Trend Micro InterScan Messaging Security Suite. Certification Training Course. Student Textbook

Transcription

1 Trend Micro InterScan Messaging Security Suite Certification Training Course Student Textbook

2 Information in this document is subject to change without notice, The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. Complying with all applicable copyright laws is the responsibility of the user. Copyright 2003 Trend Micro Incorporated. All rights reserved. No part of this publication may be reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior written consent of Trend Micro Incorporated. All other brand and product names are trademarks or registered trademarks of their respective companies or organizations. Program Manager: Tom Brandon Editorial: Niche Associates, Inc. Released: October 2003 v01

3 Table of Contents InterScan Messaging Security Suite...5 Course Objectives... 5 Prerequisites... 6 Chapter 1: Overview of InterScan Messaging Security Suite...7 Product Features New Feature: Spam Prevention Service Enterprise Protection Strategy Chapter 2: Setup, Installation, and Registration...23 Preparing to Install InterScan MSS Upgrading from InterScan MSS Installing InterScan MSS Registering InterScan MSS Upgrading From the Evaluation Period Update Settings Chapter 3: Configuring SMTP Routing Settings...55 SMTP Routing Delivery Settings Message Settings Testing the InterScan MSS Installation Chapter 4: Configuring POP3 Scanning Settings...75 POP3 Scanning Chapter 5: Configuring General and Security Settings...87 General Settings Security Chapter 6: Understanding and Configuring Policies Policy Overview Two Types of Policies Editing Global Policy Filters Creating a Sub-Policy Creating New Filter Actions Chapter 7: Understanding Filters Filters The Antivirus Filter Configuring the Advanced Content Filter Configuring a Message-Attachment Filter Configuring General Content Filter Configuring Message-Size Filters Configuring Disclaimer Manager Filter Configuring the emanager Anti-Spam Filter Spam Prevention Service (SPS) Managing the Quarantine Area

4 Chapter 8: Configuring System Monitor and Log Maintenance Settings System Monitor Settings Log Maintenance Settings Chapter 9: Troubleshooting Troubleshooting Common Problems Troubleshooting the Installation Process Getting Support from Trend Micro SolutionBank Changes to the ISNTSmtp.ini File Appendix A: Using Trend Micro Online Resources Contacting Trend Micro Trend Micro Virus Doctors Client Scans with HouseCall Trend Micro Security Information Center Appendix B: Adding Entries to DNS and Excluding Files From Scanning Adding Entries to DNS Excluding Certain Types of Text Files from Scanning Appendix C: Uninstalling and Reinstalling InterScan Messaging Security Suite Appendix D: Example Logs Appendix E: Interpreting Header Information Appendix F: Answers to Review Questions...245

5 InterScan Messaging Security Suite InterScan Messaging Security Suite Course Objectives After studying this course as part of an ATC Training Program, you should be able to: Knowledge Describe the main features of InterScan Messaging Security Suite (InterScan MSS) Explain how InterScan MSS protects your system from viruses and other malware Describe the main features of emanager Explain how emanager controls the content entering your system Describe how heuristic scan engine works and how Spam Prevention Service (SPS) uses it to filter spam. Skills Install InterScan MSS Use the Management Console to configure InterScan MSS for varying network conditions and preferences Test the capabilities of InterScan MSS Monitor the performance of InterScan MSS Update the virus pattern, scan-engine, and program files of InterScan MSS How to Use This Material To help you understand how to use InterScan MSS, this course is based on a learning model comprised of the following: Chapters Each chapter focuses on one aspect of using InterScan MSS to protect your network from viruses in the wild. In addition to defining important concepts and terms, each chapter outlines the various administration tasks you need to perform. For example, you will learn how to install, configure, and troubleshoot InterScan MSS. The PowerPoint slides your instructor uses to teach the course appear at the beginning of each chapter. The rest of the chapter contains detailed information that you can read or refer to after class Trend Micro Incorporated 5

