ExchangeDefender 9 Going Live! July 28th
ExchangeDefender 9
ExchangeDefender is proud to announce that ExchangeDefender 9 will be exiting the beta stage next week and will be in production for all of our clients on Saturday, July 28th, 2018. We want to prepare our partners and clients for our rollout schedule so that everyone is ready to go for what we expect to be a very seamless and effortless transition. You can see the new version at https://admin8.exchangedefender.com and we have written about it extensively here.
ExchangeDefender 9 has been running with new infrastructure since August of 2017, new UI launched earlier in the Spring of 2018 and all the automation and functionality has been tested extensively.
To sum it up:
Brand new outbound network Brand new inbound network
All new infrastructure, network, switching and security workflows
Brand new user interface and user experience
Tons of new features
The best part of it all is that all the functionality that you already use is in the exact same place, behaving the exact same way, and yielding the exact same results. The magic is in everything around it – everything is faster, more accessible, more streamlined and has far more functionality and flexibility than before. Just as a minor example, the new user interface allows you to interact with ExchangeDefender the same way no matter whether you’re at your desktop or on your mobile phone – and you get the full feature set, not just limited mobile experience.
Rollout Schedule
ExchangeDefender infrastructure is already running on the new code and has for months. This piece of our network is under constant maintenance and monitoring and we’re certain about it’s performance. You will not see any changes here.
On Saturday, July 28th, 2018 we will switch https://admin.exchangedefender.com to the new version of the UI/UX. Users will begin to see changes nearly immediately starting with 9AM EST. There may be a period of about an hour during which some users will experience the new UI and old UI – our support desk will be available via phone, chat, Facebook, twitter and support portal at https://support.ownwebnow.com the entire weekend to handle any issues that may come up. End users will also have a direct link to us to resolve any issues so if you’re one of our partners and don’t have a 24/7 support line – consider it covered.
On Sunday, July 29th, 2018 we will conduct a routine maintenance crash test – intentionally taking down random sections of our platform in order to determine resilience. This test will be conducted at random times during the day and we do not expect it to interfere with any operations.
New documention, marketing and collateral will become available the week of July 23rd but most of it is already available at www.exchangedefender.com right now.
Thank you for your business!
ExchangeDefender IoT Email Relay Service
The Internet of Things
ExchangeDefender IoT has concluded it’s beta period and we’re thrilled to announce that the system will go into production this week. We have blogged about this previously and the demand for this service really surprised us – so we’re rolling with the production and adding all the new features into the beta product as the applications for this service are quite extensive. To sum it up:
ExchangeDefender’s IoT Email Relay Service
ExchangeDefender IoT Email Relay Service is a custom email smarthost (outbound relay) designed specifically for Internet of Things devices and services to securely dispatch realtime email alerts. Feature-wise:
– XD IoT Relay assigns every device has it’s own account/credentials so if one device is compromised the email capabilities of others aren’t impacted.
– XD IoT Relay is secure permitting traffic only via TLS/SSL SMTP protocol to assure security credentials cannot be sniffed on the network.
– XD IoT Relay allows dynamic IP ranges, allowing for cell/4G/LTE devices and sensors with remote/unsecure network connectivity to relay alerts.
– XD IoT Relay is compatible with every device that can send out email via SMTP/SSL (should be all of them) and is backed by our support and automated throttle management (in the event of an infection)
New feature is available in the ExchangeDefender admin portal under Domain Admin > Accounts > IoT Accounts.
Simply add a new account for each device you wish to have relay rights for (they are free for now) and configure your device to relay through outbound-auth.exchangedefender.com. Our service is globally redundant (no single point of failure) and is under our SPF/DMARC announced range.
We will be blogging more about this feature as we develop it and get a better handle of how it’s used but the feedback so far has been very positive and constructive. The biggest surprise (read: shock) is the level of unreliability of some of these devices/sensors and their rather infant API/app development – but they all know how to send email so many of our partners are looking to us to help fill the void between these devices/sensors going dark/offline and production email notification service. Many of our partners also looked to use this for printers, blogs, contact forms and a seemingly endless set of services that a remote ISP should be providing but they don’t – so when it comes to business and email people come to ExchangeDefender.
