Copyright 2011 Sophos Ltd. Copyright strictly reserved. These materials are not to be reproduced, either in whole or in part, without permissions.

Transcription

1 PureMessage for Microsoft Exchange protects Microsoft Exchange servers and Windows gateways against borne threats such as from spam, phishing, viruses, spyware. In addition, it controls information sent and received both internally and externally against loss of information or inappropriate use of system. This module will take you approximately 45 minutes. Copyright 2011 Sophos Ltd. Copyright strictly reserved. These materials are not to be reproduced, either in whole or in part, without permissions. Version: April

2 2

3 3

4 4

5 5

6 Sophos Security and Data Protection enables security, control and data protection across the infrastructure. At the gateway level Sophos offers 3 solutions an appliance solution a UNIX software solution a Windows software solution At the groupware level Sophos offers 2 solutions a Microsoft Exchange solution a Lotus Notes/Domino solution 6

7 These are the main differences between the four solutions. For more details check the document called: Compare security products on the Sophos website 7

8 Please take a moment to answer these questions. 8

9 9

10 10

11 11

12 PureMessage can be installed on Exchange servers with the following server roles Exchange 2000 and Exchange 2003 front-end and back-end servers Exchange 2007 and Exchange 2010 Edge, Mailbox and Hub services PureMessage cannot be installed on a dedicated client access server or on a dedicated unified messaging server. messages processed by services such as Outlook web access ActiveSync POP3 IMAP Voic Fax are only protected once the s are processed by a supported Exchange server role. 12

13 PureMessage can also be installed on Windows gateways without Microsoft Exchange as long as Microsoft Internet Information Services (IIS) SMTP server is pre-installed and pre-configured. IIS SMTP server is included in all supported versions of Microsoft Windows. 13

14 A trusted relay is an server that processes s between the internet and the PureMessage server such as your ISP SMTP server(s) an internal relay located upstream, such as a Sophos Appliance or PureMessage for UNIX gateway Trusted relays must be defined correctly for accurate spam detection and for routing. 14

15 PureMessage scans via Transport SMTP scanning Exchange store scanning This table shows how PureMessage defines inbound, outbound and internal for Transport SMTP scanning. The list of mail domains is defined under System Routing in the administration console. For PureMessage an external address is any address not part of the following subnets: to to to *Please note that: On Exchange 2000 and Exchange 2003 internal transport SMTP scanning is not available on s exchanged between two mailboxes on the same server. In this scenario Exchange store scanning should be used to provide anti-virus scanning for internal s. On Exchange 2007 and Exchange 2010 internal transport SMTP scanning is always performed by the hub service. 15

16 Multiple PureMessage servers can be grouped as long as they share the same PureMessage database. PureMessage configuration groups allow: Centralized policy management Centralized quarantine management Centralized reporting 16

17 PureMessage configuration groups can be extended to Exchange clusters. In this example we have a PureMessage group for the Microsoft Exchange Active/Active/Passive cluster with the PureMessage database on a Microsoft SQL server Active/Passive cluster. For more information on supported cluster environments check the next section: system requirements. 17

18 Please note that PureMessage s integration with Sophos Enterprise Console Sophos EM Library, Sophos Update Manager Sophos Control Center is optional. The PureMessage installation creates anti-virus exclusions automatically. If using Enterprise Console or Sophos Control Center, you must define these exclusions in the console s anti-virus policy. For more information on PureMessage exclusions use the following article: 18

20 20

21 21

22 These are the main system requirements for PureMessage when installed on a Microsoft Exchange server. Please note that Windows 2000 and Exchange 2000 are not supported any more by the latest version of PureMessage. 22

23 These are the main database requirements for PureMessage. If no database is already installed Microsoft SQL Server Express will be installed automatically. If any of the other elements above are not present on the server, they will be installed automatically during PureMessage installation 23

24 These are the main system requirements for the PureMessage administration console. Please note that the console supports the same operating systems as for Exchange servers with the addition of the 3 systems listed in this page. 24

