Cisco ASA 5500-X Series Firewalls

First American Financial Corp.

  • Viewing Options

  • PDF (298.0 KB)
  • Feedback

Finding a Solid Email Backbone in the Cloud


Real estate services giant First American Corp., founded in 1889, split into two independent companies in May 2010, a move that had been planned for two years. The company’s original title insurance and escrow business was renamed First American Financial Corp., and its Information Solutions Group was spun off and renamed CoreLogic Inc. First American Financial Corp. serves the residential and commercial real estate industries and offers its products and services in more than 60 countries, both directly and through its agents and partners.

Cisco Advantage

   Cloud Email Security, which features a multi-layered scanning architecture, delivers the industry’s highest spam catch rate: more than 99 percent.

   Reputation Filters automatically identify suspicious email senders.

   Fewer than one in 1 million false-positive rate keeps messages out of quarantine.

   All-inclusive service, with computing resources, software and support bundled together, provides simplicity.


In early 2010, First American Corp. was preparing to split into two separate companies: title and escrow business First American Financial Corp., and financial business data provider, CoreLogic Inc.  As part of this dramatic change process for the 120-year-old company, First American Corp. would lose its existing email backbone that thousands of employees and thousands of its locations relied upon. So, it turned to the cloud to create a strong email backbone for the new First American Financial Corp.

First American Corp.’s engineers evaluated a number of offerings, including cloud-based solutions from MessageLabs and WebSense, before recommending to management that they select Cisco® IronPort Cloud Email Security. The company already had been relying on Cisco IronPort email security appliances for about four years, after switching from email security vendor Tumbleweed (now Axway).

Technical Challenges

The goal was to make the transition to the cloud email security with Cisco transparent to users. Cisco had to maintain the same level of spam capture rate, if not better, while also providing advanced routing and policies for both First American and CoreLogic. As the companies went through the process of splitting into two separate organizations, all email bound for CoreLogic would have to be processed by the First American filtering solution. This period of coexistence required that many complex and detailed filtering and routing processes be put in place to maintain similar but separate scanning policies. The new solution would have to leverage Lightweight Directory Access Protocol (LDAP) routing in order to deliver mail to the correct company once it had been processed in the cloud. The unique capabilites of the Cisco IronPort Hybrid solution offered email scanning in the cloud with advanced Active Directory (AD) integration and routing required with the use of the on-premises devices. 

Once it became an independent company, First American Financial Corp. would continue to have a very complex routing scenario to address. All email traffic intended for the new CoreLogic organization needed to be routed—intact—and the Information Solutions Group’s legacy email hosted and held securely. The IT team at First American Financial Corp. would need an email security solution with flexible routing for under 100,000 objects and content filtering that offered encryption. In addition, the solution needed to be integrated with First American’s existing MS exchange email servers.

The main problem for the coexistence phase was handling mail that was destined for two separate companies but addressed using a single email domain of First American users would have their spam quarantined in the cloud while CoreLogic users required their email to be delivered to their environment. The solution was to tag spam in the cloud for all recipients and deliver to the on-premises devices that would use AD groups to assign custom policies for First American and Corelogic users. These custom mail policies would then quarantine only the First American spam and deliver the tagged spam to CoreLogic as the company required. Finally, LDAP/AD routing was used to deliver mail to the many different email systems once the mail was inside the First American infrastructure.

Cisco Advantage

First American Financial Corp. implemented the Cisco IronPort Cloud Email Security as its new email backbone just a few months prior to its transformation into an independent company in 2010. It has encountered no difficulty in routing, hosting and holding CoreLogic’s email traffic, and is ensuring security for that email through subject-based encryption. The company’s IT team also created a connector between the Cisco IronPort email gateway and CoreLogic’s gateway to enable communication between the two backbones. This also provided a means for reporting on the volume of email bound for Corelogic that was still being processed by First American. In addition, the Cisco IronPort solution is helping the company to deflect a significant amount of spam. First American Financial Corp. estimates that roughly 92 percent of its incoming email is spam. Cisco IronPort’s Reputation Filters, which use data from the Cisco SensorBase Network to perform real-time email traffic threat assessments and identify suspicious email senders, are blocking more than 139 million spam emails per day.