6 Trend Micro InterScan Messaging Security Suite Student Textbook Chapter Objectives Each chapter starts with a list of objectives so you can see how the chapter fits into the overall course goal. After reading the chapter, you should be able to fulfill the chapter objectives. Summary Each chapter ends with a summary, listing the important information explained in the chapter. The summary mirrors the chapter objectives. Review Questions To help you fulfill the chapter objectives, each chapter includes review questions that test your understanding of the chapter material. After reading the chapter, you should be able to answer the questions easily and quickly. If you cannot answer a question, you should review the chapter material. The answers to the review questions are provided in Appendix F: Answers to Review Questions. Prerequisites This course is designed for end users and resellers who need to install and set up InterScan MSS and for those who seek Trend Micro antivirus suite certification. The following professionals benefit most from this course: System administrators Network engineers Before you take this course, Trend Micro recommends that you have the following knowledgebase: A general knowledge of TCP/IP A working knowledge of Microsoft Windows 2000 and Windows 2000 Advanced Server A working knowledge of Simple Mail Transfer Protocol (SMTP) A working knowledge of Microsoft Internet Information Server (IIS) A working knowledge of Microsoft Exchange and Microsoft Outlook Express Familiarity with the physical aspects of networking (such as network interface boards, cables, jacks, hubs, routers and so on) Trend Micro Incorporated

7 Chapter 1: Overview of InterScan Messaging Security Suite Chapter 1: Overview of InterScan Messaging Security Suite Chapter Objectives After completing this chapter, you should be able to Describe the main features of InterScan Messaging Security Suite (InterScan MSS) 2003 Trend Micro Incorporated 7

8 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

9 Chapter 1: Overview of InterScan Messaging Security Suite Notes 2003 Trend Micro Incorporated 9

10 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

11 Chapter 1: Overview of InterScan Messaging Security Suite Notes 2003 Trend Micro Incorporated 11

12 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

13 Chapter 1: Overview of InterScan Messaging Security Suite Notes 2003 Trend Micro Incorporated 13

14 Trend Micro InterScan Messaging Security Suite Student Textbook Product Features InterScan MSS is a high-performance, policy-based antivirus and content-security Simple Mail Transfer Protocol (SMTP) and Post Office Protocol 3 (POP3) server. InterScan MSS performs the following functions: Protects enterprise messaging systems from Internet-borne malware Blocks the transmission and receipt of spam and other non-business-related content InterScan MSS can be deployed into an existing SMTP messaging environment and protects networks from virus infection through the SMTP gateway. In addition to SMTP traffic, InterScan MSS can scan Post Office Protocol 3 (POP3) messages. POP3 scanning is performed using the InterScan MSS POP3 proxy that runs on the same server as the SMTP scanning function (using a different port). InterScan MSS emanager filters messages for spam and non-business-related content such as profanity, sexually offensive content, and racially offensive content. emanager includes filters that you can configure to block any type of content from your system. You can also configure the Spam Prevention Service (SPS) filters to block unwanted content from your network. AMON Support InterScan MSS 5.5 supports Application Monitoring (AMON ) from Check Point Software Technologies, LTD. InterScan MSS uses AMON to report scanning statistics to Check Point System Status Viewer. Automatic Detection of Multiple Network Interface Card If you install InterScan MSS on a server that has multiple network interface cards, the setup program automatically detects the IP address of each card. You can then select the IP address that you want the program to use. Best-Match Algorithm The best-match algorithm is the method that InterScan MSS uses to determine which policy to apply to an . InterScan MSS applies the policy with the route that most closely matches the addresses of the incoming . Cluster Servers InterScan MSS supports cluster servers for increased performance. When you install multiple instances of InterScan MSS on clustered servers, you can save your customized settings, which are stored in INI, DAT files, and registry entries. You can then apply these settings to each instance of InterScan MSS running on the cluster servers Trend Micro Incorporated