P.S. If you’d like to hear more about this feature and all the other new stuff we have set for ExchangeDefender in 2018, please download the webinar where we go into the details of how/why/what that might give you a broader perspective on how to position, sell, and implement these new features. Please click here to download the webinar.
Three Simple Ways To Begin Regulatory Compliance Archiving
Have you been putting off offering or relying on Compliance Archiving to meet regulatory compliance requirements? If so, you’re among friends as most businesses tend to view it as a form of a backup until they receive a letter from a law firm. Recently we published a quick and informal techie-free post about business continuity and we wanted to do the same for archiving because the #1 thing that will keep you out of trouble is making sure your entire organization is on the same page.
With that in mind, here are three steps that your organization needs to follow to get started with Compliance Archiving:
Step 1: Understand how your organization communicates
If you only knew what everyone did and what they had access to, things like security and compliance would be a non-issue. In the real world, organizations have a revolving door of staff, vendors, clients, laws, and projects that is constantly spinning. The notion that you can get something to manage it all, held together by IT staff and automation, is nothing short of a fantasy. Or rather, a nightmare, because you’ll get in trouble over one thing that was missed and went wrong not a million things that went right.
Our Compliance Archiving touches every message in your organization: doesn’t matter if it’s a message you sent to a client, a message you received from a vendor, or an interoffice email you sent to a coworker – we get them all. The important thing in step one is identifying the people and making sure that the way you communicate is set in stone: “We communicate with everyone through @ownwebnow.com email addresses, every ticket, every update, every inquiry, every quote, every bill pay – everything either comes from or is cc’d to an @ownwebnow.com address.”
Step 2: Get a grip on your devices, apps, and processes
Convenience is the enemy of order. And if you’re going to run a business, you cannot have everyone do exactly what they want to do. Yes, Subway will make your sandwich any way you want them to, but if you walk in and order a key lime cheesecake you’re going to be hungry. Same method applies to all the devices, apps, processes, etc. The simplest, most common sense, most effortless thing to do is to just give everyone that works on your behalf an email address on your infrastructure and have them use that email for all company communications.
If they use something else, and for some reason you wish to permit that rule change in your business, request that everything is cc’d to a local shared mailbox where you can keep ownership of it. Don’t make a big deal out of it – we get our office beer and red solo cups from Costco – and believe me we don’t have a massive asset inventory tracking system around it with people signing off on stuff left and right. We just take a picture of the receipt/order form and email to a receipts@ address – done.
Step 3: Get a regulatory compliance plan
The worst thing you can possibly do is start thinking about a plan when you’ve received a request for information or a legal hold. The good news is, step #3 is the simplest one because it’s just a matter of calling us at 877-546-0316 and talking to someone about implementing the Compliance Archiving solution. The complexity isn’t in the technology, it’s with the people and the constant sprawl of apps and devices that hold vital corporate information.
The great news about what we offer with our partners is that anything going in and out of your company can be screened, monitored, reported, and produced on demand or automatically for just a few bucks a month. The biggest challenge is knowing what to do – and you have to actually get started.
We look forward to serving you and making regulatory Compliance Archiving a breeze.
Security Problems vs. Business Problems When It Comes to Email
We live in interesting times when it comes to business email. The widespread abuse of email by hackers and spammers has always provided a cover for some rather shady email sending patterns used by small businesses. The rise of GDPR, CAN-SPAM, and other rules, regulations, and acts has built a financial incentive for regulators to go after businesses that violate the rules and small businesses are a sitting duck – too local and easy to track, too easy to report, and often very easy to fine.
Email is quickly becoming a great source of revenue for enforcement agencies – and protecting businesses from themselves (your marketing department in particular) is a challenge so many small businesses need to get a grip on before excessive penalties threaten the very existence of the business that crosses the line even once. So congratulations MSPs, VARs and security professionals, now your SPAM and mail flow management isn’t only going to concern illegal/hacker abuse, you’re now going to be at odds with your clients and how their “unique business case scenario” that will likely get them fined out of business. Fun, right?
