Quick Reference. Administrator Guide

Transcription

1 Quick Reference Administrator Guide

2 Services Quick Reference Documentation version: 1.0 Legal Notice Legal Notice Copyright 2015 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. Symantec Corporation 350 Ellis Street Mountain View, CA Clients are advised to seek specialist advice to ensure that they use the Symantec services in accordance with relevant legislation and regulations. Depending on jurisdiction, this may include (but is not limited to) data protection law, privacy law, telecommunications regulations, and employment law. In many jurisdictions, it is a requirement that users of the service are informed of or required to give consent to their being monitored or intercepted for the purpose of receiving the security services that are offered by Symantec. Due to local legislation, some features that are described in this documentation are not available in some countries. Configuration of the Services remains your responsibility and entirely in your control. In certain countries it may be necessary to obtain the consent of individual personnel. Symantec advises you to always check local legislation prior to deploying a Symantec service. You should understand your company s requirements around electronic messaging policy and any regulatory obligations applicable to your industry and jurisdiction. Symantec can accept no liability for any civil or criminal liability that may be incurred by you as a result of the operation of the Service or the implementation of any advice that is provided hereto. The documentation is provided "as is" and all express or implied conditions, representations, and warranties, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement, are disclaimed, except to the extent that such disclaimers are held to be legally invalid. Symantec Corporation shall not be liable for incidental or consequential damages in connection with the furnishing, performance, or use of this documentation. The information that is contained in this documentation is subject to change without notice. Symantec may at its sole option vary these conditions of use by posting such revised terms to the website.

3 Technical support If you need help on an aspect of the security services that is not covered by the online Help or administrator guides, contact your IT administrator or Support team. To find your Support team's contact details in the portal, click Support > Contact us.

4 Contents Technical support... 3 Chapter 1 AntiSpam... 5 Getting started with AntiSpam... 5 Detecting and handling spam... 5 Blocking, approving, and excluding senders for AntiSpam... 6 Applying the same AntiSpam filters to a group of users... 7 Quarantining spam in Spam Manager... 8 Chapter 2 Anti-Malware... 9 Getting started with Anti-Malware... 9 Chapter 3 Image Control Getting started with Image Control Detecting and handling inappropriate images Blocking and approving images Excluding senders and recipients from the image scan Setting up Image Control notifications... 12

5 Chapter 1 AntiSpam This chapter includes the following topics: Getting started with AntiSpam Detecting and handling spam Blocking, approving, and excluding senders for AntiSpam Applying the same AntiSpam filters to a group of users Quarantining spam in Spam Manager Getting started with AntiSpam Welcome to the Quick Reference for the AntiSpam service. The AntiSpam service uses two portals: The main service configuration portal to configure how you detect and handle spam s in your organization Spam Manager for administrators and recipients to review and take action on quarantined spam Detecting and handling spam In the AntiSpam service, you must set the detection methods and the actions you want to take on suspected spam s. We recommend that you change the default actions when you are sure that the AntiSpam service detects spam correctly. You change your detection settings at: Services > Services > Anti-Spam > Detection Settings You apply one of the following actions to any detected spam:

6 AntiSpam Blocking, approving, and excluding senders for AntiSpam 6 Append a header but allow the through. Append a header and redirect the to a bulk mail address. Tag the subject line but allow the through. Quarantine the . Block and delete the . You can change the way the AntiSpam service detects spam s for: All users. An domain you have provisioned with cloud security services. A group of users within an domain. Note: To ensure items such as newsletters pass through spam detection, you designate approved and excluded senders lists. The cloud security service detects spam in five ways: Use SPF (Sender Policy Framework) to detect sender spoofing, which leads to reduced phishing attempts where domain spoofing is commonplace. Match the s against IP addresses, domains, and addresses on a blocked senders list. Match the IP address of the sending server against a publicly-distributed list of spam sources (public block list). Match the signature of the body against a list of known spam signatures. Run the through our Skeptic heuristics to assess whether the is spam. Blocking, approving, and excluding senders for AntiSpam A service administrator defines global and group lists for blocked and approved senders. You identify senders by IP address, domain, or address. Users define their blocked and approved sender lists within Spam Manager. The Quarantine Administrator sets up these user lists in Spam Manager.

