Policy Based Encryption Gateway. Administration Guide

Transcription

1 Policy Based Encryption Gateway Administration Guide

2 Policy Based Encryption Gateway Admin Guide 1 Contents Description of Policy Based Encryption... 2 Policy Based Encryption and Content Control... 2 Features Summary... 2 Enabling Policy-Based Encryption... 4 Accessing the Boundary Defense / Policy Based Encryption Control Panel... 7 Creating an Encryption Group Defining an Encryption Rule Tips & Suggestions... 17

3 Policy Based Encryption Gateway Admin Guide 2 Description of Policy Based Encryption The Policy Based Encryption (PBE) service encrypts specific s based on a policy that is, a set of rules designed to analyze all , and encrypt any that matches the pre-defined conditions. Policy Based Encryption uses the Content Control rules to identify which needs to be encrypted. The Policy Based Encryption Service is managed through the same control panel that you use to manage your Anti-virus and Anti-spam settings. Policy Based Encryption and Content Control The Policy Based Encryption service is closely integrated with the Content Control service the rule that defines whether an is to be encrypted is set up in the Content Control configuration screens in the Boundary Defense for Control Panel. The encryption rule has an action to redirect any s that meet the rules conditions to a specified encryption address. This address will be sent to the administrator when the service is purchased. This address is used solely to process and encrypt the . Features Summary The following summary shows some of the features available. PBE Number of recipient languages supported 12 Best Method Of Delivery (BMOD) Encryption strength (-bit) 128 Maximum size of an encrypted (MB) 50 Maximum number of encrypted s per user per month 240 Offline reading of s (possible under certain circumstances) Support for mobile devices (Blackberry and Windows Mobile 5) Branding Configurable password policy

4 Policy Based Encryption Gateway Admin Guide 3 Recipients able to reply securely Secure portal expiry time (days) 30 Portal session timeout if inactive (minutes) 10 US Infrastructure European Infrastructure

5 Enabling Policy-Based Encryption 1) Access Hosted Exchange through the Menu Ribbon. Policy Based Encryption Gateway Admin Guide 4 2) Click on the Boundary Defense tab.

6 3) Click on the Manage link next to Policy-Based Encryption. Policy Based Encryption Gateway Admin Guide 5 4) Click on the Activate link.

7 Policy Based Encryption Gateway Admin Guide 6 5) Click on Finish. 6) The service will show as Provisioning. Click on the Refresh button in the upper right to confirm that the service is activated.

8 Policy Based Encryption Gateway Admin Guide 7 Accessing the Boundary Defense / Policy Based Encryption Control Panel The Policy Based Encryption Service is managed through the same control panel that you use to manage your Anti-virus and Anti-spam settings. This control panel can be accessed through the main Control Panel: 1) Access Hosted Exchange through the Menu Ribbon.

9 Policy Based Encryption Gateway Admin Guide 8 2) Click on the Boundary Defense tab. 3) Click on the Open link next to Boundary Defense Management Portal.

10 Policy Based Encryption Gateway Admin Guide 9 4) Log on to the Boundary Defense Management Portal using the User Name and Password from the Control Panel Boundary Defense Tab. NOTE: If the password has been changed in the Boundary Defense for Control Panel, password will not be synched back to the Control Panel. In this case, that password that is displaying in the Control Panel will not work.

11 Policy Based Encryption Gateway Admin Guide 10 Creating an Encryption Group Prior to creating any encryption rules, an encryption group must be created. This group needs to be added to each rule, as an exception in order for the mail to be forwarded to the Policy Based Encryption Gateway. See below for instructions for adding this group to the encryption rule. To create an encryption group: 1. Select the Users and Groups tab.

12 2. Click on the Content Control User Groups link. Policy Based Encryption Gateway Admin Guide Click on the User Groups tab. 4. Click on the Create New Groups button. 5. Enter the Group Name, for example PBE Exclusion Do Not Delete, in the Group Name field. 6. In the New users field, enter a non-valid address (such as example@domain.com).

