. "We have no plans on moving to SQL Server. We've continued to innovate on the extensible storage engine, what was known as JET. We feel that this is the best option for Exchange. Making the move to SQL Server would be a very large jump," product manager Ian Hameroff told IT PRO.

A post on the official Exchange blog confirms this and, as the comments to that show, users are divided over whether to stick with what is tried and trusted, or to get the consistency and better manageability that a move to SQL Server should offer.

Windows Server 2008, on a Windows domain with Active Directory to the level of at least Server 2003. We installed it on Server 2008 R2, and were impressed by the way the setup verifies all the prerequisites before proceeding with the installation. Unfortunately Exchange does not yet run on Server Core; it appears that the Exchange team has not yet managed to untangle all the dependencies.

Although we put all the server roles on one server for testing, this is not recommended for deployment. Microsoft suggests you have at least two, one for the Hub Transport, Mailbox and Client Access roles, and another for the internet-facing Edge Transport role, for security reasons.

The architectural changes are all very well, but are there any changes users will notice? There are a few. One is that Outlook Web Access (OWA), the browser-based access to Exchange, has been updated with new features and full support for Firefox and Safari as well as Internet Explorer. Enhancements include a side-by-side calendar view, conversation view for threaded messages (also surfaced in Outlook 2010), better searching and filtering, and text message support. The new Exchange Control Panel is a companion to OWA that gives access to a range of settings that previously required the full Outlook client.

Further, if you lose your mobile phone, you can initiate a remote device wipe from the browser. Microsoft is making browser-based Exchange more feasible as an alternative to Outlook, though it still lacks the speed and usability of Google's Gmail.

Setup is complex, but checking for prerequisites improves the chance of success.

Another area of focus is messaging policy and compliance. One aspect of this is personal archiving. In previous versions of Exchange and Outlook, archives live in local PST (Personal Store) databases where they are prone to getting lost, or spread over several machines. Exchange 2010 introduces server-side personal archives that are stored and moved with the primary mailbox. The downside is that more space is needed on the server, but alongside Microsoft's overall storage efforts in Exchange 2010, server-side archiving does make sense.

Pricing and licensing

On-premise Exchange follows the typical Microsoft model of server plus CALs (Client Access Licences). Although it is great value when bundled into Small Business Server (for which version 2010 is not yet available), the costs soon ramp up for larger organisations.

As Exchange 2010 requires Server 2008, so you need to purchase a server licence for both Windows and Exchange for every server instance, and at least two are recommended. Each user must have a Windows CAL and an Exchange CAL. In addition, the Outlook client must be purchased separately or as part of the Office suite. External users are licensed with a per-server External Connector.

Outlook Web Access now works as well in Firefox and Safari as in IE.

Microsoft offers Standard and Enterprise versions of both Exchange Server and its CALs, but these can be mixed and matched. The Enterprise Server is for scaling and resiliency, while Enterprise CALs enable additional features such as voicemail with Unified Messaging, custom retention policies, and information protection.

A further twist is that Information Rights Management comes with its own server and CAL requirements. The details are spelt out here, though for actual prices it is necessary to contact a Microsoft partner.

Verdict

Exchange 2010 is a relatively minor release for end users, but it delivers significant improvements in storage architecture and management that will please administrators. While Exchange 2010 is an excellent product, its complexity makes it best suited to large organisations or hosted services.

Operating system: Windows Server 2008 SP2 or Server 2008 R2 Active Directory: Windows Server 2003 or higher Mailbox databases: Standard edition 1-5; Enterprise Edition 6-100 Database storage limit: 16TB

MacRoberts is a Scottish legal firm that has British and international clients. It is a commercial law firm, dealing with business issues such as employment advice, litigation and corporate banking.

There was a large amount of pressure on MacRoberts when it came to email. It needed to follow compliance regulations, but it found it was easy to create information, but hard to keep control of it.

Also, spam had always been a problem for the company, which had used several different email solutions to control it in the past.

So last November, MacRoberts decided to start using a cloud-based email solution from Mimecast.

The spam controls were fine, but what MacRoberts IT manager Robert Crichton particularly liked was how the Mimecast cloud solution helped lawyers work efficiently outside of the office at a price that the company could afford.

"We don't have enough money to invest in hundreds of clustered exchange servers, so offloading that power to Mimecast is a big benefit to us," he said.

"I can offer these lawyers email access [outside of the office]. They can go home, review their emails of the day, send out mail from their own work email addresses and our clients are impressed that they work late at night," he said.

He added: "I can relax. I have 180 days worth of email stored. I don't have to worry if the office burns down tomorrow. They can [still] pick up the browser and send emails from MacRoberts."

Mimecast had recently upgraded, and Crichton said some of the new features were useful to MacRoberts, especially from a legal point of view.

Crichton said the firm was currently trialling features such as e-discovery' - the ability to very quickly respond to freedom of information requests, and export it in a form that was approved and suitable.

"It's very important to use that we have a tool to do that," he said. "We don't want it to be a burden to us. We want to pass that information out and quickly."

Previously, the company spent a lot of IT time in this area, to the extent that it might have had to restore backups and search archives to retrieve information.

"That's a pain if you have a small IT team," he said. "To divert their energies to boring jobs that would take a lot of time."

Other new functionality such as litigation hold' would also allow MacRoberts to bolt-in' retention policies, where it could keep emails as long as it was agreed with clients.

The Windows computer virus MyDoom first appeared on January 26th 2004, and very soon overtook a virus called SoBig as the fastest-spreading email worm ever.

Five years is a long time in the IT industry, and at the time botnets (a collection of software robots that ran autonomously and automatically) weren't really understood.

MyDoom was one of the first fast-spreading email viruses that created what we understand now as botnets, a resource which criminals can use to send out lots of spam.

Paul Wood, senior analyst at MessageLabs, said that at first it was difficult to find out how many computers were infected, because the impact on email systems was very dramatic.

He said that the MyDoom virus, when it spread, spoofed the "from" address, and in those days people hadn't configured their mail gateway in the same way that they have now.

"Your virus signatures identified an email that contained this malware, and would naturally send an email back to the recipient saying that they had just tried to send a virus," he said.

"That contributed to a huge volume of traffic because these spoofed email addresses would send it to people who hadn't sent an email originally, who were now being sent a copy of a virus."

The proportion of email traffic that contained malware before MyDoom was one in 130. As soon as the attack started this shot up to one in 12 at its peak.

Wood added: "The levels, even though they fluctuated, never really came to below one in 60 until early in 2006."

Between 2004 and 2005 there was a botnet war between criminals who wanted to take a stake in the new found botnet market. As such, MyDoom tried to take out other viruses and claim the botnet crown.

"We are still intercepting variants of MyDoom even today, but in relatively low numbers now," added Wood. "That may be due to computers that have not been cleaned up, and may never be cleaned up because of what they are and where they are."

It may have been formed as long ago as 1984 but eSoft only made a move into the UK security appliance market last year. It comes in with a solid range of products and a key differentiator is that eSoft doesn't rely on third party vendors to provide any security features as it has developed all its own solutions. This is clearly reflected in the price but don't be fooled into thinking they are less worthy as during testing we found them to be anything but.

In this exclusive review we take a closer look at the ThreatWall 250, which represents the entry point of this product line. The ThreatWall appliances are aimed at businesses that already have a firewall in place and want to add web content and mail security. If you want to go for the whole hog then check out eSoft's InstaGate appliances, which add firewalling and a few other interesting features to their security menu.