Management of all these new things is a subject of our upcoming webinar, next Wednesday, where we hope to give you some technical insight and practical business advice on how you can help businesses manage their email activity properly. Bring your techies and business/sales team in as well, as this affects both sides of the house. Or, you can just tell your clients not to SPAM out and hope they listen to you – my wallet thanks you in advance if you choose this route (sarcasm heavily implied).
Wed, Jun 27, 2018 12:00 PM – 1:00 PM EDT
Click here to register
To be clear, this is not another webinar about GDPR. At all. But you can use GDPR to inform your clients about the potential issues that are coming up. Big businesses and marketers are already facing the inevitable and I bet you that even with the onslaught of all the emails and notices you didn’t quite appreciate what those “notices” were meant to do in the first place. Inform you about GDPR and updated privacy policies, right? Wrong. They are being used to get you to opt back into messages that you accidentally got rolled up in the first place. And this is for things you knowingly entered into – think about how a typical small business gets it’s leads – from purchased lists to sweepstakes and raffles and “win a free lunch for your company” business card drops – all of that is about to become a nightmare for the IT department to manage and protect.
Or you could just see how we do it with Corporate Encryption and Compliance Archiving.
Redesigning Our Outbound XD Network
As we hinted before in our Outbound IoT announcement, there are some big enhancements coming to our ExchangeDefender outbound network. The job of getting the mail delivered over the Internet is more art than science and we are looking to put more resources behind this as encryption, compliance and GDPR take over. So today, I want to briefly walk you through our vision (roadmap to follow on this months webinar) of what we’re about to offer at scale.
The biggest obstacle to efficient email delivery are the actual users. I know it sucks to have a finger pointed back at you but truth is most of the delivery problems aren’t caused by connectivity, routing, or SPAM filtering software, they are caused by behavior and sending patterns of users. They fall into two categories: negligence and inappropriate email usage. Negligence comes in many forms but primarily lack of security (weak passwords, unpatched servers, compromised networks/accounts) leading to a SPAM outbreak from a domain that otherwise wouldn’t be sending SPAM. Inappropriate email usage comes from users knowingly abusing their personal email accounts to send large mail merge, mailing list, commercial SPAM sort of content. Yes, everyone has a justification and an excuse for behaving the way they do and we’re not here to judge that – but machines have 0 judgement and only work off “score” that is calculated by adding points to a total until a message has enough to qualify as SPAM. If you look like a spammer, the remote system isn’t going to care much that you aren’t. We can only address these through education and we’re committed to doing that at ExchangeDefender… but, we can do even better. And that’s our vision for our supported outbound network.
We are currently working on consolidating our entire outbound network into a single outbound.exchangedefender.com – that means saying goodbye to –corp, –jr, –int, –misc and specialty email routing services we’ve written to help address unique business requirements of our users. Starting soon, the entire network will simply allow outbound mail for person-to-person communication regardless of the message format and contents (yes, you’ll be able to use out of office (OOF) notices and autoresponders again). For non person-to-person email, we’ll use outbound-auth for devices, services, etc. For marketing (newsletters) we’ll have one as well.
The big change will be in support and an active managed postmaster. This simply means that there will now be a monkey-in-the-middle facilitating, reporting and auditing outbound mail sending patterns to assure delivery and proper routing. Say Bob from Marketing decides to do a mail blast using his Outlook and attempts to hit 5,000 contacts. All but maybe 100-200 of those messages will actually make it through our network. Say your “Password1!” security credential was compromised and someone started using your Exchange login to run a SPAM campaign – that too isn’t getting out. And the support team that will be managing this flow will be the same one that will be helping you address mail problems immediately, not as a reaction 3 days later when your domain ends up on an RBL.
