Outlook Safe Sender s Filtering

Transcription

1 Outlook Safe Sender s Filtering User s Guide Also Guide to Making Internet Explorer More Secure By: Gregg Sterner Trellix Engineering Corp.

2 Table of Contents Introduction... 1 This Manual... 3 Junk Filtering... 4 Junk Mail Options... 4 Safe Senders List... 7 Safe Recipients List... 9 Blocked Senders List International Lists False Positive s Menu Bar Buttons Additional Reading Internet Explorer Security Table of Figures Figure 1 - Outlook Version Number... 3 Figure 2 - Junk Menu Option Figure 3 - Junk Menu Option Figure 4 - Junk Options Window... 6 Figure 5 - Safe Senders List... 7 Figure 6 - address In A Contact... 8 Figure 7 - Add to Safe Senders List... 8 Figure 8 - Safe Recipients List... 9 Figure 9 - Blocked Senders List Figure 10 - Add To Blocked Senders List Figure 11 - International Lists Figure 12 - Blocked Top-Level Domain List Figure 13 - Blocked Encodings Lists Figure 14 - Mark As Not Junk Figure 15 - Mark As Not Junk Confirmation Figure 16 - Add Junk Mail Button Figure 17 - Select the Add to Blocked Senders List Figure 18 - Drag the new button to the button bar Figure 19 - New Junk button Figure 20 - Rename the Blocked Senders Button Figure 21 - Add An Image To The Junk Button Figure 22 - New Junk Button Figure 23 Menu Bar Figure 24 Default Security Level Figure 25 Reset Security Defaults Figure 26 - Trusted Sites Figure 27 Trusted Sites List Figure 28 Privacy Settings Figure 29 Advanced Privacy Settings Figure 30 Per Site Privacy Actions Figure 31 Turn off Sounds in Web Pages Figure 32 Default Programs Page ii

3 Introduction Junk is on the rise again. SPAMMERS have even found a way to use the Adobe PDF files to send SpyWare and computer viruses into your PC. Also, a lot of the SpyWare and computer viruses are attempting to turn your PC into a computer zombie so that it can become a member of a Botnet without you knowing it. What is a Botnet? You can read more about it at the free on-line encyclopedia Wikipedia at: Junk or un-wanted and their infected attachments are one of the major methods of infecting your computer. Another method the SPAMMERS like to use is putting a link to a web site in an in order to direct you to a web site. The web pages at that site could have SpyWare, Botnets, or computer viruses embedded within them so that as soon as you open those web pages those un-wanted programs download into your PC without you knowing it until its too late. Overall, the most effective weapon against SpyWare and computer viruses is good old human common sense and education. Likewise, the most disastrous weapon to destroy your PC is the lack of using that common sense and operating a PC without trying to learn the most basic concepts of how to use it properly. Much of the junk today is targeted at stealing your identity. Junk e- mail used to be targeted to destroying your PC; however, it has turned from the thrill of crashing a PC to the thrill of cashing in on your bank account. When you are at the office, keep in mind that your office PC is not your home entertainment system. Don t download programs from the Internet. DO NOT respond to those Download Now ; Click Here to get the latest protection, Click here for those cute cursors ; Click here to get the latest screen savers. DO NOT install tool bars from places like Yahoo, Google, Hotbar, Smiley Faces, etc. All of these pretty extras how the potential of causing problems with the proper operation of your office programs. Most of them have popup blockers that interfere with normal operations. Internet Explorer already has a pop-up blocker built into it. Therefore, when you add another pop-up blocker on top of Internet Explorer s pop-up blocker strange effects start to happen. We ll discuss more about that later. Every time you install those quite toolbars, screensavers, greeting cards, smiley faces, PC scans, etc. you are adding programs to your PC that use your computer memory. Soon, your computer will run out of the memory that it needs to operate effectively. Your computer will slow down to a crawl and you are effectively crippled and can t work. Sorry, no worker s comp. here. It s your own fault. You re the one that has killed your PC. Page 1