The 250 appliance offers a reasonable specification and with a price tag of 1,532 for the hardware looks comparatively good value. It can be customised to suit as eSoft offers two ThreatPak software upgrades with each costing a very reasonable 665 per year. The Web ThreatPak delivers web content filtering, protection from spyware and phishing sites, gateway anti-virus, IPS, anti-spyware and IM and P2P app controls. The Email ThreatPak deploys message content filtering, more virus scanning, anti-spam and mail quarantining.

The 250 can also function as a full mail server that can handle SMTP, POP3, IMAP and webmail. eSoft is offering this upgrade as an Exchange replacement and for a modest outlay of 266 per year it looks a cost effective and more manageable alternative for smaller businesses.

eSoft supports a number of deployment scenarios although if you want everything including intra-LAN traffic to be scanned you should use the transparent or bridged mode. Standalone node and routed modes are also supported but in these configuration the 250 can't scan mail being sent over the LAN between users unless their clients are reconfigured.

For testing we installed the appliance in transparent bridge mode, dropped it between our firewall and LAN and had it up and running in a few minutes. The appliance offers four Fast Ethernet ports comprising LAN and WAN along with a pair of optional ports and in transparent mode the two main ones are automatically bridged. All administration is via the well designed web interface and on first contact it runs a quick start wizard that registers with eSoft, contacts its SoftPak Director and downloads all updates and options that have been purchased.

With initial installation completed the web interface home page opens with the ThreatMonitor screen. This provides a useful overview of activity as it has a row of tabbed folders each offering plenty of graphical information about performance and activity. For web security you get a bar graph showing the total web traffic, pie charts for blocked and permitted web sites, lists of the top ten blocked sites and recent web site activity. From the mail tab you can easily see spam volumes and what is being quarantined.

Gateway anti-virus measures can be enabled for HTTP and FTP traffic plus inbound and outbound mail. HTTPS scanning is, unfortunately, conspicuous by its absence although eSoft advised us that it plans to add support for this soon. Intrusion prevention is a strong feature as you can declare specific mail and web servers plus operating systems and once completed the appliance will generate sets of protection rules and action policies for them.

To set up the mail filtering services you need to add details about your internal mail servers but we opted for the simpler transparent scanning process. There are plenty of options to play with here as the anti-spam features include a learning phase to improve eSoft's Bayesian filtering and you can create custom lists of content that you want to block or be notified about. You can manually train the filters to recognise spam as eSoft offers its SpamFilter add-in for Outlook so you can get your users in on the act enabling them to mark messages they want classified or declassified as spam.

The appliance applies a sophisticated scoring system for spam that can be customised to suit if required and it uses these to place suspect messages in one of three groups. Depending on their score you can forward them normally, reject or quarantine them or accept and delete them where the sender will be unaware that their message has been intercepted. To test eSoft's spam defences we left the appliance filtering live mail for a week in the lab and were very impressed with the results. During this period the 250 caught every genuine spam message and didn't generate any false positives either

You can start web filtering as soon as the appliance is deployed as it comes with a default security policy that has all URL categories activated. eSoft provides seventeen main category headings and underneath these there are over fifty sub-categories to play with. With authentication activated you can apply different policies to various users and groups and use time schedules to determine when they are active.

Further testing showed eSoft delivered the goods in this department as well. With the default policy in place we attempted to visit over one hundred games, gambling and social networking sites and were blocked from them all. It is advisable to make sure that the uncategorized' option is enabled as this picks up sites that don't fall into any of the other categories. With this disabled we found that of the sixty on-line bingo sites visited we got through to ten of them.

During testing we found the ThreatWall 250 a cinch to deploy and manage. The fact that eSoft doesn't use any third-party security measures is reflected in the very competitive price but don't think they will be less effective as we found anti-spam and web filtering performance to be very impressive.

Verdict

The content security measures employed by the ThreatWall 250 may be all home-grown by eSoft but they’ll give the competition a run for their money. This compact appliance is extremely easy to deploy and manage, offers an impressive range of security features for a very good price and delivers an impressive out-of-the-box performance.

Chassis: Desktop CPU: 1GHz VIA C7 Memory: 512MB 533MHz DDR2 Storage: 40GB IDE hard disk Network: 4 x Fast Ethernet Management: Web browser

Launched in September, GFI MailArchiver 6 for Exchange keeps an archive of all the messages that pass through a Microsoft Exchange mail system. As soon as messages arrive at the Exchange server they are added to the archive, and they can be retrieved from the archive regardless of what Outlook or Exchange has done with them. Once archived, messages cannot be altered or deleted, and archives are much easier to backup, perhaps as part of a disaster recovery plan.

Some firms archive mail to comply with industry regulations or because of best practice commitments to shareholders. Others do it to minimise the amount of storage needed on their Exchange Servers. Rather than storing archived messages within Exchange, MailArchiver puts them on local NTFS storage. And unlike Exchange, MailArchiver compresses emails and stores only one copy of a message, regardless of how many people received it.

Putting messages into a proper archive also means administrators can avoid relying on messages stored on desktop PCs using the famously troublesome Outlook PST files. One of the main attractions of MailArchiver is its Outlook connector, which enables users to view their archived messages from within their Outlook folder hierarchy.

Two versions of MailArchiver 6 are available, one for Microsoft Exchange 2000 and 2003, which uses 32-bit code. A 64-bit version is available for Exchange 2007 running on Windows Server 2008 hosts. Both versions are functionally identical.

One of the new features in version 6 is scalable role based deployment, which allows the various MailArchiver functions, or roles, to be run on separate servers. For example, one role downloads emails from Exchange, another places those emails into storage, and another indexes them so they can be searched quickly. While small and medium sized businesses could probably run all the roles on a single server, larger systems may work better if the various roles are distributed across several pieces of hardware. So for example, the web interface could go on one server, indexing on another, and storage on a third.

MailArchiver is licensed per mail-enabled user in the Active Directory whose mail is being archived, so there are no additional MailArchiver license fees for using multiple servers, or for mailboxes that are not archived. A tool synchronises the MailArchiver configuration between the various role servers.

MailArchiver can be run alongside Exchange on the same server, or on one or more separate servers. It comes with the open-source Firebird database, and GFI recommends small and medium sized installations store archive metadata here and store archived messages on an NTFS file system. For larger email systems, GFI suggests using Microsoft SQL Server for the archive metadata. Microsoft SQL Server could also be used to store the archived messages, which enables MailArchiver 6's new auditing feature. This keeps track of what users have done with emails, such as whether they were printed or forwarded.

MailArchiver is managed using a modern web-based front end, so the server running the front end role also needs Microsoft IIS world wide web service and the dot-Net Framework 2.0. MailArchiver also uses Active Directory, so it must run on a suitable domain controller, or be connected to one running elsewhere on the network.

We tested MailArchiver using a single server running Windows Server 2008 and Exchange 2007. To prepare the server for MailArchiver, we added the Web Server (IIS) role using the Windows Add Roles wizard, and added .Net Framework 3.0 using the Windows Add Features wizard. We also needed to add a journaling mailbox to the Exchange system, and like the other installation steps, this process was documented properly in the installation section of the MailArchiver manual.