That and you’ll have additional intelligence embedded in outbound mail routing to assure delivery and start realtime conversations for things that are better handled in a chat vs. email. But sssssh that’s a secret for now. Everything else about this (and the new UI) is coming in this months webinar, I cannot encourage you enough to register for it, tune in live and ask questions:
New Features Webinar
Wed, Jun 27, 2018 12:00 PM – 1:00 PM EDT
Click here to register
We believe that the division of email flow – separating machine/service/device/non-person mail from person-to-person email will give us the unique ability to more precisely deliver messages over notices and also improve our ability to get around bulk filtering that plagues us just because of the way email is routed. Getting support in there, in realtime, will make the difference between an issue being handled directly and right away as opposed to dragging on for days and offering no assurance to the client or recipient where the message went. So not only will support and client relationships improve, so will our ability to embed more features into outbound mail that will make it more effective as opposed to leaving it at “best-effort”.
We need your support feedback
We’ve been getting incredible feedback since the launch of our new support portal but believe me when I say that this is just the preview of what we’ve got going on behind the scenes. As ExchangeDefender’s business model continues to shift towards security and compliance services (instead of just software/cloud) our ability to provide excellent service becomes the top goal organizationally. And it matters the most to you, our clients and partners, because we’re lifting the burden of support and platform management from you so we need to be able to provide support on a whole new level as a result of it.
On the bottom of all the new sections of the portal you will see a link that says [BETA] Give us feedback.
Tap that link and tell us what you would like to see.
I cannot overstress the importance of us getting this right, not just for our own sake but for yours as well: support and assistance will start getting bundled and integrated into the very solutions we provide. This means that we will be using your brand, your logo, your site to deliver ExchangeDefender services on your behalf and that will include realtime communications with clients, employees, staff and anyone else with valid credentials. You will have full control over it all, along with analytics and reporting: we won’t do this without you is more than just a tagline on every webinar I’ve held in the past two years.
So please. Whatever you see, however minor, whatever idea you have, however major: I want to hear it. Developers won’t. I want us to continue providing an integrated cloud service end-to-end that continues to thrill customers instead of frustrating IT people. We’re changing the game here.
-Vlad
General Data Protection (GDPR) and ExchangeDefender: Get your resources to demonstrate compliance
ExchangeDefender, at it’s core, is all about protecting our clients: it should come as no surprise that we are big fans of GDPR. If you haven’t been inundated by GDPR, or by a million “we’ve updated our privacy policy” emails from every web site you’ve ever signed up for, or you’ve landed here simply because the deadline is tomorrow, Friday, May 25th: rest assured we’ve got you covered.
ExchangeDefender is 100% compliant with GDPR. You are covered as are your clients on ExchangeDefender and we have presence across European Union to handle any issues or complaints that come up as a result of GDPR implementation.
What you need to know
GDPR, essentially (and no, this is not legal advice), is a European Union data privacy regulation that turns the tables on marketers and gives residents of EU very specific rights and control over their personal data. The regulation is very broad in terms of scrutinizing everyone that may be holding (controller) or managing/processing (processor) personal data and ExchangeDefender fits both of those roles at times depending on the product or service we’re talking about.
If you’d rather do without me talking at you for 6 minutes, we have a ton of other resources that you can share with your clients. I would start with this document available for download here:
What you need to do now
1. Start by reviewing our new Privacy Policy. I know, I know, you’re done with
2. Contact us if you’re seriously building out a business around GDPR and get our marketing folks to hook you up with branded collateral (minimum client count
3. Review our GDPR collateral, particularly the webinar with the deep dive of the ExchangeDefender implementation. This is the most important thing you could do but it’s 27 minutes long and I know everyone doesn’t have that kind of time or attention span – I get it – but if you’re seriously working with us and need GDPR assistance, you will have to go through the training eventually.
Where to go next
We are very excited about GDPR and have put significant resources to design our products and services around the regulation because we believe it will have a broad impact well beyond Europe. Privacy, data integrity, right to be forgotten, right to withdraw consent, right to find out what sort of information companies have about you – those are fundamental rights in our opinion.
And if you ignore them the penalties are going to be extensive.