4 For now, just remember, anytime you download something from the Internet you run the risk of infecting your PC with something strange. Also, some programs downloaded from the Internet are so poorly written by their authors that the program cripples your PC. Now back to Junk mail. The best guide to Junk mail is that if it looks strange, DELETE IT. You don t need to notify your IT department. In % of the cases your IT people already know about the crap that comes in the mail plus a lot of stuff the average person doesn t want to know. Again, just to emphasize, the most important weapon against the crap is YOU. Take the time to learn the basics and DO NOT DOWNLOAD anything from the Internet unless you know for sure that it will DO NO HARM to your PC or your personal identity. Why Me, Why Now I m often asked, Why is my going to the Junk folder all of a sudden. It didn t used to? The struggle between Junk Mail/Spam Filter Vendors and Spammers is like the age old struggle between Good and Evil. It s a constant tug-of-war. The Vendors change or improve their Filter algorithms to trap more Junk and Spam s then, the Spammers find ways around the filters and you start getting more crap in your Inbox. Then, the cycle repeats itself over and over in a constant tug-of-war. As users, we re caught in the middle of this war. The worst part is that when the Filter Vendors change their algorithms more false positives are created thus sending legitimate to the Junk folder. Fortunately, we are able to mark those false positives as safe using the Safe Senders list described later in this manual. Again you say, Why? Unfortunately, only the Filter Vendors know and they re not talking since giving us a detailed explanation of Why would reveal their methods and algorithms to the Spammers thus making it open season on Junk mail for the Spammers. Don t give up hope. Junk and Spam Filters today are far superior than when they were first introduced in Microsoft Office 2002 several years ago. Also, the anti-virus vendors are now starting to include Junk and Spam Filers in their Anti-Virus software. Vendors and law enforcement agencies are joining together to gang up on Spammers in that gradually, Spammers are being hunted down and are being prosecuted. I know it s just a drop in the huge ocean of Spammers, however, it s a start and it s being perused more aggressively every day. Page 2

5 This Manual This manual applies to the Junk Mail filter system in Microsoft Outlook version 2003 and above. The procedures here are similar for other clients like Outlook; however, the exact steps involved to implement the filtering process may be different. You can find the version number for Outlook by selecting, from the menu bar, Help then select About Microsoft Office Outlook. from the dropdown menu. The version number will be listed on the top line as shown below. Figure 1 - Outlook Version Number This manual will describe the most effective and highest level method of filtering out junk . Initially, there will be a lot of false positives and you will need to review your Junk Mail folder to find those false positives before deleting your junk mail. Basically, you will need to train your system to allow the good mail to pass and the junk to become trapped and filtered out of your system. No filtering system is perfect. While the human cognitive skills are the best determiner of right and wrong, computers do exactly what you tell them to do. Their best trait is that they can do it 24 hours a day and faster than a human can. Page 3

6 Junk Filtering The Junk Mail filtering system in Microsoft s Outlook version 2003 and above is quite good. Older versions, quite frankly, were a joke. The downside is you must train it to understand which s are from good or trusted senders and which are junk. The Junk Mail system in Outlook has some basic programming inside of it to filter out a lot of junk (SPAM) however, like any such program it will also filter out that you really want to keep unless you tell it what to look for. When trying to identify those s from your family, friends, and business associates. Junk Mail Options Outlook 2003 In Outlook 2003 there are two methods of opening the Junk Mail options window: Method 1: On the Outlook menu bar select: Actions > Junk > Junk Options. Figure 2 Open Junk Menu Method 1 Method 2: Right-click on any title and select: Junk > Junk Options from the drop down menus. Figure 3 Open Junk Menu Method 2 Page 4

7 Outlook 2010 In Outlook 2010 there are two methods of opening the Junk Mail options window: Method 1: On the Outlook menu bar select: Junk > Junk Options. Method 2: Right-click on any title and select: Junk > Junk Options from the drop down menus. Page 5

8 Once the Junk Options window opens you will see the various option levels listed. Safe Lists Only is the highest setting for this system. This is the level we will be discussing in this manual. Figure 4 - Junk Options Window The Safe List Only option means that only those s on your Safe Sender s List will be allowed through to your Inbox. Once you have selected the desired option you need to setup the various Lists as shown on the tabs at the top of the Junk Options window. These lists will be discussed further in this manual. Page 6