The first time we ran the MailArchiver installation tool it warned us that we were missing Exchange Server MAPI Client and Collaboration Data Objects, and a link in the warning message took us to a Microsoft web page where we could download the missing component. The wizard did not ask us to restart the installation, but we did so anyway. Next the install wizard asked us which language to use for indexing emails, so we picked UK English. We were also asked for our license key and to specify the web site address to be used for the MailArchiver user interface. We took the default option, which was to use the default port 80 web site. If you don't have a license, MA can be run in evaluation mode for 15 days after installation.

With the suite installed we launched a browser on a desktop PC and connected to the MailArchiver user interface. All users access MailArchiver using the same URL, and once logged in users are presented with various options depending on whether they have administration rights over the MailArchiver system. Mailbox users get one top level hierarchy, called Conversations, while administrators also have Configuration and Auditing hierarchies. (see Gallery). MailArchiver must be used with Internet Explorer 5.5 or later.

Before MA started archiving emails, we needed to log in as an administrator and configure it to work with our Exchange server. This process was so easy we didn't even need to refer to the manual; we just took the "Mail Servers to Archive" option from the "Configuration" menu and filled in a few answers.

Next we logged into MailArchiver with the username of one of our ordinary mail accounts. A quick look at the "Conversations" menu showed that all the messages in our Exchange Mailbox databases had been archived, including those sent before we installed MailArchiver (see Gallery). However, Exchange administrators would need to import emails that were not stored in server mailboxes using one of several GFI tools. For example, one tool imports messages from a collection of PST files, while another is deployed to desktop systems to import emails stored in local PST files.

GFI has UK offices and guarantees a same day response to email and phone support enquiries.

Verdict

MailArchiver 6 for Exchange is a top class solution for archiving messages using low cost storage. A range of deployment options mean the suite can be tailored to small, medium or large scale organisations. Messages can easily be searched and retrieved from the archive using a web browser or a plugin for Microsoft Outlook.

CPU: Pentium 4 (or equivalent) - 2Ghz Memory: 512MB RAM (minimum). Recommended: 2GB RAM Storage: 2 GB of available physical disk space (NTFS) Management: Web browser

Enterprises have traditionally favoured point solutions for their network security as these are capable of delivering high levels of protection within their areas of expertise.

However, the high costs for support, management and maintenance are driving many towards UTM appliances as these can offer a complete range of security features in a more cost-effective an easily managed solution.

A major concern for larger businesses is performance as a single appliance handling all security functions has the potential to become a bottleneck. NetASQ aims to solve this with its latest U6000 which it claims as the first carrier grade UTM appliance with a maximum throughput of 5Gbps. Another bonus is NetASQ's licensing model as it provides support for unlimited users as standard.

The U6000 brings together NetASQ's firewall and IPS capabilities and serves them up with anti-virus, anti-spam and web content filtering services. Central to the appliance is the ASQ (advanced security qualification) engine which runs on a hardened FreeBSD kernel and uses three traffic inspection modes where it watches out for malicious content, employs behavioural and statistical analysis and uses twenty signature databases. ASQ is designed to reduce scanning overheads as it handles all firewall, NAT and VPN functions itself before passing it over to the mail and web proxies so reducing the number of processes required.

The hardware package for the U6000 is adequate as this 4U Supermicro rack system is equipped with a single 3GHz Xeon 5160 teamed up with 4GB of memory. The storage arrangement does look a little dated as the appliance comes with a pair of 73GB Seagate SCSI hard disks configured in a mirror. Power redundancy is also on the menu as the appliance is supplied with a pair of hot-plug supplies.

Network connectivity options are extensive as along with two embedded Gigabit ports, the price also includes a quad-port Gigabit card. The appliance can support up to 24 network interfaces and the wide range of spare expansion slots allows you to mix copper and fibre. As the appliance represents a single point of failure, HA is an essential feature and the U6000 supports active/passive configurations.

For deployment the U6000 can route traffic between selected network interfaces, function as a transparent bridge or use a combination of the two. Web browser access isn't available as management is carried out by NetASQ's own Unified Manager, Realtime Monitor and Event Reporter utilities. For the mail and web content filtering services, NetASQ uses transparent proxies. There are pros and cons here as no client configuration is necessary but for mail it can't perform quarantining. It can only tag the subject line of suspect messages so you'll need rules for handling these either on your mail server or at each mail client. HTTPS scanning is also conspicuous by its absence.

We opted for the transparent bridge mode for testing in the lab and found installation easy enough and aided further by a useful CD-ROM based wizard. The Unified Manager utility is well designed and provides easy access to all functions. Network interfaces need to be defined for LAN, WAN and DMZ duties and then you can create objects to represent network entities, services, users and hosts. User authentication is provided as the appliance supports LDAP and can use a wide range of methods including RADIUS servers.

Dedicated plug-ins are used for protocol analysis where packets are checked for conformity and these function at the kernel level to further improve performance. All the plug-ins are enabled by default and are set to auto-attach to traffic as determined by the engine's protocol detection. Policies bring firewall and IPS functions together and are available for traffic filtering, NAT, enforcing implicit rules and applying QoS.

You can create up to ten separate rules with different configurations and use schedules to decide when each one is active. Traffic filter policies are easy enough to create as you pick your interfaces, choose a protocol, assign source and destination objects and select an action.

Anti-spam services are handled by the Vade Retro engine which uses DNS blacklist analysis and heuristic analysis plus domain blacklist and whitelist filtering. To test this we hooked the appliance up in the lab and left it to filter live email for over a week with the clients dropping tagged messages into a separate folder. At the end of the test the U6000 delivers a high spam detection rate of 93 per cent with a low one per cent rate for false positives.

For web content filtering you get NetASQ's own URL lists as standard but in the review unit we had the optional Optenet upgrade. Performance was also impressive as we configured a rule to block access to all gambling sites, Googled for online bingo sites and watched the appliance only allow access to three sites out of 100 visited.

The RealTime Monitor tool provides a handy dashboard overview of the appliance and its status plus plenty of information about network activity, filtering policies, interfaces and users. The Event Reporter will also prove useful as it offers detailed reports on all areas of operations including services, filtering proxies and IPS plug-ins and the results can be exported to text, CSV, XML and HTML formats.

The U6000 looks a good all-in-one security solution and during testing we found it easy to deploy and manage and capable of delivering high out of the box scores for anti-spam and web content filtering. The hardware platform offers a reasonable specification with plenty of options for network port expansion although HTTPS filtering needs to be supported to make it a complete enterprise security package.

Verdict

NetASQ has always focused on UTM appliances and it shows as its firewall and IPS features are designed to have a minimum impact on network traffic. With no user limits on the license the U6000 offers good overall value and we found the anti-spam and web content filtering services performed well during testing. The only drawbacks are a lack of spam quarantining facilities and no support yet for filtering HTTPS traffic.

Chassis: 4U rack chassis CPU: 3GHz Xeon 5160 Memory: 4GB 667MHz DDR2 Storage: 2 x 73GB Seagate Cheetah 10K.7 Ultra320 SCSI hard disks RAID: Adaptec 2020ZCR Ultra320 SCSI with 64MB cache Network: 6 x Gigabit Ethernet Power: 2 x 800W hot-swap supplies Management: NetASQ Unified Manager, Realtime Monitor, Event Reporter

Half of companies are consolidating their email servers into a single data centre, but just one per cent are protecting these systems with redundant servers in case of disaster, according to new research.

The research, conducted by messaging analysis specialist Osterman Research, also discovered less that nearly three out of five organisations consider enabling continuous operations as an important or critical driver for adopting virtualisation.

