Marshal sets up spyware protection

Marshal, a U.K.-based company that NetIQ acquired in 2002 and sold back in a management buyout three years later, plans to announce this week the first round of upgrades to its e-mail and Web security software since regaining control of those products.

MailMarshal SMTP 2006 and WebMarshal 2006 are on their sixth iteration; they have been around since Marshal was conceived in 1997 in New Zealand, according to Ed Macnair, the company’s CEO. Included in the upgrades are new features that keep spyware from entering an organization by detecting it at the gateway instead of the desktop, Macnair says. MailMarshal SMTP 2006 also has a new feature that detects from where an e-mail message was sent, which helps determine whether the message is spam.

Marshal competes with gateway e-mail security software makers, including Mirapoint, Proofpoint and Symantec, as well as Web-filtering companies WebSense and SurfControl.

System-management company NetIQ purchased Marshal in 2002 in an attempt to move into the emerging market of e-mail security and content filtering. The convergence of system management and security products did not catch on to the extent that NetIQ had predicted, according to Macnair. That, coupled with mismatched distribution strategies – NetIQ sells directly to corporations, while Marshal goes through third-party channels – meant the Marshal products didn’t thrive under the NetIQ name. In NetIQ’s fiscal year, ending June 2005, Marshal products – MailMarshal, WebMarshal, Security Reporting Center and Firewall Suite – generated only 8% of the company’s total revenue.

Some customers noticed the lack of attention paid to Marshal products under NetIQ’s ownership. About six months ago, Brisbane Girls Grammar School in Australia, which has 1,300 e-mail users, moved from MailMarshal to Symantec messaging security gateway products.

“We were finding that [MailMarshal] was creating too many false positives, and a significant number of legitimate e-mails were getting blocked,” says Nathan Pilgrim, the school’s manager of IT infrastructure and communications.

“We felt that the development of the product was not keeping abreast of the new e-mail-borne attacks and was therefore unable to protect our organization from them,” Pilgrim adds.

Marshal is now out to change that. In December 2005, Macnair led a management buyout of the Marshal products, supported by U.K. private equity firm Kelso Place Asset Management. The company rehired about 80% of its old development team, as well as the two original founders, and plans to employ nearly 100 before the end of May, Macnair says.

MailMarshal SMTP 2006 catches spam and viruses at the gateway and includes a new feature called CountrySensor, which determines the country from which an e-mail originated, Macnair says. Users factor in the information about country of origin when determining whether a message is spam, he says – or if the message comes from a country with which the company doesn’t normally do business, it is blocked altogether.

This version includes new protection against directory harvest and denial-of-service attacks, Macnair says, and detects spyware at the gateway by inspecting inbound attachments for unauthorized .exe files.

WebMarshal 2006 includes the same anti-spyware technology and the same anti-virus feature set as MailMarshal SMTP 2006, and provides content analysis and URL filtering. Later this year, Marshal plans to release instant-messaging security software.