25 These are the main system requirements for PureMessage when installed on a server without Microsoft Exchange. 25

26 Prior to installing PureMessage, Microsoft IIS must be installed and configured. PureMessage uses the IIS web services as well as the IIS SMTP services. Microsoft IIS stores undelivered s in the badmail directory defined in the IIS Manager transmission settings. To avoid using up disk space, consider running a scheduled task that deletes files in this directory. For more information on the configuration of IIS SMTP server check the following Microsoft articles:

27 These are the main network requirements for PureMessage for external connections and internal connections. Please note that Windows, Microsoft Exchange, a remote database or a remote console may need additional network services. 27

28 The most common installation scenarios, including multi-server and cluster installations, are documented in the startup guide. Upgrades are documented in the upgrade guide. Ensure you read the system requirements in this guide. Ensure you read the known problems section in the release notes. 28

30 30

31 31

32 32

33 SophosLabs analysts in Sydney, Oxford, Boston and Vancouver use a variety of detection techniques to provide 24x7 protection. Many of these techniques use automated systems, increasing speed and efficiency of detection. The following is a list of the main detection techniques in use 24x7: Genotype malware identities: identities written by Sophos analysts to detect variants of known malware threats. Other malware identities: identities written by Sophos analysts to detect malware threats not proactively detected by Genotype malware identities. Sender Genotype: a list of known spammer IP addresses and a list of rules to detect suspicious hosts Calls to action: a list of known web links (URI) and phone numbers used by spammers Genotype campaign analysis: definitions written by Sophos analysts to detect complex spam campaigns Checksums: a list of checksums from selected messages and paragraphs extracted from known spam campaigns Image attachment fingerprinting: a list of checksums using image meta data extracted from known spam campaigns Spam heuristic rules: a combination of rules looking for common characteristics found in spam messages SXL: a database of anti-spam data which provides a realtime lookup service for the Sophos antispam engine As a result SophosLabs is able to achieve more than a 99% spam detection rate with low false positives. SophosLabs also detects up to 93% of new malware threats without requiring an update with Genotype identities. 33

34 This slide highlights the 4 main types of data sources used by SophosLabs: Honeypot network Third party resources that report and share threat information Spam traps addresses from over 50 countries collecting millions of spam messages daily Sophos customers Send data: automatically from Sophos appliances and from Sophos PureMessage manually via the Sophos website Scanning the world wide web Data-sharing partnerships with search engines 34

35 PureMessage for Microsoft Exchange provides security and control by scanning inbound, outbound and internal traffic flows as well as the Exchange store. Transport SMTP scanning is available both for Microsoft Exchange and IIS SMTP servers, except on servers configured as a mailbox-only role 1. Filtering blocks senders using a custom block list Filtering also blocks invalid recipients 2. Anti-spam controls and secures against spam, phishing and other scams 3. Anti-virus secures against trojans, viruses and spyware and controls encrypted attachments 4. Content controls content 5. Disclaimer adds banners to outgoing s 6. Based on the policy results messages can be: deleted modified quarantined and or delivered and an alert be sent 7. Finally all results are stored for the reports Exchange store scanning is only available on Exchange servers with mailboxes or public folders At this level anti-virus secures against trojans, viruses and spyware and controls encrypted attachments 35

36 The Administrator s console is based on the Microsoft Management Console (MMC). The console provides centralized management for the PureMessage Server group. From the console: the Dashboard provides statistical data of the PureMessage servers the Activity monitor displays message counters and action counters System configures multiple policy settings, such as log settings or tagging Users and Groups allow you to synchronize with Active Directory and to create custom users and groups Filtering enables you to block specific senders and to allow recipient validation Anti-virus defines anti-virus policies Anti-spam defines anti-spam policies Content defines content policies Disclaimers defines disclaimers policies Exchange store scanning defines anti-virus policies for the Exchange stores Quarantine searches and displays quarantine messages Reports generates reports 36

37 User groups can be: imported from Microsoft Active Directory and/or created manually with a list of addresses These groups are then used as part of the policies as well as recipient validation. 37