"I was surprised to see that, despite a strong interest in virtualisation to enable cost and resource savings in the data centre, there wasn't more interest in virtualising messaging servers," Michael Osterman, president of Osterman Research told IT PRO.

This is despite the fact that messaging system reliability and uptime was a serious problem for one in five organisations questioned on behalf of the disaster recovery (DR) specialist vendor Neverfail.

Yet three out of four respondents did not see messaging as an important part of their virtualisation project. Osterman said this meant that they must look to alternative technologies to provide DR and business continuity in what is often a mission critical part of business operations.

"Companies have historically paid their email servers, for instance, less attention than other areas of the IT infrastructure," he continued. "And they often look to outsourcing to de-risk this area of the business. But for some organisations to whom owning the data is mission critical - including those that are heavily regulated, like pharmaceutical and financial services industries - that hasn't been an option."

He predicted a significant increase in uptake of messaging DR technologies in the next 12 to 18 months. "As they move to Microsoft Exchange 2007 or Lotus Domino 8, they may consider virtualisation as part of the overall lifecycle upgrade," he said.

The iPhone has finally arrived in the UK, but what is all the fuss about?

IT PRO is in the process of conducting a thorough review of a genuine UK iPhone running on O2, but in the meantime, we used an opportunity to play with a US iPhone running on AT&T to give you some insight into what you can expect from Apple's smartphone.

First up is the user interface, which is very different from Apple's previous iPod devices or from other touch screen PDAs currently on the market. It is an icon-driven interface, which probably compares more to Palm OS than Windows Mobile, but with a smooth and slick animated fade-in/fade-out loading and closing operation for applications. Also worth noting is that the iPhone does not use a stylus, the interface is built around large icons and on-screen buttons to allow for finger control. With that in mind, the touch screen is covered with optical grade glass rather than plastic, which is actually less susceptible to scratching than plastic.

The iPhone combines iPod audio and video playback functionality with a phone, two mega pixel camera, basic PDA functions and a handful of additional applications. We were pleasantly surprised to see that there are no games on the iPhone, and iPod games cannot be legitimately installed at this time.

The iPhone uses the GPRS-based Edge data system, rather than faster 3G. This is not a bad thing. Edge is pretty quick (I have been using an Edge-based Sidekick device for a year and can confirm that loading times are far faster than normal GPRS, but probably twice as slow as a good 3G connection), and is more than enough to sustain the iPhone's email client, web browser and other internet-reliant applications.

The mail client, along with the text messaging capability really push the limits of a touch screen device. However, the layout is clear, support for IMAP as well as POP3 email means it can interact comfortably with business mail servers as well as consumer mail services, and the on-screen keyboard works extremely well, despite the lack of a tactile keyboard experience.

A mixture of error correction and keys that enlarge as you press them keeps unforced typing errors to a minimum, and even my manly hands cope well, even through the iPhone is extremely narrow (61mm). BlackBerry users will find that migrating to the iPhone and its onscreen keyboard is not that traumatic.

For us, the strongest feature of the iPhone is its web browser. A useful by-product of using a striped-down build of Mac OS for the phone's operating system has allowed Apple's software engineers to shoehorn a full desktop version of the Safari web browser onto the phone, rather than have them develop a bespoke and less powerful mobile browser.

With a full mobile browser on-board, the phone can access normal web pages, and display them in their original form - the same way they would look on a desktop or laptop computer - rather than reformatting the page for a small display. Desktop browsing on a mobile device is again nothing new - various Symbian-based phones have been offering the same feature for some time now, while third party mobile browsers such as the one from Opera can also display a web page in its desktop form.

The difference with Safari on the iPhone is that it is faster than any Symbian device we have used, and compatibility with pages is higher. Pretty much anything that works with Safari on a Mac-based desktop or laptop will load and display quite happily on the iPhone. Simply tapping on the area you want to read causes the display to zoom in on that area and re-render the display to improve the on-screen clarity of the text and images. The page can also be dragged around the screen using a pressed finger, like moving a piece of paper around a desk.

The block on installing third party applications has, for the moment, put a block on adding additional browser plug-ins and add-on applications, but this is likely to change with the launch of a developer toolkit for the device.

Going to the phone, and call quality is good, and call management straightforward. Free-dialling using the on-screen keypad is simple and largely error-free, despite the lack of tactile feedback, while the integration with the address book is easy to access and allows for one-click dialling. The Address Book also lets you insert an image for a contact (as does the Mac OS desktop address book, which will transfer across to the iPhone), with the image popping up on screen when a known contact calls you.

Other applications pre-installed on the iPhone include a Google Maps client (which works extremely well, using a two-finger pinch motion on the screen to zoom in and out of a map), a YouTube client (again, very slick and provides a very easy way to navigate content on YouTube, but it is just as well that iPhone price plans come with unlimited data use) and of course the iPod functionality.

We won't dwell too long on the iPod side of the iPhone, but suffice to say the iPhone's audio and video playback functionality is completely different from a traditional iPod, with the circular click wheel interface gone and replaced with a commonplace left-to-right scrolling bar showing time elapsed and time remaining.

The big change is Coverflow, which has now been deployed as a general file and folder interface within Apple's new Leopard operating system. Again, using a finger dragging movement, users can literally flip through their albums. It is a very intuitive interface and is surprisingly easy to find and stop on the item you are looking for.

Video playback benefits from a widescreen display, and the ability to switch from portrait to landscape display simply by turning the device on its side (a tilt switch inside the iPhone detects movement and repositions the screen as needed.

In all, the iPhone appears to be a very good first attempt at a smartphone from Apple, and for that reason we are happy to give it six stars. Our full review will, however, give a clear view of what an iPhone is like to live with for more than a couple of days.

Mobile phone news, reviews, themes and downloads at Know Your Mobile

Verdict

Ahead of getting our hands on a genuine UK iPhone running on O2, we went stateside to have a brief look at a US model running on AT&T. On first impressions, Apple has struck gold, pulling together a compelling mix of easy-to-use applications and functionality, coupled with a touch screen interface and display that cannot be matched by anything currently on the market.

Dimensions

Height: 115 mm (4.5 inches)

Width: 61 mm (2.4 inches)

Depth: 11.6 mm (0.46 inch)

Weight: 135 grams (4.8 ounces)

Capacity

8GB flash drive

Display

3.5-inch (diagonal) widescreen multi-touch display

480-by-320-pixel resolution at 163 ppi

Support for display of multiple languages and characters simultaneously

On-board Operating system

OS X

GSM

Quad-band (850, 900, 1800, 1900MHz)

Wireless data

Wi-Fi (802.11b/g)

EDGE

Bluetooth 2.0+EDR

Camera

2.0 megapixels

Audio

Frequency response: 20Hz to 20,000Hz

Audio formats supported: AAC, Protected AAC, MP3, MP3 VBR, Audible (formats 1, 2 and 3), Apple Lossless, AIFF and WAV

Video

Video formats supported: H.264 video, up to 1.5 Mbps, 640 by 480 pixels, 30 frames per second, Low-Complexity version of the H.264 Baseline Profile with AAC-LC audio up to 160 Kbps, 48kHz, stereo audio in .m4v, .mp4 and .mov file formats; H.264 video, up to 768 Kbps, 320 by 240 pixels, 30 frames per second, Baseline Profile up to Level 1.3 with AAC-LC audio up to 160 Kbps, 48kHz, stereo audio in .m4v, .mp4 and .mov file formats; MPEG-4 video, up to 2.5 Mbps, 640 by 480 pixels, 30 frames per second, Simple Profile with AAC-LC audio up to 160 Kbps, 48kHz, stereo audio in .m4v, .mp4 and .mov file formats