15 Chapter 1: Overview of InterScan Messaging Security Suite Content Management You can use InterScan MSS to inspect messages and attachments and stop unwanted content at the gateway. is an indispensable business tool, but it must be managed properly to ensure it is used productively. You can create filters that use keyword expressions to eliminate anything from violent, sexually offensive, or racially offensive content to personal communications. Domain-Based Message Routing With InterScan MSS, routing is based on the recipient domain. This domain-based routing capability provides flexible message delivery through multiple smarthosts or specific Domain Name System (DNS) servers. Early Detection of Mass- ing Viruses InterScan MSS detects mass- ing viruses such as the Melissa, Loveletter, and AnnaKournikova viruses. These -aware viruses use the infected computer s client and address book to spread themselves. Trend Micro publishes a list of these auto-spamming viruses in the antispam pattern file, which InterScan MSS updates from the Trend Micro ActiveUpdate server. InterScan MSS also protects your network from new mass- ing viruses before they are added to the antispam pattern file. InterScan MSS recognizes the symptoms of infected messages and blocks them. For example, the file attachment name or extension and the text that appears in the message body or header typically remain the same as the virus spreads. InterScan MSS can recognize these identifying characteristics and determine that a mass-mailing virus is spreading the file. Because -aware viruses can be so damaging, InterScan MSS may take different actions when it detects mass- ing viruses than the actions it takes against other viruses. For example, if InterScan MSS detects a macro virus in a Microsoft Office document, it can quarantine the document, in case it contains important information that has to be retrieved. If InterScan MSS detects a mass- ing virus, however, the program can automatically delete the infected file. Deleting the file saves resources that would be used to scan, quarantine, or otherwise process a file that has no value. In addition to saving resources, deleting the file can prevent help-desk calls from concerned employees and eliminate post-outbreak cleanup. Enhanced Performance InterScan MSS includes an enhanced built-in transfer agent (MTA), delivery agent (MDA), and virus/content scanner to ensure that your messaging system runs efficiently. In addition, InterScan MSS has a multithreaded design that takes full advantage of multiprocessor systems Trend Micro Incorporated 15

16 Trend Micro InterScan Messaging Security Suite Student Textbook Policy-Based Management InterScan MSS provides policy-based management, which makes it easier to regulate content and filter for viruses. To enforce usage guidelines, you can create multiple virus and content-filtering policies on a single InterScan MSS server. You can also set up different policies for individuals or groups, based on sender and recipient addresses. A policy consists of the following three attributes: Who What Action To whose messages the policy applies What message or attachment characteristics, such as addresses, keyword expressions, file types and sizes are to be filtered The action to take with that triggers the filters Quarantine Manager You can use the Quarantine Manager to manage messages in the quarantine area. The Quarantine Manager is part of the InterScan MSS Web console. You can view the messages in the quarantine area and decide what action you want to take with them. The Quarantine Manager has a query feature that you can use to retrieve information about the messages in the quarantine area, including the reason the message was quarantined. Secure, Web-Based Management Console InterScan MSS includes a Secure Sockets Layer (SSL)-compatible, Web-based Management Console. Using this Management Console, you can control access to InterScan MSS servers and sessions from any Web-enabled workstation on your network. Server Access Control You can set connection and relay restrictions that prevent unauthorized use of your InterScan MSS server. Such restrictions can prevent spammers from using your servers to relay messages. To ensure that InterScan MSS processes only messages you deem acceptable, you can also set limits on inbound connections, message sizes, and other parameters. Single-Server, Multiple-Policy Support A single InterScan MSS server can enforce company rules on use. You can set up different policies for individuals or groups based on the sender and recipient addresses. You can create a maximum of 3,000 sub-policies within a single InterScan MSS installation. However, each sub-policy can have an unlimited number of filters Trend Micro Incorporated

17 Chapter 1: Overview of InterScan Messaging Security Suite SMTP Load Balancing to Downstream Servers InterScan MSS has an enhanced domain-based delivery mechanism and delivers to downstream SMTP servers in round-robin fashion. This delivery mechanism balances the load for all downstream SMTP servers (see Figure 1-1). InterScan MSS forwards to the first available server. 1 SMTP 4 IMSS 5 2 SMTP Internet 6 3 SMTP Figure 1-1: InterScan MSS uses a round-robin method to forward to downstream SMTP servers. Support for POP3 InterScan MSS can scan POP3 traffic. The POP3 proxy runs on the same server as the SMTP scanning function, but it uses a different port. InterScan MSS also includes a POP3 Client Tool, which is an ActiveX control for configuring clients. You can use the POP3 Client Tool to automate the configuration of several common clients. Note: The ActiveX configuration tool only works with Outlook Express. All other clients require manual configuration. System Monitor InterScan MSS includes a built-in agent, called the System Monitor, which monitors the status of the InterScan MSS server. The System Monitor can notify you by or Simple Network Management Protocol (SNMP) trap when fault conditions, such as a virus, threaten to disrupt the flow. Detailed logging helps you take a proactive approach to these issues and eliminate them before they become a problem. Event monitoring helps you identify potential trouble spots and provides notifications so that you can correct problems and keep the system running smoothly Trend Micro Incorporated 17

