Reviewer s Guide. PureMessage for Windows/Exchange Product tour 1

Transcription

1 Reviewer s Guide PureMessage for Windows/Exchange Product tour 1

2 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO WELCOME Welcome to the reviewer s guide for Sophos PureMessage for Lotus Domino, one of the Sophos Security and Data Protection solutions. The guide provides IT administrators with an overview of the product s key features, takes a closer look at the way it enforces corporate policy and explains its comprehensive reporting functions. Like all our solutions, PureMessage for Lotus Domino is the product of more than 20 years experience protecting business, education, and government organizations. It delivers integrated protection for your gateway and Domino servers against all -borne spam and malware threats. It allows you to control the information your organization sends and receives, provides protection against the loss of confidential data and guards against the inappropriate use of your system. Sophos solutions are built around simplicity and manageability, and are acclaimed for delivering proactive protection from increasingly complex and fast-spreading security threats. All our licenses include comprehensive 24-hour support from our worldwide network of support experts every day of the year, at no additional cost. PureMessage for Lotus Domino is also backed up by SophosLabs our global network of threat analysis centers which provides a rapid response to emerging and evolving threats. For information on pricing and how to buy PureMessage for Lotus Domino, please contact your local Sophos representative. To find out who to contact in your area, please visit: If you would like to request an evaluation, please go to: 2

3 CONTENTS CONTENTS 1 A BRIEF OVERVIEW 4 Award-winning technology 4 Deployment and management 5 2 CORPORATE POLICY ENFORCEMENT 6 Simplified policy setting and enforcement 6 Powerful anti-malware scanning 8 Industry-leading spam protection 8 Content filtering 9 Disclaimers 10 Quarantine management 10 3 COMPREHENSIVE LOGS AND STATISTICS 12 Graphs 13 APPENDICES I Sophos products for the enterprise 14 II Other Sophos products and services 15 III System requirements 17 3

4 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO 1: A BRIEF OVERVIEW PureMessage for Lotus Domino stops spam and malware from entering your infrastructure and Domino 8 servers. It delivers cost-effective and proactive protection against known and unknown threats, while its advanced attachment and content filtering technology prevents data leakage and helps you enforce acceptable use policies. Default anti-virus and anti-spam policies get you up and running as quickly as possible, and you can easily write customized policies to suit your exact needs. All policies can be assigned to individual users or groups, giving you complete control over usage. Simple security Default and customized policies and full scanning of s and their attachments protect your Domino servers from spam, malware and data loss. Sophos Firewall Lotus Domino server protected by PureMessage Internet Infected Notification sent Figure 1: Inbound, outbound and internal mail is scanned for multiple threats Award-winning technology PureMessage scans and attachments as they enter and leave your network and within your Domino server (Figure 1). It detects viruses, Trojans, worms, spyware, spam and sensitive information, protecting the integrity of your infrastructure and your information. Sophos Genotype Technology recognizes entire spam and virus families and protects you against threats before they happen, blocking malware and over 99.9 percent of spam. Further protection is delivered through obfuscation detection, URL tracking, heuristics, and content fingerprinting, while SXL (Sophos extensible Lists) provides real-time spam intelligence to catch all evolving threats. PureMessage for Lotus Domino is also updated by SophosLabs throughout the day with the very latest pre-packaged anti-spam and anti-virus intelligence. 4

5 A BRIEF OVERVIEW PureMessage for Lotus Domino benefits Unrivaled detection of spam and malware Proactive protection High accuracy Data loss prevention Regulatory compliance Global protection Automatic updating End-user controls Comprehensive support Detects over 99.9 percent of spam and protects against scams, including phishing attacks. Detects, disinfects, deletes or quarantines viruses, Trojans, worms, and malicious spyware in incoming and outgoing . Employs Genotype, Behavioral Genotype, and Sender Genotype technology to catch evolving threats and dangerous applications. Automatically balances a range of spam detection techniques to deliver consistent accuracy, minimizing false positives. Provides powerful message and attachment content scanning controls to protect against confidential information leakage. Incorporates a rich policy environment to support complex security or regulatory compliance requirements. Protects global organizations from spam and viruses in multiple language message streams, including those that use double-byte characters. Updates automatically with the latest protection from SophosLabs a global network of threat analysis centers. Provides end-user quarantine review, allow lists, and block lists. Includes unlimited 24-hour telephone, , and online support, 365 days a year. Full visibility A Domino-based console allows you to manage the quarantine, trace messages and see all traffic and threat activity. Deployment and management A Domino-based console gives you centralized administration across multiple servers, providing automated quarantine management, message tracing, and reporting on traffic and threat activity. You can install PureMessage on standalone and replicated servers and can integrate users and groups with the Notes Address Book (NAB). Two versions PureMessage for Lotus Domino is available in two versions with separate pricing structures: Anti-virus only Integrated anti-virus, anti-spam and content filtering. 5

