Clearswift MIMEsweeper CSW250 review

When Clearswift launched its MIMEsweeper for web security appliances last year, we brought you an exclusive look at its entry-level CSW250 (web ID: 104988), and were sufficiently impressed to place it on the A List. However, we did note that user authentication was conspicuous by its absence, and with its latest update - with, confusingly, the same name -Clearswift remedies this oversight and adds a few more choice features as well.

Previously, the CSW250 was only able to identify systems; it then used Machine Lists, which defined end points using IP addresses, IP subnets and hostnames. At the time, security policies could only be assigned to physical systems, but now you can apply them to users and groups. Reporting also benefits, since you can track usage and possible infringements of AUPs by authenticated user names.

Rather than use nondescript hardware platforms of unclear lineage, Clearswift continues its partnership with Dell, so the appliance has a good-quality PowerEdge 860 rack server as its foundation. The hardware specification hasn't changed, but there's plenty of power on tap. Installation remains swift, as the CSW250 functions as a web proxy and client browser settings can be modified manually, via an AD Group Policy or proxy auto-configuration scripts. It can also operate transparently, but you'll need to redirect web traffic to the appliance for inspection if you use this method. All changes to the appliance are activated only once applied, but note that this will restart the proxy service, which will kick out any users currently accessing the internet.

The web interface and its slick design is still a standard setter, and it uses Centers to separate functions for easy configuration. User authentication is set up from the appliance's proxy settings, where you view and import user and group lists from LDAP servers and domain controllers. You implement Kerberos authentication from here too. IE users will be automatically authenticated against a domain controller, whereas users of other browsers will need to provide their Windows login details. We had no problems linking up the CSW250 with our Windows Server 2003 domain controller, where it was automatically added as a new computer.

The appliance uses combinations of content rules and routes to define what to look for, how suspect content should be handled and who should be notified. Common filters include content blocking, restricting upload and download file sizes and virus scanning, but Clearswift's lexical expression feature adds a new dimension. You can now search web content with user-defined expressions and Clearswift's predefined categories that look for credit card numbers, UK national insurance numbers and US social security numbers. Clearswift's ThreatLab service also maintains regularly updated lists of unacceptable words in a variety of languages.

The new functions are clearly worthy additions that make the CSW250 even more versatile. It's offering a powerful web-content filtering solution with an extensive range of features, and all at a very competitive price.

Author: Dave Mitchell