How To Migrate from Kaspersky Secure Email Gateway?

The U.S. Federal Government recently banned domestic sales and integration of Kaspersky products because of concerns regarding risks to U.S. national security and the safety of American citizens.

On July 20, 2024, U.S. regulators will ban Kaspersky from entering new agreements with U.S.-based persons regarding information, communications, and technology services, per an order signed by U.S. Secretary of Commerce Gina Raimondo.

This decision prompted the announcement that the Moscow-based security firm will depart the U.S. market by the end of 2024. Several existing clients leverage Kaspersky security products, including the secure email gateway (SEG).

Trustifi, a global leader in advanced cloud-based email security powered by artificial intelligence, has extensive experience migrating clients from existing SEG solutions. Thanks to Trustifi’s professional service team and ease-of-use onboarding process, many migrations took less time and effort.

Do you want to migrate from the Kaspersky SEG? Schedule a demo with the Trustifi email migration team!

Understanding the Transition

The U.S. Departments of Homeland Security, Commerce, and Justice periodically investigate foreign-owned technology firms conducting business inside the United States. Many times, if these federal agencies determine just cause and a risk to national security, they will ban one or all products sold by the company in question.

These actions have been displayed for several years regarding China and several companies, including ZTE and Huawei. After years of investigations, the U.S. finally banned the sale and installation of any products from these Chinese companies.

Overview of the Kaspersky Secure Email Gateway

The Kaspersky SEG is a comprehensive email system and mail security solution conveniently in a virtual appliance. It is derived from the well-regarded Kaspersky Security for Linux Mail Server and offers advanced protection against spam, phishing, BEC, and malicious attachments.

The SEG platform leverages the Kaspersky global threat intelligence network for constant updates. The SEG devices communicate back to the Kaspersky Labs through a private network for anti-spam updates. A core component of Kaspersky threat intelligence is machine learning (ML) modeling, executed within a secured cloud. The ML models run continuously based on data processed from several sources.

One of the primary benefits organizations counts out from Kaspersky is its ability to help stop a wide range of attacks, including business email compromise, zero-day, email phishing, malware attacks, account takeover, and identity threats.

Why Should You Audit The Kaspersky Secure Email Gateway?

Before migrating, it is essential to audit existing solutions to validate that the architecture is still working as expected and to understand the existing rules and policies in effect within the SEG configuration file.

Organizations adding or migrating adaptive controls rarely just pick up one device and simply copy over the rules and configuration. This type of upgrade may apply to simple network devices like Wi-Fi controllers; however, with security appliances with historical audit logs, transport layer security (TLS) encryption, and complex rules, migrations allow the security operations team (SecOps) to start with consolidating or updating existing policies while taking advantage of the new platform functionality.

Specifically, for the Kaspersky SEG, an audit could confirm if any rogue remote access connections exist or if any exploits to other security systems are occurring. This risk is not to be taken lightly. Kaspersky products, like others, use APIs to interface with extended detection and response (XDR) systems, SIEMs, and even network devices. Understanding any connection dependencies will be helpful when reviewing other alternative solutions.

Exploring Alternative Email Security Solutions

After completing the Kaspersky SEG device audit, SecOps and IT operations should review and validate which current features will migrate to the new email security solution. These current functions will be replaced or converted into the new solution differently.

Here are some current features found within the Kaspersky SEG that should exist within the new solution:

• Support for DMARC, DKIM, and SPF for domain authentication.
• Roles-based-access-control (RBAC) with MFA
• Machine learning
• Anti-Phishing Rules
• Anti-Virus Engines
• Business Email Compromise Prevention
• Account Takeover Prevention

Top Email Security Alternatives to Kaspersky Secure Email Gateway

Besides ensuring the current features functioning on the Kaspersky SEG exist in alternative solutions, organizations should research additional, more advanced features.

Trustifi

A global leader in cloud-based email security powered by AI, Trustifi offers several integrated adaptive control layers to meet and exceed client expectations. Trustifi’s protection layers include AI, ML, Data loss prevention (DLP), email encryption, data tokenization, email archiving, account takeover prevention, and dynamic security awareness training and attack simulation.

Mimecast

Like Trustifi, Mimecast is also a leader in the cloud-based email security solution market. Its solution offers several layers of protection, including AI and ML filtering and analysis, zero-day protection, email encryption, and DLP. Mimecast has also handled several migrations from other solutions; however, transitioning into its cloud-based offering is complex and requires extensive engagement with professional services.

Proofpoint

Considered the standard for large enterprise and government customers, Proofpoint’s email SEG and cloud-based scale are suitable for large deployments. Proofpoint is a traditional SEG deployment solution. Similar to Kaspersky, Proofpoint offers similar SEG-like functionality. The company provides extended capabilities, including DLP, email encryption, and CASB services. However, these solutions loosely integrate into their primary offering.

Migrating to a New Email Security Solution

After your organization has decided on the alternative solution, analyzed the audit findings from the existing Kaspersky application, and mapped out additional features that will become part of the new email security architecture, the next step is to develop a plan for the actual migration.

The optimal way to migrate from one email security solution to another is to do so without causing disruption. This goal is executed through API integration and layering one solution in front or behind the existing solution. By taking this approach, the existing mail flow will traverse the existing Kaspersky SEG device slowly, and the migrating team can enable new email security features while sunsetting existing settings.

Removing the Kaspersky SEG from the network is safe once you have fully sunsetted all the settings and updated the MX record with DNS. Using mx tools can help verify your MX record changes have propagated correctly.

Ensuring Compliance and Security During Transition

During the migration, the SecOps team should forward all events to an XDR solution to validate the old rules are still protecting the email.

The SecOps team should also review the new solution’s continuous monitoring function, including the automated reporting function, to validate that all the security controls and compliance mandates are up-to-date and secure.

Evaluating Managed Services for Post-Migration Coverage

After the completion of the migration from the Kaspersky SEG to the new email security platform, does your organization have a formal SecOps team internally staffed to handle the current and feature email phishing and other attacks? By enabling the new advanced email security solution, your organization will benefit from automated incident response, reporting, and compliance verification. Even with this capability, do you plan to staff your SecOps to cover your organization 24x, seven or are you currently investigating a partner with an email detection and response (EMDR) service provider?

EMDR providers like Trustifi offer 24/7, after-hours, and overall staff augment services. Organizations that prefer to use their internal engineers to focus on more strategy projects benefit from these offerings.

Conclusion

Kaspersky’s decision to close U.S. operations creates an opportunity to migrate from a legacy SEG to a cloud-based email security solution. This migration increases your protection layers and may make a similar and cost-effective operations model for your email security.

Why Trustifi?

Organizations leveraging the Kaspersky SEG need to consider other options. Trustifi’s expertise in SEG and advanced cloud-based email security migrations makes it an optimal choice for a smooth migration. Compliance, preventing data loss, automated incident response capabilities, stopping next-generation email phishing, and providing dynamic security awareness training powered by Ae are some reasons organizations trust Trustifi.