18 Trend Micro InterScan Messaging Security Suite Student Textbook Some events are handled automatically. For example, if the InterScan MSS service stops, it restarts automatically to ensure flow is not interrupted. New Feature: Spam Prevention Service The addition of Spam Prevention Service (SPS) 2.0 provides InterScan MSS with heuristic spam filtering capabilities. Heuristic technology calculates the probability that a particular message is spam. Unlike other methods used to identify spam, heuristic technology is capable of identifying first-time spam, or spam that has not been previously documented. Because spammers frequently change the techniques they use, heuristic scanning is an important layer of defense against new spam. Enterprise Protection Strategy InterScan MSS protects your network at the SMTP gateway, which is one of the main entry points to your network. However, you must also protect the other entry points to your network. For example, when users browse the Internet or download files from Web sites, their workstations might be attacked by malware. When mobile users plug their laptops into public networks, home networks, or networks at other companies, their laptops might be attacked by malware. When these users reconnect to your network, malware on their computers can spread to your network. Once the malware enters your network, it can quickly spread to all vulnerable devices. To help you protect all the entry points to your network, Trend Micro offers variety of products that you can use to protect all the entry points to your network (see Table 1-1). Product Protection Platform InterScan Web Security Suite HTTP and FTP Windows and Solaris InterScan VirusWall SMTP, HTTP, and FTP Windows, Solaris, HP-UX, Linux, and IBM AIX InterScan Messaging Security Suite SMTP and POP3 Windows and UNIX InterScan Web Manager HTTP Windows ScanMail for Microsoft Exchange SMTP Microsoft Exchange on Windows ScanMail for Lotus Notes SMTP IBM Lotus Domino on Windows, IBM AIX, IBM S/390, IBM AS/400, Linux, Solaris, and SUSE Trend Micro Incorporated

19 Chapter 1: Overview of InterScan Messaging Security Suite Product Protection Platform ScanMail for OpenMail SMTP OpenMail on HP-UX ServerProtect File system Windows, NetWare, Network Appliance Filers, EMC Celerra, and Linux PortalProtect File system Microsoft SharePoint Portal Server on Windows Damage Cleanup Server PC-cillin OfficeScan Corporate Edition Cleaning templates that repair damage to device, including changes made to registry, files, and open ports File system, network shares, POP3 File system, TCP/IP, Outlook client, PDAs, and wireless devices Client: Windows Server: Windows Windows Client: Windows Server: Windows Table 1-1: Trend Micro products that you can use to protect the different entry points on your network. Note: To help you protect your network against the latest malware threats, Trend Micro is constantly updating its products. For up-todate information, visit Protecting individual devices and systems is only the first layer of defense. To prevent malware from damaging your network and causing downtime, you need an integrated solution that coordinates all virus-protection products, mitigates damage caused by malware attacks, and cleans damaged systems. The Trend Micro Enterprise Protection Strategy (EPS) combines products, services, and support to protect network entry points. To rebuff a malware attack, the Enterprise Protection Strategy delivers a coordinated defense that begins when a new virus is discovered and ends when the threat is eliminated Trend Micro Incorporated 19