What we’re choosing to do at ExchangeDefender is to create a service around protecting people on the Internet – not just from SPAM but really safeguarding all communication you do as a business. Take a look at our GDPR resources and see how we can get you started on the same path – at the very least you can use our reach and resources to comply with GDPR.
The false sense of cloud security: “I don’t need backups or archiving, we’re in the cloud.”
One of the most common misconceptions we get to deal with in the email business is the notion that the almighty cloud eliminates the need for backups, redundancy, compliance archiving, and disaster planning in general. Nothing could be further from the truth so please share this checklist with your clients and decision makers so they can make informed decisions about how much protection is needed for critical business data.
Now, let’s tear apart the myths we hear most often:
It’s in the cloud so it’s already backed up. You will not find a single cloud service provider that will offer their backup policies in explicit detail. This is not just a matter of secrecy (exposing the network and storage design) but also of implementation: some services just don’t have a backup only a lagged copy. Never, ever, assume that your cloud provider cares about your data more than you do, it’s no coincidence that the first thing you do with every service you sign up for is a mandatory acceptance of terms of service that you’ve likely never read. Your data is your sole responsibility.
It’s in the cloud and they say it’s there forever. Sometimes marketing gets falsely associated with the actual service deliverables: “You will never have to delete email to make space” doesn’t translate into “Your email will never disappear” – all major email providers have a well documented trail of losing clients mail, deleting their mailboxes “for policy violations” and otherwise shunning any responsibility.
It’s in the cloud so someone is actively managing it. Cloud service providers manage the cloud service, management of your personal data is often the secondary concern. That sounds harsh so allow me to elaborate the top down view: Imagine your service just crashed, massive catastrophe: What is your primary concern? Restoring access to service to send/receive email, or restoring clients data from 5 years ago? Now align those priorities with the budget: What is more important to the cloud provider: service operation or access to old data? Many services are even pushing for not keeping all of your data in the cloud at all, the notion of archive boxes and focused views is all about not having the responsibility for your data.
It’s in the cloud so it meets compliance. Your regulatory compliance requires assurance that data could not have been deleted. That kind of assurance only comes with services like ExchangeDefender Compliance Archiving which archives messages before anyone has a chance to tamper or delete the data. Furthermore, the backend system for an archiving or compliance solution is radically different because of the liability: companies that insure confidential data storage are far more concerned about redundancy, backups and data loss than they are about the uptime and service availability.
Now that the myths surrounding the false sense of cloud security are shattered, let’s look over a brief plan you need to implement to safeguard your data:
1. Document everyone with access to email.
2. Come up with a policy for adding/removing employee email.
3. Identify any regulatory compliance requirements.
4. Identify business case scenario requiring long term archiving.
5. Document who has access to what and how changes are tracked.
6. Come up with a data retention and data backup plans.
7. Understand the law and security, make neccessary adjustments.
8. Designate a Compliance Officer to manage everything.
9. Test your backups and compliance archiving routinely.
10. Periodically audit everything in the previous 9 steps.
Truth is, there are hundreds of steps in cloud security management for each of the 10 items I listed above: The goal isn’t to give you a blueprint, the goal is to make you aware of complexities and the issues that can come up when the basics are ignored. If you would like the details, give us a call, email is what we do for a living and (unfortunately) our expertise is developed over the years of cleaning up our clients neglect of their email infrastructure – let us and our partners know how we can help.
Top 5 Mistakes Companies Make With Compliance
ExchangeDefender Compliance Archive was designed as a blend of services and products to help organizations achieve regulatory compliance. This complex process is always evolving with new regulatory requirements, changes in organization structure, and unique reporting requirements.
At ExchangeDefender we specialize in helping organizations with their eDiscovery needs. Here are the biggest fallacies we hear all the time:
“We have a backup”
Email backups are not sufficient for nearly any modern regulatory compliance requirements for email retention. Not only can the messages be deleted before backups run, but running reports across the entire organization is next to impossible, not to mention excessively expensive. We recently assisted a partner managing a small 15 employee office in their backup and restore process to locate a message from 5 years ago, costing the organization over $18,000 in IT labor alone.