6 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO 2: CORPORATE POLICY ENFORCEMENT Simplified policy setting and enforcement PureMessage for Lotus Domino allows you to centrally configure and consistently enforce your corporate policies. This helps you to control your organization s flow of information and prevent the accidental or malicious loss of data, or the distribution of inappropriate material. Flexible policies You can customize policies so that incoming, outbound and internal mail are treated differently. An policy that is correctly configured will play a major role in defending against attacks against your network, which is why PureMessage for Lotus Domino comes equipped with a number of pre-installed default policies that are based on our in-depth knowledge of anti-virus and anti-spam enforcement. s and their attachments are scanned for viruses, spam, inappropriate content, keywords and other sensitive information (Figure 2). If an is identified as being suspicious it is either blocked or quarantined. It can also be cleared and then delivered. You can re-write the default policies or create your own to suit your individual requirements and set exemptions for individuals or groups. traffic PureMessage anti-virus scan Clean viruses? Approved sender? Quarantine PureMessage anti-spam scan Is spam? PureMessage content scan Block content? Mail delivered Recipient mailbox PureMessage store scan Figure 2: s are scanned a number of times before they are passed as clean PureMessage for Lotus Domino also allows you to configure your policies to cover direction, making it possible to set one policy for inbound , another for internal and a third for outbound . 6

7 CORPORATE POLICY ENFORCEMENT Policies can be written to detect certain words or phrases within the main content of an or its subject line and can cover attachments, including all common programs. Policies for and store scanning (Figure 3) are independent of each other, giving you a flexibility as to how you manage them. Each policy is defined by a set of jobs, and unlimited numbers of jobs can be configured and prioritized. Default sample jobs facilitate quick organization-wide deployment. Intelligent scanning Policies can detect certain words or phrases within messages and attachments including all common programs. Figure 3: Policies that scan and stores are defined by a set number of jobs which can be customized to suit your needs Each individual job also has a number of aspects that can be configured to suit your requirements, including rules for what types of message the job should apply to, and the kind of information to be scanned for (Figure 4). Figure 4: Each job can be configured in a number of ways 7

8 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO Depending on the job, other attributes can also be configured. For example, you can configure specific parts of a message to scan, which thresholds to use, whether messages should be blocked and/or quarantined, or any notifications that should be generated. Powerful anti-malware scanning PureMessage for Lotus Domino incorporates our malware detection engine which scans all s entering and leaving a Domino server, and those within the Domino message stores. It provides protection against blended threats such as those that combine virus, spam and DoS (denial of service) attacks. PureMessage also supports background scanning which can be set to run continuously or at regular intervals. Industry-leading spam protection Full threat protection PureMessage for Lotus Domino protects against blended threats such as those that combine virus, spam and denial of service attacks. Spam accounts for 97 percent of all business . To combat this, PureMessage for Lotus Domino filters suspicious in hundreds of different ways, one example being a test that looks for the billions of different spellings of the word Viagra. Figure 5: A score system determines if an is treated as spam From the initial scan the solution determines a message s risk level through a scoring system. In the example shown (Figure 5), any with a rating of 80 is categorized as having a high spam rating, while messages scored at 50 are considered a medium risk. You can determine whether the message should be quarantined, discarded or delivered. 8