Mac system requirements

Mac computer with USB 2.0 port

Mac OS X v10.4.10 or later

iTunes 7.5 or later

Windows system requirements

PC with USB 2.0 port

Windows Vista Home Premium, Business, Enterprise or Ultimate Edition; or Windows XP Home or Professional with Service Pack 2 or later

iTunes 7.5 or later

Power and battery (Manufacturer-supplied data)

Built-in rechargeable lithium ion battery

Talk time: Up to 8 hours

Standby time: Up to 250 hours

Internet use: Up to 6 hours

Video playback: Up to 7 hours

Audio playback: Up to 24 hours

Most of the attention given to rack mounted storage over the last year has been around the explosion in secondary storage - devices containing large capacity SATA drives. While some vendors have been happy to target these as primary storage, their large capacities and slower speeds are not well suited to high speed, transactional environments.

To address this market, EqualLogic has released the PS3800XV, the first in a range of Serial Attached SCSI (SAS) devices that are direct replacements for fibre channel SCSI arrays. The target market is those running databases, mail servers and even CAD systems.

The PS3800XV comes fully assembled. The chassis contains 16 x 15,000 rpm SAS drives each capable of holding 147GB and mounted in their own caddies. To power these drives there are two 450W hot plug power supplies.

Network and communications is handled through controller boards and the PS3800XV ships with two controllers, each of which has three gigabit Ethernet ports and a serial port.

There is a separate box containing accessories and inside here you will find serial and power cables. There is an anti-static band should you need to work inside the enclosure and rack mount kit with rails. Two documentation packs contain quick start kit, hardware guide and software.

What is missing is also of interest. EqualLogic see no need to ship a spare drive. This is because these are SAS and not SATA drives so they are less likely to fail. No network cables was a surprise.

Getting started was not quite as easy as expected. As the PS3800XV comes fully loaded it becomes a heavy box. In order to get it into the rack without risking any injury takes a little time.

Mounting the rails in the rack and onto the chassis was very easy. Before installing, however, we removed all of the drives. They slid out smoothly with no force needed. The drives have plenty of airflow around them so even though they are spinning at 15,000 rpm, any heat generated is easily dissipated.

We also removed the two PSUs to reduce the weight of the chassis and these slid out with no problems. Out of interest, we also removed the two controller cards which provided us with access to the Compact Flash cards that they use to store system settings.

Once this was done, the weight was very manageable and the chassis was quickly inserted into the rack.

Reinserting everything was quick and easy. Once all of this had been done, we connected the power leads attached the PS3800XV to the gigabit switch and fired up the array. Power-up took a little time as the drives seemed to spin up individually. This allowed up to see how much vibration there was as each drive was added and the unit was rock solid.

Connectivity to the network needs to be thought through. EqualLogic suggest two options. The first is to connect port zero on each controller card to the network switch. This is the minimum network configuration. For fault tolerance, you need to connect to multiple switches. Simply connecting all the ports to a single switch gains nothing.

Like all EqualLogic products, there is a quick way and a long way to initialise and configure an array. Previous EqualLogic products have required that the initial configuration was done through a DOS tool using a machine connected directly to the array. In a clear improvement, we were able to start with the GUI tool. The only time we went to the DOS tool was to completely reset the array before returning it to EqualLogic.

To get started, you insert the CD that comes with the array. It begins by preparing to install drivers by searching for any pre-installed components. One thing that it loads is the Microsoft iSCSI initiator. Strangely, even though the server used had been running an iSCSI array until just a few days before adding the PS3800XV, it still installed its own copy of the initiator.

The host integration program then installs the remote setup wizard, the auto-snapshot manager and finally the virtual disk service provider (VDSP). As a compliant Windows Server application, there is no need to reboot the server, even after adding the VDSP. The total space used to install these components is less than 5MB.

Once this is done you run the remote setup wizard which allows you to either locate new arrays or configure the machine to access a PS Series SAN. The wizard will find any arrays that have not been initialised and walk you through the initialisation. One of the options you get is to create a new storage group for this array or add the array into an existing storage group.

When creating a new group you need to setup accounts and passwords so that the Microsoft services can connect to the group. One of the things you will need to set is the RAID level for the arrays and here you have three choices, RAID 5, RAID 10 or RAID 50. You can change the RAID level later from RAID 10 or RAID 50 to RAID 5 or from RAID 10 to RAID 50.

Once set, the initialisation process is extremely fast, taking less than 10 minutes. After the array is initialised you can either launch the MS Storage Manager for SANs or connect to the array via a browser. The former is a Microsoft Management Console snap-in which is very easy to work with. The browser option is a Java utility. It can either be run as an applet in the browser or run as a standalone application.

After you are log in, the Group Manager window is displayed in summary mode. This displays a vast amount of information that takes some time to get to grips with. For anyone who has not worked with an EqualLogic array before, it is worth taking time to read through the help file and examine the various menus and reports.

Before creating volumes you need to complete the Group Configuration menu. One of the settings is to configure an NTP server entry for time synchronisation. If you are configuring multiple arrays for replication you should always use a time server to ensure accurate replication between the replicated partners.

Alerts and configuration data can be sent via email. However, there is a problem here. Most organisations require user accounts to login before sending email. EqualLogic does not provide a field for you to add the user password for this. As a result, you find yourself unable to send alerts via email. This is not an optional fix but something that EqualLogic needs to fix urgently. This does not affect information sent to a SYSLOG server however, so there is a solution for large organisations. Unfortunately a lot of medium sized organisations do not use a SYSLOG server and will need to find a workaround.

Under the Advanced options page, you configure snapshots and load balancing. Where the data is time sensitive and business critical, the snapshot option gives you the ability to protect against problems. Snapshots can be used as a halfway house for backup where the volume cannot be taken offline. Create a snapshot and then back that up. If the array is to be accessed by a large number of users, then you should consider using the load balancing feature.Only when you've finished the configuration should you start creating volumes. It might seem to make sense to create volumes first but if you want to use snapshots, for example, configuring the policy before attempting to create the volume ensures that you will only be able to create a volume whose snapshots can be properly supported.

The Create Volume utility is wizard driven and you set the size in either MB or GB. Once you have set the size of the volume and its parameters you will then have to wait for it to be created. This can take several hours depending on the size of the volume you are creating. This makes it preferably an overnight task.

At this point you are ready to start moving data onto your volumes.

Working with the Group Manager is actually quite fun once you've decided what you need to look at and where it is located.

Monitoring the behaviour and performance of a volume and array is essential. One of the key tools for any administrator is the log file. Every event is logged and you can configure the help file to always check the EqualLogic website for updated information.

When an event triggers an alarm, the Alarm panel, located at the bottom of the main Group Manager window will flash until you open the panel and examine the alarm. This quick visual indication of a problem is very helpful and better than relying on email and other notification methods.

The Group Monitoring menu allows you to see how a particular array group is behaving. From here you can see the configuration of all the components in a group, right down to each physical drive. This allows you to identify how each drive is doing and should you need to change a drive, you can see exactly where it is located.