9 Safe Senders List You need to allow all of the addresses for the people that want to receive e- mails from by adding them to the Safe Senders list. Figure 5 - Safe Senders List If you want to add a group of people, such as everyone in your office, you can add a global Safe Sender by using symbol plus the domain name. Unfortunately, many SPAMMERS will also use domain names with false user names in SPAM addresses. Check the two options at the bottom of the list. The Also trust from my Contacts option means that if you have addresses in the contact profiles for the people in your contacts list those addresses will also be considered a safe sender. See Figure 6 below. The Automatically add people I to the Safe Senders List option is self explanatory. You should review your Safe Senders List periodically and edit the list as needed. Page 7

10 Add addresses to your contacts and they will automatically be added to your Safe Sender s List. address goes here. You can add up to 3 s per contact. Figure 6 - address In A Contact You should review your Junk folder and add any false positive e- mails to your Safe Senders List by right-clicking on the title then select Junk > Add Sender to Safe Senders List menu items. Figure 7 - Add to Safe Senders List Page 8

11 Safe Recipients List The Safe Recipients List should only be used for special addresses when you want and to bypass the Junk filter. Do not add your personal address here. Remember, SPAMMERS are sending to your personal address. Therefore, if you put your address here all of the SPAM will bypass the filter and go directly into your Inbox. Figure 8 - Safe Recipients List If you use Outlook to receive s through multiple accounts you may want all s sent to a specific account address to pass through the filter regardless of who sent it. If so, add that address to the list above. Page 9

12 Blocked Senders List Your Blocked Senders List should be used for those s that make it through the filter. Figure 9 - Blocked Senders List You can quickly add an address to the Block Senders List by rightclicking on the title then select Junk > Add Sender to Blocked Senders List as shown below. Figure 10 - Add To Blocked Senders List Page 10

13 International Lists The International Lists can be used to tighten filtering even move. The definitions of the options are shown below. Figure 11 - International Lists Page 11

14 Blocked Top-Level Domain List A lot of SPAM comes from foreign labeled addresses. You can block a wide range of s from different countries. Remember to un-block those countries for which you receive s on a regular basis. Figure 12 - Blocked Top-Level Domain List Most s use the US-ASCII and Western European formats. You can block all or none of the language formats. Figure 13 - Blocked Encodings Lists Page 12

15 False Positive s Remember to review the s in your Junk folder for any false positive s. If you find an in your Junk folder that you know for a fact is not Junk, you can mark it as Not Junk. Right-click on the title and select Junk > Mark as Not Junk. Figure 14 - Mark As Not Junk You will then see a pop-up confirmation window that when approved, will add the indicated address to the Safe Senders Lists. Figure 15 - Mark As Not Junk Confirmation Page 13

16 Menu Bar Buttons I m sure you ve noticed that marking an as junk takes several mouse clicks. If you get a lot of junk you going to want an easier way to mark e- mails as junk. You can do this by adding two buttons to the button bar at the top of Outlook. 1) Select View > Toolbars > Customize Figure 16 - Add Junk Mail Button 2) Select the Customize Tab > Actions > Add Sender to Blocked Senders List Figure 17 - Select the Add to Blocked Senders List Page 14

17 3) Hold down the left mouse button and drag it to any place on the button bar then release the mouse button. Figure 18 - Drag the new button to the button bar Note: Do not close the Customize window yet. You will not see a large button on the button bar with the button title on it. Obviously this button is too large so in the next step you are going to modify it. Figure 19 - New Junk button Page 15

18 4) Change the Name of the button to Junk. Figure 20 - Rename the Blocked Senders Button 5) Change the button image to one you desire. Figure 21 - Add An Image To The Junk Button Page 16

19 6) Now you have a simple button that you can press to add the address to the Junk Senders List. Figure 22 - New Junk Button 7) If you desire, you can repeat the process for the Add Sender to Safe Sender s List action item. Page 17

20 Additional Reading Microsoft provides a wide range of reading materials on their web site at: US&form=MSHOME&setlang=en-US&q=junk+mail More information about Junk mail filters for Outlook can be found at: More information about Junk mail filters for Outlook Express can be found at: Page 18