“We have a product/compliance service”
Having a product or a service subscription is different from being in compliance with regulatory requirements. The difference between having a product and being in compliance is similar to “We have a CPA” and “We have filed our tax returns on time” – mistaking the two can be costly and dangerous.
“We are never going to need that”
Most organizations downplay the importance of long term email archiving and eDiscovery. An overwhelming majority of subscribers to our eDiscovery service don’t have a specific regulatory requirement at all, they do it to effectively defend themselves from legal threats that are all too common these days. With email being the gateway for all corporate communication, it is the first place record retentions, legal holds, and subpoenas are issued for electronic records and there needs to be a system in place to effectively deliver that information.
“What we have is enough”
Regulatory compliance goes far beyond poorly interpreted recommendations and laws. It is a process of producing reports, identifying problems, and assuring that corporate communications policies are being followed, or at least addressed, in case there is an issue. If the organization does not have people in charge of managing the compliance on a monthly basis or there are no current reports searching for dangerous or sensitive content or there is no ongoing maintenance or an established incident record – the organization is likely out of compliance even if they purchased the right software or signed up for the right service at one point.
“We have a someone managing that”
Someone is not a good person to rely on when you get a subpoena and they are even more difficult to get into a courtroom. Plus, how much would you trust them to demonstrate expertise and defend the implementation of the compliance archiving and eDiscovery solution? Many organizations make a mistake of thinking that just signing up for a service or purchasing a product is sufficient for compliance but it’s really just a starting point. You need the personnel, product, service, and reporting to fully achieve regulatory compliance.
ExchangeDefender Compliance Archiving and eDiscovery are a part of a professional service that helps get your organization and its means of communication on path to achieving regulatory compliance. Whenever someone is fully confident that they have their compliance in order we simply ask them to “show me your last Compliance Officer Report” and almost everyone struggles to produce the report or even name the Compliance Officer, the processes being used for archiving, the type of data protection, or the way in which the entire process is tested and audited. With ExchangeDefender Compliance Archiving, you not only get a service, you get a partner that will work with you every step of the way in achieving your regulatory and organizational needs for proper record keeping.
Rough week with Windows Updates? DR is in!
With technology you really cannot avoid disasters, all you can do is prepare and test all backup plans when things go wrong. IT people in charge of Windows systems have had so many issues with Microsoft updates over the years that Microsoft consolidated all of their patching to happen on the second Tuesday of every month – and this months update disables network cards (kb 4103718) on many Windows PCs – oops! This got us to thinking, how many of you are effectively planning and implementing all the ExchangeDefender services to resume work when disaster strikes? We make it as simple as a bumper sticker, but it’s all in the planning and effective onboarding:
Outlook Web App/Access: Outlook Web App has almost the entire functionality of Microsoft Outlook and it’s included for free with your ExchangeDefender Exchange subscription. Problem is, most users do not know the server name or how to find it in an outage or on the road. We advise our partners to setup a splash page, a link or a dropdown on the clients web site or their own MSP site that leads the clients to the right location.
LiveArchive: LiveArchive is included in ExchangeDefender and it’s designed exclusively as a business continuity solution to be used when Exchange and other email servers go offline. Server down? Just point your browser to https://livearchive.exchangedefender.com and all your email is right there even if it’s not showing up in your Outlook due to an outage.
Mobile Device: Let’s face it, you won’t be able to pull out your monitor and workstation and take them down to Starbucks when the disaster strikes. Prepare your mobile devices to function as remote offices. You can configure both work Outlook and LiveArchive devices up front and just set them as Disabled or dormant accounts. Doing so allows you to simply “turn on” the mobile feature instead of trying to walk someone through the device setup while they are on the speakerphone and you already have their entire office waiting too.
Let’s be real for a second: We know that disasters in IT happen. Mechanical machines that these incredibly complex systems run on are prone to failure: so instead of gambling that the problem will not occur, why not just build it into the onboarding system and take care of the inevitable situation right now where you can do so at your own pace and keep everyone happy.