The Performance Statistics monitor will give you detailed information on each drive, volume, storage pool and array. One of the problems of monitoring storage through the operating system is that storage arrays are presented as a single entity. This means that the monitoring tools cannot give you an accurate representation of what is happening with each drive or provide the necessary counters to identify problems below the volume level.

Not everyone uses Windows or wants to work through a GUI. For those who prefer to use the command line, EqualLogic provide a Command Line Interface (CLI) tool. This can be used under both Windows and Unix/Linux. With the next version of Windows Server (Longhorn) shipping with a non-GUI option, this means that EqualLogic does not have to rewrite their interface tools.

One of the advantages of a CLI is the ability to script common and frequent commands. Datacentres are becoming increasingly automated today so scripting is a big issue. To make life easier, EqualLogic has their own scripting language, EqualScript. It is based on the standard Perl scripting language and there are a number of modules and sample scripts provided by EqualLogic to get you started. For those working on Unix/Linux systems who probably use Perl already, this will enable them to automate management very quickly.

Earlier I mentioned the Compact Flash (CF) Card mounted on the Control Module. This holds the configuration information for the Control Module. Should a module fail, you can replace the module, put the old CF Card on the new module and be up and running immediately. No need to try and remember your previous configuration. This is a cool feature especially where arrays need to be kept running without downtime.

The ease of setup and management of the PS3800VX is outstanding and sets a benchmark for many of EqualLogic's competitors. Components are solid, move in and out easily and the cooling works very well indeed, something that is critical where 15,000 rpm drives are concerned.

The only downsides are the lack of a spare drive which every other storage vendor seems to supply, the lack of network cables and the problem with secure login for email. None of these are insurmountable and given the overall ease of use, it might seem churlish to highlight them. However, they are something that EqualLogic's competitors all do and it's hard to see how it would cause EqualLogic a problem.

There is no RAID 6 support but unlike arrays that use drives ranging from 500MB to 1TB, it is not required here.

At 28,300 this is not the cheapest 2.3TB you will every buy but don't forget that this is high speed, enterprise ready, SCSI replacement storage aimed at tier one applications. Other storage vendors are heavily focussed on the tier 2, high volume SATA market and this gives EqualLogic a clear advantage.

If you need mission critical storage to support transactional applications such as email and databases this is the solution for you.

Verdict

This is not the cheapest 2.3TB you will every buy but don't forget that this is high speed, enterprise ready, SCSI replacement storage aimed at tier one applications. However, if you need mission critical storage to support transactional applications such as email and databases this is the solution for you.

15,000 RPM, 146 GB SAS drives 16 drive chassis Dual controller modules, each with 64-bit dual core RISC processor Battery-backed and mirrored RAID cache Automatic RAID 5, RAID 10, and RAID 50 configuration Highly flexible, space-efficient volume snapshots Auto-capable volume replication Complete storage solution with heterogeneous OS support Automatic load balancing Scales without service disruption Fully interoperable with the entire PS Series product line 2.3 TB of raw capacity 60,000 IOPS and 300 MB/sec EqualLogic Multi-path I/O

This year sees Evesham Technology moving further into the enterprise server market and the launch of its SilverEDGE 5000HW platforms allow it to add high-performance Xeon MP systems to its portfolio.

Evesham has always been a big fan of Intel so the 5000HW 6U on review is the latter's Server System SR6850 HW4 package. It's aiming these at typical environments demanding a high processing performance such as medium to large mail servers, high-demand SQL applications and render farm environments and also systems consolidation and expansion using virtual servers.

We've watched Intel's white-box solutions gradually getting ever more sophisticated and this system doesn't let the side down as it delivers a healthy combination of processing power, storage capacity and expansion potential. The 6U chassis is extremely well-built but it's certainly no lightweight and it would have been useful for some carrying handles to be fitted such as those found on HP's larger rack servers.

The 5000HW puts its height to good use as it provides two cages at the front with room for five 3.5in hard disks apiece. Good design extends inside as with the lid removed you'll find a tidy interior awaits. The Intel SE8501HW4 motherboard occupies most of the internal real estate and has the four Xeon MP sockets mounted at the front where they can take advantage of a bank of six hot-swap cooling fans.

The price includes a full house of 7140M Xeon MP processors which run at 3.4GHz, have an 800MHz FSB and sport a whopping 16MB of L3 cache. However, it's worth noting that the E8501 chipset only supports older 400MHz DDR2 memory and despite a wholesale move by Intel to its Core technology the processors still utilize the older NetBurst architecture and will almost certainly be the last to do so. The first Xeon MP processor to use Core technology will be the quad-core Tigerton which is expected to arrive on the launch-pad very soon. Rated at 150W the Xeon MP isn't very green either. Using a Pro-Elec power meter we saw the server drawing 533W in idle and with SiSoft Sandra pushing the processors to 100 per cent utilisation this peaked at a very uncomfortable 780W.

The motherboard offers a single SATA/150 interface and an embedded LSI Logic dual channel Ultra320 chip with ties in with Intel's embedded RAID controller. However, for high performance applications SAS is fast becoming the interface of choice with SCSI now likely to start fading away as SAS gains acceptance. Fortunately, Intel has addressed this by fitting a SAS backplane to the chassis and teaming it up with an Intel PCI-e RAID controller card.

System memory is implemented on four separate hot-plug modules which mate with the motherboard via dedicated 16X PCI-e slots. Each has four DIMM sockets and this arrangement takes full advantage of the mirroring and memory RAID feature offered by the E8501 chipset. You can designate one bank of memory as a spare and with an even number of modules with identical memory capacities you can implement mirroring. If all four modules are populated with matching memory configurations you can go for the memory RAID feature which creates system memory partitions for full redundancy even in the event of a complete module failure. Each module has status LEDs on the top panel and the power button on each one facilitates hot removal and hot-add.

Typical applications this server is aimed at demand 100 per cent uptime and along with the memory redundancy the 5000HW offers plenty of other fault tolerant features. You get a good choice of PCI-X and PCI-e slots and five of these are the hot-plug variety. Power comes into this equation as well and the price includes a pair of mighty 1570W hot-plug supplies.

HP still holds all the cards for remote server management and monitoring as its integrated iLO2 chip and ProLiant Essentials Foundation Pack software offer an unbeatable partnership. Nevertheless, Intel has been working hard on its act and now bundles its Active System Console and LANDesk System Manager. The former provides a smartly designed web interface with full monitoring of areas such as temperatures, voltages, fan speeds, hard disk space and CPU status. The LANDesk software takes management up a notch as it can monitor multiple servers from a single core server. This allows you to keep an eye on environmental values of all systems from a central location and you can create alerting tasks to warn of any problems. It requires an agent installed on each system but with this in place you can closely monitor performance, collect historical data and maintain detailed hardware inventories.

You also get Intel's remote management module which provides a dedicated network port allowing the server to be remotely controlled irrespective of its condition. Management is via a secure web browser session which provides a tidy interface offering access to functions such as sensor monitoring and power control where you can switch the server off, cycle power or reboot it. Full remote control is provided where you can access the BIOS menu and control the resident OS.

No doubt the biggest competition to the 5000HW comes from HP's ProLiant DL580 G4 where its smaller 4U chassis offers a more modular design that allows the processors and four memory modules to be accessed from the front panel. Storage potential isn't as good as the DL580 supports up to eight lower capacity 2.5in SAS and SATA drives. Furthermore, whereas the 5000HW offers five hot-plug expansion slots as standard the DL580 requires an optional mezzanine card for this. Evesham also scores highly in the value stakes as most of the competition will be hard pushed to deliver such a highly specified Xeon MP server at this low price point.