20 Trend Micro InterScan Messaging Security Suite Student Textbook Relying on a broad offering of specific products and resources, the Trend Micro EPS includes these basic components (see Figure 1-1): Trend Micro Control Manager Outbreak Prevention Services Virus Response Services Damage Cleanup Services CENTRALIZED MANAGEMENT Trend Micro Control Manager (outbreak lifecycle management, deployment, and reporting) OUTBREAK LIFECYCLE PHASES OUTBREAK PREVENTION VIRUS RESPONSE ASSESSMENT & RESTORATION STAGES Threat Information Attack Prevention Notification & Assurance Pattern File Scan & Eliminate Assess & Clean up Restore & Post-Mortem TREND MICRO SERVICES OUTBREAK PREVENTION SERVICES VIRUS RESPONSE SERVICES DAMAGE CLEANUP SERVICES Figure 1-1: Using Trend Micro Enterprise Protection Strategy to manage the outbreak lifecycle Trend Micro Control Manager Trend Micro Control Manager provides centralized management and enterprise-wide coordination of all Trend Micro antivirus and content-security products and services. Using Trend Micro Control Manager, you can monitor virus activity on your network from a central location. You can ensure that virus pattern files are always updated, and you can deploy and enforce virus-protection policies across the entire network. You can also respond quickly to virus outbreaks. Outbreak Prevention Services Outbreak Prevention Services (OPS) provides proactive attack updates, outbreak prevention policies, and system-wide status reports. Coupled with Trend Micro products that reside at critical points across the network, OPS accelerates response times in protecting networks against new malware. By applying information and prevention policies that focus on a specific threat, you can deflect, isolate, and restrict attacks before they spread. These early prevention measures help reduce system damage and prevent costly shutdowns that affect business operations. Virus Response Services Virus Response Services includes the Virus Response Service Level Agreement (SLA) and threat-based scanning. The SLA is a penalty-backed guarantee to deliver a virus pattern file within two hours from the time the customer submits a virus case. If Trend Micro fails to meet this promise, it will pay the customer an amount of money agreed to in the SLA Trend Micro Incorporated

21 Chapter 1: Overview of InterScan Messaging Security Suite The virus pattern file provided with Virus Response Services includes threat-based scanning. This feature increases the efficiency of virus scanning by focusing the search in areas where the threat is most likely to be found. Damage Cleanup Services The Damage Cleanup Services provides cleaning templates that scan the system and assess the damage incurred during the outbreak. The template analyzes changes that were made to the files, system settings, and network protocols. These changes include hidden guest accounts, registry entries, or memory-resident payloads. For more information about the EPS, visit Trend Micro s Web site at Trend Micro Incorporated 21

22 Trend Micro InterScan Messaging Security Suite Student Textbook Chapter 1 Summary and Review Questions Summary InterScan MSS analyzes messages and attachments for content that you want to block from your network. Because InterScan MSS supports both SMTP and POP3 traffic, it can scan all messages entering or leaving your company s system. With InterScan MSS, you can block viruses at the gateway before they enter your company s messaging system or network. In addition, you can block non-business-related , including violent, sexually offensive, or racially offensive . To enforce your company s usage rules, you can create virus and content-filtering policies. You can also set up different policies for individuals or groups, based on sender and recipient addresses. Review Questions 1. Which feature allows you to control the level of antivirus and content management that is applied to members of your organization? a. Domain-based message routing b. Quarantine manager c. Policy-based management d. Single-server, multiple policy support 2. Which feature can you use to filter unwanted , such as sexually or racially insensitive material? a. Domain-based message routing b. Content management c. Policy-based management d. Single-server, multiple policy support 3. Which feature notifies you when a fault condition threatens to disrupt flow? a. Content management b. Enhanced server access control c. Quarantine manager d. System Monitor Trend Micro Incorporated

23 Chapter 2: Setup, Installation, and Registration Chapter 2: Setup, Installation, and Registration Chapter Objectives After completing this chapter, you should be able to: List the options for incorporating InterScan Messaging Security Suite (InterScan MSS) into your current firewall setup Choose an installation server, based on the requirements of your company s network Install InterScan MSS Register InterScan MSS Configure InterScan MSS Upgrade InterScan MSS from trial to full version Update InterScan MSS 2003 Trend Micro Incorporated 23