21 Internet Explorer Security The following instructions describes the process for configuring Internet Explorer to run securely. While these steps will make your Internet Explorer more secure at this time, hackers are constantly trying to find ways around these settings. Additionally, many of these settings will block use of custom application sites such as Medical portals and web based applications. Care must be used when making any changes to these settings. You should make only one or two changes at a time and always make a note of which settings you change so that you can undo them should you find that they are too restrictive. Here are the key configuration changes you can make to disable various features and reduce the attack surface in Microsoft's Internet Explorer. This guide provides a walkthrough of IE 6.0 but applies to the latest IE 7.0 as well. (This guidance was prepared and distributed by Will Dorman, vulnerability analyst at Carnegie Mellon Software Engineering Institute CERT Cordination Center). Figure 23 Menu Bar To get started, to Tools > Internet Options. Please note that these options may vary slightly depending on your browser version. Page 19

22 Click on the Security tab which shows the various IE security zones. For each of these zones, you can select a Custom Level of protection. By clicking the Custom Level button, you will see a second window open that permits you to select various security settings for that zone. The Internet zone is where all sites initially start out. The security settings for this zone apply to all the web sites that are not listed in the other security zones. We recommend the High security setting be applied for this zone. By selecting the High security setting, several features including ActiveX, Active scripting, and Java will be disabled. With these features disabled, the browser will be more secure. Figure 24 Default Security Level Click the Default Level button and then drag the slider control up to High Page 20

23 You can click on the Custom Level button to get a more granular control over what features are allowed in the zone. Here you can control the specific security options that apply to the current zone. Default values for the High security setting can be selected by choosing High and clicking the Reset button to apply the changes. Figure 25 Reset Security Defaults Page 21

24 Trusted sites is a security zone for web sites that you believe are securely designed and contain trustworthy content. To add or remove sites from this zone, you can click the "Sites" button (see next slide). CERT/CC recommends that you set the security level for the Trusted sites zone to Medium. When the Internet Zone is set to High, you may encounter web sites that do not function properly due to one or more of the associated security settings. This is where the Trusted sites zone can help. If you trust that the site will not contain malicious code, you can add it to the list of sites in the Trusted sites zone (see next slide). Figure 26 - Trusted Sites Once a site is added to this zone, features such as ActiveX and active scripting will be enabled. The benefit of this type of configuration is that IE will be more secure by default, and sites can be whitelisted in the Trusted sites zone to gain extra functionality. Page 22

25 When you click on the "Sites" button (previous slide), a new window pops up that lists the sites that you trust and permit you to add or remove sites. You may also require that only sites with Secure Sockets Layer (SSL) implemented can be active in this zone. This permits you to verify that the site you are visiting is the site that it claims to be. Figure 27 Trusted Sites List In the Privacy tab, you can configure settings for (text files placed on your computer to track your movements about the Web. CERT/CC recommends that you select the Advanced button and select Override automatic cookie handling. See next slide for instructions on how to configure this setting. Figure 28 Privacy Settings Page 23

26 Select Prompt for both first and third-party cookies. This will prompt you each time a site tries to place a cookie on your computer. You can then evaluate the originating site, whether you wish to accept or deny the cookie, and what action to take in the future (always accept, always block, or continue to ask). Figure 29 Advanced Privacy Settings By selecting the "Sites" button (go back two slides), you can manage the cookie settings for specific sites. You can add or remove sites, and you can change the current settings for existing sites. The bottom section of this window will specify the domain of the site and the action to take when that site wants to place a cookie on your computer. You can use the upper section of this window to change these settings. Figure 30 Per Site Privacy Actions Page 24

27 In the Advanced tab, you can find default settings used by all zones. The settings contained in the Multimedia section have features that you can adjust to protect against some potential vulnerabilities. For instance, attackers may be able to track your usage or exploit the software you use to play multimedia data. CERT/CC recommends disabling the options to play sounds and videos by unchecking these boxes. Figure 31 Turn off Sounds in Web Pages Page 25

28 Under the Programs tab, you can specify your default applications for viewing Web sites, s, and other network related tasks. You can also prevent Internet Explorer from showing you a message asking to be your default Web browser. Figure 32 Default Programs Page 26