Verdict

Evesham delivers a well designed and solidly built Xeon MP server with masses of expansion potential and fault tolerance that competes strongly on price with HP's ProLiant DL580.

6U Intel Server System SR6850 HW4 4 x 3.4GHz dual-core Xeon MP 7140 with 1MB L2 cache per core 800MHz FSB Intel E8501 chipset 8GB 400MHz DDR2 SDRAM expandable to 64GB LSI Logic 53C1030 dual channel Ultra320 SCSI chipset Intel SAS18E SAS RAID controller with 512MB cache memory Supports RAID0, 1, 5, 10, 50 and JBODs 5 x 73.5GB Fujitsu SAS hard disks in hot-swap carriers 2 x Broadcom Gigabit Ethernet 10/100BaseTX management port 1 x hot-plug PCI-e 8X 3 x hot-plug PCI-e 4X, 1 x hot-plug 133MHz PCI-X, 2 x 100MHz PCI-X Dual 1570W hot-plug redundant power supplies Intel RMM Intel System Management Software 1.5 bundled

Security experts have noted a new trend in spamming that involves surges of spam sent to individual domains to knock email servers offline, according to a new report.

The findings of the MessageLabs Intelligence Report noted the appearance of sudden spam surges, or "spam spikes". These spikes were also designed to defeat anti-spam appliances that use signatures to weed out unsolicited email.

According to the report, one such attack on a domain lasted 11 hours and 10,000 junk emails was sent by spammers to the domain's email servers.

The report also noted that image spam is changing. Rather than embedding images in the message body of a spam email, spammers are now hosting the image on a number of picture hosting websites that don't require any form of registration to upload image files.

A link to the spam image is then included in the body of the message, either as a link that will display the message when clicked, or included as an HTML image.

According to information gathered by the company, the group that launched this recent attack was also the same group responsible for abusing Imageshack, a popular image hosting site. MessageLabs said that it is difficult for traditional anti-spam methods to guard against these forms of attack.

Experts said that spammers have continued attacks by developing new tactics to "fly under the radar and cause the most damage."

"With the increase in spam spikes and new techniques with image spam, it is crucial for businesses to take a multi-layered security approach among email, web and IM to protect their employees and their systems completely from these malicious attacks," said Mark Sunner, Chief Security Analyst, MessageLabs.

The research found that spam has in fact decreased 3.4 per cent from last month. Spam accounted for 72.7 per cent of all email. Viruses accounted for one in 118 emails, according to figures from the company.

GFI EventsManager 7.0 is an event log management solution from security and messaging software company GFi. EventsManager is designed to capture events from a variety of sources around your network and pull then into one place.

We downloaded the software and manuals and were sent a key by GFi. If you want, you can also buy it as boxed software. The installation guide is easy to work with but doesn't tell you in the requirements that you need an account with Domain Administrator privileges. This is left until you get to the relevant screen shot. The user manual is well written and covers all the features.

EventsManager requires SQL Server to be installed in order to work. We did point it at MySQL but it wasn't interested. This seems to limit EventsManager to those sites who only have SQL Server. GFi does not provide a copy of MSDE with your license which would at least allow people to evaluate before making the additional purchase of SQL Server.

Initial installation is simple enough. You will need to have a Domain Administrator account available for EventsManager to use. We would recommend careful thought about where you create that account. If you have already split your users up into business units then you will want to put the GFi account with the main administrator accounts.

The software can be installed onto a server or a desktop. We did both and found that putting it on a virtual server was a simple way of ensuring that everyone had access when required. As it will be pulling information from a variety of log files and servers, putting it close to those that generate the most traffic makes sense. The same is true of the database instance.

Once you have completed the installation there is no need to reboot the computer, just launch the application. Before you can do anything, you will need to go through a series of configuration steps. EventsManager does not automatically detect your SQL server installation and you will need to know the name of the server you are going to add it to. This was the same even when the database server was on the same machine that EventsManager was installed onto. It will create its own database once it knows the name of the server.

There is an option to Configure Administrator Account. This is supposed to be optional but if not done, you get a warning flag. The account name that EventsManager suggests is EventsManagerAdministrator and this is the person who will be contacted in an emergency. Most companies would simply put in the details of the administrator without creating yet another user account. After all, you have already created a domain administrator level account under which it runs so another account seems crazy.Most email servers require you to log in before sending. GFi has realised this and unlike a lot of vendors, has provided the mechanism for you to configure email authentication.

Once all of this is done you can finally begin configuring Event Sources. GFi pulls information from a wide range of sources and allows you to group devices together. You get a predefined set of groups such as workstations, servers, laptops and infrastructure servers. You can create your own groups on top of this but this is a manual process. It would be nice to simply take the AD and start by importing a list of groups from there that could then be further divided. You cannot create nested groups so the more granular you want the groups, the more larger the list becomes.

If you can see multiple domains then you don't have to rely on the trusts to access them. You can add the computers and then provide EventsManager with a set of credentials to access that computer. For organisations that maintain multiple domains for security and don't want a single account accessing everything, this is a useful option.Within just minutes of adding a range of computers and forcing a scan you will have so many entries that it becomes impossible to work with them. This is where the event processing rules come into their own. GFi has provided a lot of starter rules under different categories and you can extend them yourself. Each rule can be given a weighting and is then used in the reporting system.

All of the information gathered in stored in SQL Server and GFi provide instructions on using the free Express Edition of SQL Server. This should be done only if you have a very small set of machines that you are monitoring under strict conditions. The problem is that any effective monitoring should gather all the alerts and log files without throwing stuff away. With just three servers, one desktop machine and a notebook, it took less than 24 hours before we had 6Mb of data. Might not sound like much but scale that up to a busy network with over 500 computers and the amount of raw data gathered over a month could easily reach several gigabytes. You will need to think about how you partition up non critical from critical data and how you archive the logs and alerts.

One thing that GFi has missed is the ability to use the data transformation and analysis tools within SQL Server. There is no guidance or plug-in that would allow you to start building data cubes to track infrequent or seemingly random events and locate patterns of attack. With all of the data being gathered, this seems like a missed opportunity.

There is a reports pack but rather than provide it with the product, GFi sells it as an add-on. This is unfortunate as it just gives the impression of an unfinished product. You can download the free trial version but it is difficult to see why GFi would not have provided a set of good reports as standard with the option of adding more later. Instead, most companies are likely to look at using SQL Server Reporting Services to organise their data.

Verdict

Very nice package with clear business benefits. However, only targeting SQL Server and not providing reports prevents it from becoming a "must-have" in the support centre.

. NET framework 2.0. Microsoft Data Access Components (MDAC) 2.6 or later Access to MSDE / SQL Server 2000 or later

The Nexsan Assureon is marketed as a storage security product and oddly enough, that's just what it is. Another way of looking at it, is as a Content Addressable Storage (CAS) disaster recovery solution. The Assureon uses multiple servers and storage devices and can be located in multiple sites for wide area replication.

The Assureon is not a piecemeal solution. Before it is shipped to site, it is built to order by Nexsan and requires a lot of pre-planning between both the customer and Nexsan field engineers. There are several versions, depending on the complexity and storage requirements of the customer but the basic components consist of servers, storage appliances, a 25u or 45u rack to hold everything and some software.