24 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

25 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 25

26 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

27 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 27

28 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

29 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 29

30 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

31 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 31

32 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

33 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 33

34 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

35 Chapter 2: Setup, Installation, and Registration Notes 2003 Trend Micro Incorporated 35

36 Trend Micro InterScan Messaging Security Suite Student Textbook Notes Trend Micro Incorporated

37 Chapter 2: Setup, Installation, and Registration Preparing to Install InterScan MSS Before you install InterScan MSS, consider the following: Location You must decide how to incorporate InterScan MSS with your firewall. Installation server You must decide whether to install InterScan MSS on the Simple Mail Transfer Protocol (SMTP) server or on a dedicated server. Hardware requirements You must ensure that the server meets the minimum hardware requirements for running InterScan MSS. Incorporating InterScan MSS with Your Firewall Trend Micro recommends the following two options for incorporating InterScan MSS into your current firewall setup: Behind the firewall In the Demilitarized Zone (DMZ) Behind the Firewall You should always install InterScan MSS behind a firewall. In this configuration, the firewall can continue to protect your network against intrusion while InterScan MSS provides content scanning and filtering (see Figure 2-1). Note: You should never install InterScan MSS in front of your company s firewall. InterScan MSS is a content-security product, not a firewall. IMSS SMTP Server Internet Firewall domain2.com Figure 2-1: Installing InterScan MSS behind the firewall Trend Micro Incorporated 37

38 Trend Micro InterScan Messaging Security Suite Student Textbook In the DMZ You can install InterScan MSS in a DMZ, which further protects your company s network from Internet-based attacks. A DMZ isolates traffic that is coming from the Internet, preventing this traffic from directly accessing your network. You can create a DMZ by installing two firewalls to separate your network from the Internet. The area between the two firewalls is the DMZ, which is where you would place your InterScan MSS server (see Figure 2-2). DMZ Incoming (port 25) Outgoing (port 25) IMSS SMTP Server Internet External Firewall Internal Firewall Figure 2-2: Installing InterScan MSS on a dedicated server in the DMZ. You can also create a DMZ using just one firewall. In such a configuration, passes through the firewall when entering the network. After InterScan MSS has scanned the , it sends it back through the firewall and to the receiving client. (see Figure 2-3). Firewall SMTP Server Internet Receiving Client passes through the firewall on the way to the InterScan MSS server. After InterScan MSS completes the scanning, it routes the back through the firewall and to the SMTP server. IMSS Figure 2-3: Installing InterScan MSS in a one-firewall DMZ Trend Micro Incorporated

39 Chapter 2: Setup, Installation, and Registration Choosing the InterScan MSS Server You can either install InterScan MSS on your SMTP server or on a dedicated server. Installing InterScan MSS on a server that runs other applications can decrease efficiency. Trend Micro recommends that you install InterScan MSS on a dedicated server. The decision of where to install InterScan MSS, however, is based primarily on resource availability and SMTP traffic. Installing InterScan MSS on a dedicated server is ideal for networks with heavy traffic because the overhead on the server does not increase. If your server has antivirus products from other vendors, installing InterScan MSS on a dedicated server prevents problems that might arise as a result of conflicting applications. Installing InterScan MSS on your server does not require any additional servers. This configuration also uses less network bandwidth, and you do not have to make any changes to your network s DNS configuration (see Figure 2-4). IMSS Existing SMTP Gateway Client Internet Firewall Figure 2-4: Installing IMSS on the original SMTP server. If you install InterScan MSS on your server, you must configure the InterScan MSS server exactly as your existing SMTP server is configured. Matching the configuration ensures that the server and InterScan MSS both process the all . When you install InterScan MSS on the same computer as the server, ensure that the SMTP and InterScan MSS ports do not conflict. InterScan MSS binds to port 25 by default, so the port on the existing SMTP server must be changed prior to installing InterScan MSS. If you are using POP3, the POP3 port numbers should also be changed because InterScan MSS tries to bind to port 110. After you reassign these ports, you can run the InterScan MSS setup program. Configuring Flow Through Your Network Regardless of where you install InterScan MSS, you must configure your flow in the same fashion. Incoming must pass through InterScan MSS first. After InterScan MSS scans , it passes it to the network server, which then passes it to the receiving clients. Outgoing must pass through the network server first, which then passes it to InterScan MSS (see Figure 2-5) Trend Micro Incorporated 39