38 policies include: Filtering options Anti-virus policies for infections, encrypted messages and encrypted attachments Anti-spam policies for spam and suspected spam Disclaimers policies Content filtering policies for suspicious attachments, restricted attachments, blocked phrases and offensive language. With content filtering: Attachments can be identified by attachment type, by attachment name, by attachment size and/or as potentially unwanted applications (PUAs) Blocked phrases and offensive language use strings and regular expressions. It can scan the subject, body and attached documents. For more information on filtering attachments read Appendix E in the PureMessage startup guide. Anti-virus and Content policies can have different settings for Inbound, Outbound and internal messages. alerts can be sent to administrators, senders or recipients for each policy test. Policies are by default set to apply to all users. Exceptions for specific users and/or groups can be set for each policy with differing actions. For example: You can quarantine inbound messages with restricted attachments except for the IT group You can also send different disclaimers for different groups of users. 38

39 Exchange store scanning provides a second layer of virus protection using the Microsoft Virus Scan API. The private store contains the users mailboxes, the public store contains the users public folders. On-Access scanning automatically checks files when you read them. Proactive scanning checks new files as they arrive in the store. Background scanning periodically checks all items in the store. Please note that it can use significant system resources. If you want to use it you should use the feature to Enable background scanning only for out of working hours. 39

40 Spam management comprises 4 areas: 1. Anti-spam policies This is where messages detected with spam and suspected spam scores can be processed by policies. This is also where you can adjust the anti-spam settings, although Sophos recommends to keep the default settings. 2. Allow/Block specific senders This is where you can bypass the anti-spam rules managed by SophosLabs. These features need to be used with care. For example, allowing all s from an entire mail domain would result with bad spam catch rates. 3. End user spam quarantine management This is where you can delegate some responsibility for managing inbound spam to its intended recipient. This is available via: an quarantine digest with a link to the web quarantine access Web quarantine access using HTTP on port Administrator spam quarantine management This is where administrators can search, view the messages details, release, forward or delete them. 40

41 You can configure policies so that a message identified as unacceptable, spam or inappropriate content is placed into PureMessage central quarantine, giving the administrator a secure area of the network in which to view the details and decide what to do with it. In a PureMessage server group quarantine management can cover individual servers or all servers in the group. 41

42 From the management console, administrators can view, print and export 25 standard reports. In a PureMessage server group reports can cover individual servers or all servers in the group. 42

43 Sophos provides the following support services: Online support knowledgebase The ability to contact Sophos technical support 24x7 by or telephone Additionally: PureMessage checks for threat definition from SophosLabs every 5 minutes PureMessage checks anti-spam definitions in real time from SophosLabs using SXL 43

45 45

46 The product documentation can be downloaded from the support section of the Sophos website. Under product maintenance administrators can also: download the latest version of PureMessage check whether a specific version of PureMessage is still supported or not (lifecycle) 46

47 The support knowledgebase offers a large number of support articles such as: How to submit a spam sample to SophosLabs PureMessage for Microsoft Exchange disaster recovery planning 47

48 The reviewer s guide document provides a review of the core functionalities of PureMessage for Microsoft Exchange. 48

49 Sophos interactive showroom is: the best and most cost effective way to demonstrate PureMessage for Microsoft Exchange a fully interactive, hosted product environment a fully functional product environment with multiple machines and test data designed to play with, learn and demonstrate to prospects accessible via Microsoft Internet Explorer available on-demand and scheduled access For more information contact your account manager. 49

50 This demonstration enables you to navigate through PureMessage for Microsoft Exchanges administrator console with mock-up data. 50

51 To access a 30 day product trial, select Free trials from the Sophos website home page To convert this trial into a full product you only need to replace the trial username and password in Sophos AutoUpdate. 51

53 You should now be able to: describe how the solution fits in common infrastructures qualify the main system requirements describe 10 main features of the solution find additional Sophos online resources 53

54 Thank you for taking the time to study the PureMessage for Microsoft Exchange technical overview course. Feedback is always welcomed as it helps us to improve our courses for you. Please with your comments. You can now take your online assessment. This should take around 15 minutes. 54