The servers in the Assureon are Dell PowerEdge 2950's. These are 1u servers with a pair of Intel Xeon 3.06GHz dual core processors; 2GB RAM and up to four local Serial Attached SCSI (SAS) hard disks. The number of servers that you have depends on your preferred configuration and this is determined by performance and resilience. In a typical evaluation system, Nexsan would ship just a single server. In a production environment the minimum recommended configuration becomes two servers, one for the front-end (user facing) one for the back-end (data-facing).

The storage units are normally Nexsan SATABoy devices, each holding up to 7TB of storage although you could use the Nexsan SATABeast which supports 21TB of storage in a single enclosure. Each Assureon contains two separate storage appliances although it can contain more as you build out your solution over time.

The Assureon comes in an APC rack. This is to enable factory configuration and ensure that the customer has a working solution when it arrives on site.

Nexsan ships two standard configurations, the SX and the GX plus. The SX is designed for a single site while the GX is intended for users needing to keep data at different sites.

Nexsan perform the pre-configuration of the Assureon based on information provided by the customer prior to delivery. The customer will then go through their own configuration work. Configuration is something that should not be taken lightly. Ideally, the issues and problems with configuration will have been dealt with during the pre-sales meetings.

The Assureon comes set as its own Windows 2003 domain. This is to keep it separate from existing systems and to reduce the security footprint. In order for it to work you need to create a trust between the Assureon domain and your existing systems. This is a one way trust from the Assureon to your domain and is only done after the Assureon has been delivered. If you have multiple Assureon solutions, each will be a separate domain. Once you add it to your systems, you will need to make DNS entries so that users from different sites can connect to it.

Administration is done through the Assureon Admin which is a standard web-based GUI. Here Nexsan have been smart and kept the same look and feel as their storage products - SATABoy and SATABeast.

The Assureon uses Microsoft Windows Server 2003 as its operating system and Microsoft SQL Server 2005 to maintain the indexes and other information. Although this is a hardened version of Windows Server (it conforms to Evaluation Assurance Level 4 (EAL-4)) there are still issues over security and other patches. Despite Microsoft efforts to remove the need for reboots when patches are applied to their software, this is not always possible, nor does Microsoft make it clear when you will need to reboot. Nexsan takes control of this for you and Nexsan Canada test all patches to see what does need a reboot. The Assureon is redirected to Nexsan Canada to pick up all patches and updates.

The Assureon has a full audit log which is stored in a read-only database. Like many devices today you can redirect any alerts to email, pagers and mobile phones. Unfortunately, Nexsan has yet to add a secure email option. Most organisations require their users to login before they can send mail. This prevents unauthorised email being sent through the corporate email servers. Nexsan are looking to address this soon.

At the heart of the Assureon is the classification and sub-classification groups. A classification is a tag applied to data and is used to control access and security. A sub-classification simply refines the tagging. This is a fairly broad approach to the use of meta-data but does provide a start point for Information Lifecycle Management (ILM).

Classifications can be time limited and can allow the retention time to be extended. They are very powerful and most of the preparation work is around planning the classification tree that you will use. Each classification creates its own group in Active Directory. To create control of data, classifications are linked to retention rules.

These rules create the minimum and initial retention periods which can be different. Once set, these rules cannot be changed for existing data only for data added after the rule is changed. The retention rule also determines if data is to be compressed, encrypted and the number of versions to be kept. With some financial legislation you need to keep all versions so this number should be kept high. The Assureon does not delete excess versions but there is a utility that the administrator can run to reclaim the space.

Encryption is done through the use of two separate keys, SHA-1 and MDA-5. The result is that every file has a unique fingerprint and prevents any mathematical chance of two files every getting the same key. When a file is destroyed, the index is shredded. This means that even if the file exists on a backup tape, you cannot restore and then access it.

Data is acquired by the Assureon through the use of File System Watchers (FSW). These are placed out where the data resides and collects it back into the Assureon when it changes or new files are added.

The Assureon requires its own management account in your general domain for administration but the administration tools can be installed on any workstation. There is a hidden Nexsan management account that can only be accessed by Nexsan from their support centre based in Canada. Nexsan does not provide the customer with the details or access to this account. This account has no access to files; it is used for maintenance by Nexsan. While Nexsan are sure that they meet all the requirements of any data legislation, they do stress that final checks are the responsibility of the customer. Outside access is one of those times when you will need to do checks.

Initial configuration can take time and it is likely that you will initially end up keeping more data than you want. One of the most important considerations is that of time. Get the retention time wrong and there is little you can do. Most organisations have no idea of how long they want to keep data for and this is where any planning to install an Assureon must include your Compliance team.

With careful planning at the start, ongoing maintenance of the Assureon is almost non-existent. Making backups of data, monitoring logs, adding new classifications and retention rules is not overly burdensome and this looks to be a light touch security solution.

The list price for the Assureon looks very high but shop around and the street price is generally around 25 per cent less.

Verdict

The Assureon appears expensive for what it is, but as a secure, manageable CAS solutions which will help meet the changing face of data compliance, it is a very good option.

Assureon SX Single Node, Single or Dual File Writes Includes (Next Business Day) Onsite and Phone Support SX-10(1) 4TB, includes (4) FSW agents£27,077.00 SX-20 (1) 7TB, includes (4) FSW agents£37,744.00 SX-30(1) 21TB, includes (4) FSW agents £86,616.00 Assureon GX Dual Node, Single or Dual File Writes Includes (Next Business Day) Onsite and Phone Support GX2-10 - 7TB, includes (8) FSW agents£46,872.00 GX2-20 - 14TB, includes (8) FSW agents£70,565.00 GX2-30 - 21TB, includes (8) FSW agents£94,103.00

BlackBerry users in the UK suffered a huge headache yesterday when many found they were unable to send email due to at least one of Research in Motion's (RIM) mail servers being blacklisted by anti-spam guardian SpamCop.

The issue has now been rectified but some are worried that it may happen again.

Yesterday afternoon, several of IT PRO's readers received bounce back messages when they tried to send email from their devices to certain contacts. The reply stated that RIM's Smtp02.bis.eu.blackberry.com server had been blacklisted.

When IT PRO entered the server's details into SpamCop's database, it confirmed that the mail server in question was indeed blocked.

When approached about the problem, RIM's spokespeople claimed they believed the issue was being investigated but were unable to provide further comment or clarity as to when the problem might be resolved.

Additionally, RIM was unable to provide any details on why the situation had arisen or reassure frustrated business users that this issue would not become a regular occurrence.

Following further investigation today, the server has been removed from the SpamCop blocking list (SCBL).

"The SCBL is a list of IP addresses which have transmitted reported email to SpamCop users, which in turn is used to block and filter unwanted email," according to SpamCop's site.

"The SCBL is a fast and automatic list of sites sending reported mail, with a number of report sources, including automated reports and SpamCop user submissions. The SCBL also quickly and automatically delists these sites when reports stop."

A large number of businesses use SpamCop to weed out unwanted junk mail from their communications infrastructure. An equally large number of business users rely on their BlackBerry, resulting in a serious conflict of interests.

Last month, research from YouGov and T-Mobile found that 40 per cent of BlackBerry users felt that their ability to rapidly respond to emails enhanced customer relationships.

Nine out of 10 users also cited the devices as a saviour when they found themselves in potentially awkward business situations.