13 7. Select Save and Exit. Policy Based Encryption Gateway Admin Guide 12

14 Policy Based Encryption Gateway Admin Guide 13 Defining an Encryption Rule To trigger mail to be encrypted, an Content Control rule must be configured with an action to redirect the mail to the specified address for the service you are using. Define the rule to include the specific conditions that you want to cause to be encrypted, for example, specific words contained in the header or body of the . The Content Control service scans against the rules in the order they are listed in the BDE Control Panel portal. If an triggers a rule with an exit action, it is subject to that action and does not pass on to be scanned for further rules. The redirection action for PBE rules is an exit action. So it is important to put encryption rules towards the bottom of the rule set, so that other rules defined to comply with the organization s acceptable usage policy are acted on first. NOTE: If an triggers a rule with an exit action, such as a block action higher in the rule set, the will not be encrypted, because the first rule, blocking the , will take precedence. NOTE: It is recommended that test groups be added to a rule initially for testing, to ensure the new encryption performs as expected. This will prevent potential problems on mail flow for the entire organization. Test groups are created as in Section 4 above, only with valid corporate addresses added to the rule instead non-valid address. To create an encryption rule: 1. Select the Services tab.

15 2. Select Content Control, and click the [Create new rule] button. Policy Based Encryption Gateway Admin Guide Give the rule a name and specify the rule to apply to Outbound mail. 4. In the Sender tab, select the user groups this rule applies to, if the rule will only be for a subset of your users. If you do not select any setting in this tab, the rule will apply to all users in your organization. 5. In the Recipient tab, specify a user group condition. Please note the following: All encryption rules MUST specify a recipient user group condition. To encrypt s sent by anyone in the organization, you will need to use the user group you created in section 4, and then select the option to All recipients EXCEPT those in selected groups. The rule will then be applied to all of your users; so all s will trigger the rule and therefore be encrypted.

16 Policy Based Encryption Gateway Admin Guide 15 If a domain list is also specified as a recipient, in the Rule conditions section, you must select All the conditions below need to be satisfied. NOTE: Any modifications to the rules will require replication throughout the platform before the rule is active. 1. In the Content tab, select the criteria with which you desire to filter. In this tab, you can also select if you want to Scan body, Scan subject line, Scan Microsoft Office & PDF documents, Scan header. content section you can select content from the drop-down list, or choose Custom

17 Policy Based Encryption Gateway Admin Guide 16 List to add customized keywords. You will need to click the information in the Selected content section to filter on this content. (<CTRL> and click to select multiple items) templates section you can select content to encrypt on from Credit Card Numbers, Social Security Numbers, or Specific Credit Cards. You will need to click the information in the Selected templates section to filter on this content. (<CTRL> and click to select multiple items) 2. In the Attachments tab, you can select to ignore attachments based on size, or whether you want to encrypt all messages with a certain attachment type. 3. In the Time Intervals tab, specify a specific time period for the rule to run. 4. In the Actions & notifications tab, select the action Redirect to administrator from the dropdown list, and check the Use Custom address box 5. In the Administrator s address box, enter the PBE-specific address that was sent to your company administrator after the purchase of the PBE service. 6. Review the settings in the Summary tab, and click [Save and exit].

18 Policy Based Encryption Gateway Admin Guide 17 Tips & Suggestions Below are some tips and suggestions for setting up and configuring the Policy Based Encryption Gateway: It is highly recommended to use a test group before activating the rules. This allows you to limit any issues caused by mail flow the rule to only affect a subset of the organization. Once the rule has been tested and proper functionality has been verified, the rule can be enabled for the entire organization. When setting up filter keywords, it is recommended to review the keywords internally, to ensure they meet the encryption needs of the organization. Each customer s encryption requirements are different, so there are no default rules configured initially upon purchase of the service. When forwarding a message to the Administrator , it is vital the forwarding address is correct in the Administrator s address field. If this address is not correct, mail will not flow correctly, and will not reach the encryption gateway or the proper recipient. As messages flow through the system, they are filtered according to the order that the rules appear on the screen, from top to bottom. When a message meets the criteria of a rule, the actions of that rule are enforced, and the message will not reach the rules that follow. Policy Based Encryption rules should only be configured for outbound mail. Encrypted messages can be sent to any user. If the recipient is not a subscriber, he or she will be directed to a secure web portal to access the encrypted message after creating a log-in. If the recipient is a subscriber, the message will be delivered to the recipient s mailbox. Policy Based Encryption can be used in conjunction with the Secure Mail encryption client. Policy Based Encryption encrypts messages sent via the Outlook client, the OWA web client, or any mobile device. If a rule is not working, the organization may want to deactivate the rule instead of deleting the rule. The rule will no longer filter messages, but it remains available so that the organization can refer back to the rule or activate it in the future, should the need arise.