9 CORPORATE POLICY ENFORCEMENT Malicious hyperlinks Spammers can snare unwary users by placing a malicious hyperlink in an and encouraging them to click on it. PureMessage for Lotus Domino deals with this through spammer asset tracking, and does so by: Evaluating URLs contained in an and blocking those messages that contain links to a known spammer s web assets Filtering URLs and blocking any messages that link to hijacked, freeweb and other suspect websites Checking against the Sophos IP Block List for known spam servers, open proxies and hijacked systems. Content filtering Reputation scanning PureMessage for Lotus Domino runs a reputation check on the server IP address of every it scans. Through its advanced content filtering, which scans attachment and message content, PureMessage for Lotus Domino helps you control the data leaving your organization. The solution s content filters protect your data in a number of ways: Attachment type PureMessage for Lotus Domino can be configured to block certain applications, such as executables, that are considered a security risk or a threat to staff productivity, such as MP3s. The body of an attachment, subject lines and message text can all be scanned. Phrase/regular expression This policy looks for full and partial phrases and regular expressions that you deem unacceptable or a security risk. PureMessage for Lotus Domino comes with a number of out-of-the box dictionaries (Figure 6), which include common confidential terms and offensive language. Dictionaries can also be customized. Figure 6: This dictionary lists the keywords and other confidential information that should be blocked 9

10 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO PureMessage for Lotus Domino can analyze content within common document types, such as Word and Excel, to see if they contains certain words or phrases, for example Financial Report. You can define phrase lists and can include wildcards that match partial phrases. Regular expressions can be added to the policy and provide a powerful way to match specific number or code formats, such as credit cards or other personally identifiable information. Once the content policy has been defined, an action and any exceptions, can be applied when an is captured. Common actions are: Delete Log only Replace with text Quarantine Quarantine and deliver Adding unique text You can add copy to all outbound messages and tailor it to suit specific audiences and senders. The last option allows you to quarantine a blind copy of an , which is particularly useful for monitoring sensitive data contained within outbound s. True file type detection True file type detection ensures that executable files in attachments are not disguised as innocent files, such as jpegs or word processing documents. Disclaimers The disclaimers option allows you to add unique text to all outbound messages and can be configured for specific groups or individual users. Uses could include promotional text being added to s sent from the sales team or helpdesk information from those coming from the IT department. You can also set exceptions so that, for instance, messages coming from a sales or IT director contain information more applicable for their audiences. Quarantine management You can configure policy so that any message identified as infected with malware, spam or as containing inappropriate content is placed into the central quarantine (Figure 7). This gives you a secure area to review the message and perform a number of actions, such as: Forwarding a copy to your inbox Releasing the to its intended recipient(s) Deleting the from the quarantine Disinfecting the Deleting any viral attachment Adding the sender to the global allow or block lists. 10

11 CORPORATE POLICY ENFORCEMENT Saving you time You can allow users to manage their own spam, which keeps IT resources focused on core responsibilities. Figure 7: The quarantine gives you an area where you can safely deal with any messages that are considered a threat. You can also dig down into individual messages to view their specific details, including the job that caused it to be quarantined (Figure 8). In this example the job was catching spam by keyword. Figure 8: Details of individual messages can be accessed to see why they have been flagged as suspicious and placed into the quarantine You can grant end users access to quarantined spam through a web interface and ask them to respond to any immediate concerns about a specific . They can request that a quarantined message be released, or that the sender be added to the allow/block list. Allowing staff to manage their own spam not only ensures that all incoming is correctly identified, but it will help you keep your IT resources focused on core responsibilities. However, please remember that great care should be taken when looking at any message that might contain malware. 11

12 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO 3: COMPREHENSIVE LOGS AND STATISTICS PureMessage for Lotus Domino provides you with extensive reporting, graphs and logging options that are designed to help you analyze your message traffic, quarantines and filter options. You can create customized reports that detail all aspects of your network, such as showing trends in throughput, policy rule hit rates, and any issues that require remedial action. This data can then be exported for further analysis or be included in other office programs such as word processing documents and spreadsheets for management reports. In-depth analysis All threat data captured by PureMessage for Lotus Domino can be exported for later analysis and presentation. Reports can be defined and customized using advanced filters that include: General report formats Output format Report period Server direction. Figure 9: Customized reports can be generated and can be exported to common word processing and spreadsheet packages. 12