7 AntiSpam Applying the same AntiSpam filters to a group of users 7 Note: Group and user lists are optional components of AntiSpam. If group and user lists are not available in your portal, contact your cloud security services representative for more information. To create a blocked sender list: Services > Services > Anti-Spam > Blocked Senders To create an approved sender list: Services > Services > Anti-Spam > Approved Senders Before you define group lists, you must set up groups within domains. You also define a list of domains that are not tested against the AntiSpam rules: Services > Services > Anti-Spam > [domain name] > Exclusions Applying the same AntiSpam filters to a group of users You apply the same combination of : Blocked sender lists Approved sender lists Signature-matching Skeptic heuristics to a group of users who are registered in the same domain. Note: Groups are optional components of AntiSpam. If group settings are not available in your portal, contact your cloud security services representative for more information. To create a group: Services > Services > Anti-Spam > [domain name] > Create new group To add a user to a group: Services > Services > Anti-Spam > [domain name] > [group name]

8 AntiSpam Quarantining spam in Spam Manager 8 Quarantining spam in Spam Manager Quarantined s are stored in Spam Manager. Note: Spam Manager is an optional component of AntiSpam. If quarantine settings are not available in your portal, contact your cloud security services representative for more information. To quarantine suspected spam: Services > Services > Anti-Spam > Detection Settings > [detection method] > Action Your organization decides if: The text of the quarantined can be viewed. The recipient or a Quarantine Administrator manages the quarantined . Users are notified when spam is received. Users release spam s from within Spam Manager or from a link in a spam notification. Spam Manager deletes quarantined s after 14 days. Note: We recommend that you set active notifications with a release spam link, so that users do not need to access Spam Manager. You change your quarantine settings at: Services > Services > Anti-Spam > Domains > Quarantine Settings In the administrator's portal you: Create Spam Manager Quarantine Administrators. Allow users to receive notifications when the AntiSpam service quarantines an . Allow users to request additions to the approved senders list.

9 Chapter 2 Anti-Malware This chapter includes the following topics: Getting started with Anti-Malware Getting started with Anti-Malware Welcome to the Quick Reference for the Anti-Malware service. Inbound and outbound s are routed to the cloud security service and the Anti-Malware service scans all s passing through the system. If an passes successfully through a scan, the service forwards the to the original recipient. If the fails the scan, the service quarantines the . The recipient must decide whether to release inbound s. With the Anti-Malware service, you: Enable administrator and user malware alerts. Change the sending address for malware alerts. Note: You change your settings either globally or for each domain.

10 Chapter 3 Image Control This chapter includes the following topics: Getting started with Image Control Detecting and handling inappropriate images Blocking and approving images Excluding senders and recipients from the image scan Setting up Image Control notifications Getting started with Image Control Welcome to the Quick Reference for Image Control. You configure Image Control to scan s and attachments for inappropriate images that are sent to or received by users in your organization. You scan against: Known lists of inappropriate images. Predictive Image Control Analysis heuristics. Detecting and handling inappropriate images You change the detection sensitivity and the action the service takes with a flagged image. You change the way the Image Control service detects inappropriate images at a global level. Alternatively you specify custom settings for each domain that you are provisioned with in the cloud security services. Note: When the detection sensitivity is low you detect fewer images, but also have lower false-positive rates.

11 Image Control Blocking and approving images 11 You change your global detection settings at: Services > services > Image Control > Global Settings You change your domain settings at: Services > services > Image Control > [domain name] You take the following actions on inbound and outbound mail: Scan Microsoft Office and PDF files. Use Image Control Analysis heuristics. Match the image against a publicly-distributed list of inappropriate images (global list). Match the image against your own list of inappropriate images (client list). You take one of the following actions on the images that the scan flags as inappropriate: Block and delete the suspected . Redirect the suspected to the Image Control administrator. Copy the suspected to the Image Control administrator. Tag suspected in the header. Tag the subject line but allow the through. Log only. Warning: If you block and delete s you lose all falsely-identified s, which can annoy users. Rather than block and delete, we recommend that you copy or redirect identified s to the Image Control administrator. Note: To ensure business-critical images pass through the Image Control filters, you must designate approved senders and recipients, and lists of approved images. Blocking and approving images If an inappropriate image passes through the Image Control scan, you add the image's signature to a blocked images list. The next time a user sends or receives the image, the Image Control service flags the that contains the offending image. To create a blocked images list: Services > Services > Image Control > Blocked Images

12 Image Control Excluding senders and recipients from the image scan 12 If the Image Control scan incorrectly flags an image as inappropriate, you add the image signature to approved images lists. The next time a user sends or receives the image, the Image Control service allows the that contains the image to pass through. To create an approved images list: Services > Services > Image Control > Approved Images Note: The cloud security service maintains global blocked and approved images lists, which you can also scan against. Excluding senders and recipients from the image scan You authorize certain users to send and receive images without an Image Control scan at: Services > Services > Image Control > Approved Senders Services > Services > Image Control > Approved Recipients Setting up Image Control notifications You enable user notifications for any inappropriate images the scan finds within s. You also set up notifications to the administrator. You set up your global notifications at: Services > Services > Image Control > Notifications You change your options for each domain you have provisioned with the cloud security services: Services > Services > Image Control > [domain name] > Notifications