13 COMPREHENSIVE LOGS AND STATISTICS Graphs PureMessage for Lotus Domino also provides a number of standard report graphs that include: Quarantines by category Number of messages quarantined Traffic reports Message by trends. Standard reporting Extensive reporting options can analyze and present data quickly and efficiently. 13

14 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO APPENDIX I: SOPHOS PRODUCTS FOR THE ENTERPRISE Sophos Security and Data Protection Sophos Security and Data Protection provides integrated threat management across the entire organization. In addition to Security and Data Protection it includes: Sophos Endpoint Security and Data Protection protects networks from malware and controls unauthorized applications, with centralized management through Sophos Enterprise Console. A single client detects viruses, spyware, adware, suspicious files, suspicious behavior and controlled applications such as VoIP and games and, in combination with a client firewall, stops zero-day threats and prevents intrusion by hackers. Our endpoint protection also comes with integrated network access control. Sophos Web Security and Control is based on a fully-integrated web appliance that protects against the full range of web threats. It provides a complete infrastructure for secure browsing and eliminates the complexity of administering effective web security. Sophos NAC Advanced controls access to the network for guest, unmanaged and unauthorized computers, identifying and isolating non-compliant computers based on a centrally defined, policy-driven assessment. Safeguard Enterprise Encryption from Utimaco is now available from Sophos since the encryption specialist became part of the Sophos group. The solution complements Sophos endpoint, gateway, and network access control solutions and prevents data access, loss or theft with centrally managed full disk encryption for laptops, desktops and removable storage devices. It can also detect and block use of removable storage devices, optical media drives and wireless networking protocols. 14

15 APPENDIX II: OTHER SOPHOS PRODUCTS AND SERVICES APPENDIX II SAV Interface SAV Interface enables software vendors, OEMs, ISPs, and ASPs to integrate Sophos malware detection into their own firewalls, gateways, and solutions, and is included in Security and Data Protection and Web Security and Control licenses. Sophos Small Business Solutions Sophos small business solutions provide award-winning virus, spyware, and spam protection to enterprises with little or no IT expertise. Sophos Professional Services Sophos Professional Services provide businesses with the skills to implement and maintain complete endpoint and gateway security. We have worked with some of the most recognized organizations in the world, meeting their specific requirements and assuring rapid, optimal deployment of Sophos products. Our expertise is delivered through standard or customized packages, provided onsite or remotely, to ensure the maximum return on your investment. Sophos Alert Services Sophos ZombieAlert Service provides you with immediate warning if spammers have hijacked any of your organization s computers to send spam or launch denial-of-service attacks. Sophos PhishAlert Service provides fast, near real-time alerts of phishing campaigns, so that you can take steps to shut down the imitation website and protect your organization s customers. Sophos WebAlert Service provides your organization with an automatic warning if any of your webpages are infected by malware. For more information on Sophos Alert Services, visit:

16 REVIEWER S GUIDE: SOPHOS PUREMESSAGE FOR LOTUS DOMINO Industry-leading, 24/7 support Our round-the-clock technical customer support operation is included in your license, giving you unlimited access to our highly-acclaimed customer support team. You can contact our engineers for one-to-one support by or telephone, or use our web-based support knowledgebase. Working from support centers around the world, our experts draw on a wealth of experience and technology to replicate, analyze, and resolve your problems fast. Our technical support operates from centers in Australia, Canada, France, Germany, Japan, Italy, Singapore, UK and USA. Whichever center handles your problem, you can be assured of the highest level of expertise, professionalism and customer service. For more details, visit 16

17 APPENDIX III: PUREMESSAGE FOR LOTUS DOMINO SYSTEM REQUIREMENTS APPENDIX III server* Lotus Domino server R7, R8.0x, and R8.5 (32-bit/64-bit) Operating system Windows 2000 Server Windows Server 2003 (32-bit/64-bit) Windows Server 2008 (32-bit/64-bit) *Lotus Domino server R6 is supported by PureMessage for Notes/Domino v3 17