Transitioning to McAfee SaaS Protection from Postini

Transcription

1 Technical FAQ Transitioning to McAfee SaaS Protection from Postini Frequently Asked Questions Google recently and abruptly announced that all Postini customers must either migrate to Google Apps, which includes a paralyzed version of Postini, or terminate their contract upon expiration and move to another vendor: To make matters worse, the Google Apps filter will not maintain many of the valuable features that IT departments have come to depend on. Therefore, it s no surprise that McAfee has welcomed scores of Postini customers to its award winning McAfee SaaS Protection service since the announcement. Q: Why Choose McAfee? A: There are many reasons why you should switch from Google/Postini to McAfee: As the world s largest dedicated security vendor, McAfee s primary focus will always be providing the highest level of security to our customers. When it comes to security, McAfee solutions goes beyond defending against spam, phishing, malware, and blended attacks, to also help customers secure outbound communications via integrated encryption, a robust set of pre-built compliance templates, the ability to scan 300+ attachment types, and data loss prevention technologies to safeguard data from bad actors or accidental mishaps. continuity and archiving are integrated as part of the solution. McAfee has a long-term commitment to security, demonstrated by our history of frequent product enhancements, and over 10 years of operational excellence. We understand that providing good customer service requires more than just a support web site, which is why McAfee provides 24x7 live customer support at no additional charge. McAfee recently received these important industry recognitions for security: Leader, Gartner Magic Quadrant for Secure Gateway Leader, Forrester Wave for Content Security Value Leader, EMA Radar Report for Hosted Security 5-Star Best Buy, SC Magazine Content Security Innovator: Data Protection, SC Magazine McAfee is ISO certified and serves tens of thousands of businesses and millions of end users worldwide: Console localized for end users in 18 languages Localized processing with data centers in North America, Europe, Asia, and Australia. McAfee SaaS Archiving is SEC-compliant and provides up to a 10-year retention period, guaranteed regional data storage based on your designation, and localized administrative and end-user console in 18 languages. Integration with McAfee SaaS Web Protection helps organizations optimize security for greater cost effectiveness. Q: How is McAfee SaaS Protection Different than Postini and Google Apps? A: First and foremost, McAfee keeps your safe with our defense In-depth approach to threat protection, utilizing three AV engines, zero hour protection, and most importantly, McAfee Global Threat Intelligence (GTI). GTI is McAfee s cloud-based threat identification network, drawing threat data from over 100 million global listeners and billions of transactions per day.

2 Differentiators to consider: McAfee offers Spooling options for instances when cannot be delivered to your network due to outages, including the ability for users to interact with spooled Outbound filtering including built-in DLP and integrated encryption services 60 days of audit logging versus Postini s 45 days Near-real time message audit records availability Proxy-based filtering, which minimizes disk writes and provides senders with accurate chain of custody information, as opposed to Google Apps store-and-forward model McAfee s proxy architecture won t overwhelm your system with unnecessary connections. No character limit on allow/deny list entries With convenient roles like quarantine administrator McAfee makes it easy for organizations to delegate appropriate levels of access to the corporate helpdesk Easy-to-use TLS, SPF, and DKIM functionality, supporting your ability to enforce authentication best practices Migration Process Overview In this guide, we ll show you the most common configuration tasks, but keep in mind that there is a lot more to McAfee SaaS Protection than what you ll find here! To learn more, we highly recommend attending one of our free online training classes. Setup can take anywhere from a few minutes to several days depending on your knowledge level and the complexity of your infrastructure. Tasks 1. Preparation 2. Configure inbound delivery 3. Configure inbound server failover 4. User creation 5. Configure inbound policies 6. Configure outbound policies 7. Inbound cutover 8. Outbound cutover

3 Task 1: Preparation 1. In your preferred browser, login using your administrator account to the Postini Message Center System Administration module. 2. Open a new browser tab and login using your administrator role to the McAfee SaaS Control Console. Both web sites should now be easily accessible by clicking on the respective browser tab. This will make it easier for you to transfer some of your settings from one console to the other. Postini Message Center (below) McAfee SaaS Control Console (below) Task 2: Configure inbound delivery 1. From the Postini Message Center, navigate to the Inbound Servers > Delivery Manager 2. In the McAfee Control Console, navigate to the Protection tab >Setup tab >Inbound Servers screen 3. Copy and paste each server in Postini to an SMTP Host Address field in the McAfee SaaS. Click the Add New Host button to expose additional rows.

4 4. Be sure to Test Connectivity to ensure that McAfee SaaS can connect to your network. 5. Repeat this process for each of your domains and don t forget to click the save button! Tip: McAfee SaaS always attempts to send and receive using TLS encryption regardless of your settings.

5 Task 3: Configure inbound server failover 1. Configure server failover by entering your failover server(s) into a vacant SMTP Host Address row but with a higher preference than your primary server(s). In the example below there is one primary (preference 10) and one failover (preference 20). 2. In this example, you can see how to configure two primary servers and two failover servers. Task 4: User creation There are five convenient ways for you to populate user accounts: SMTP Discovery recommended for small organizations Manual entry Batch import Active Directory (AD) Pull Sync recommended for medium-sized organizations AD Push Sync recommended for large organizations and enterprises Once created, users will automatically receive a daily spam report so that they can safely review quarantined spam messages without assistance from IT. View your user creation settings by navigating to the Setup tab >User Creation Settings link.

6 SMTP Discovery SMTP Discovery is the default user creation method and the easiest option to administer because it automatically creates your users as they receive valid . Manual Entry You can enter users manually by navigating to the Account Management tab >Users tab > Click the New button on the toolbar and select Creation Mode: Individual. Enter users one at a time. TIP: To add aliases from the user list on the Users tab, double click on the user and navigate to the Aliases tab.

7 Batch Import To batch import users from a file, follow the same process as before, but this time select Creation Mode: Batch instead of Individual then browse to the file containing a listing of your users. The online help contains additional information on the use of this feature, including the required file format. AD Pull Sync AD Pull Sync automatically imports users from your AD without any on-premises software. Access this feature by navigating to the Account Management tab >Configuration tab >Directory Integration link and select Domain from the combo list. Please refer to the online help for more information on configuring AD Pull Sync.

8 AD Push Sync AD Push Sync requires the epolicy Orchestrator-based Directory Services Connector software plugin but it has the advantage of not requiring you to expose your AD to the McAfee SaaS through your firewall. To locate this feature, navigate to the same location as before but select Logical Structure: AD Domain from the Logical Structure combo list. To learn more about this feature, please refer to the online help and the Directory Services Connector Getting Started Guide, downloadable from the Control Console (highlighted below). Task 5: Configure inbound policies The default inbound policy settings are sufficient for most organizations to get started, but there is a great deal of customization to consider. The Default Inbound policy will be applied to all users and groups not assigned to another inbound policy. You can create additional policies and assign those policies to domains or groups by navigating to the Policies tab >Inbound Policies and click the New button.

9 One policy will be applied to each user. If a user is assigned to multiple policies by virtue of their group membership, the policy with the higher priority will be applied. Assign a group to a policy by opening a policy and clicking on the Group Subscriptions tab. Spam Filtering Levels The remaining topics in this section refer to features found inside your inbound policies, which can be viewed by double clicking on any inbound policy. McAfee SaaS categorizes spam in three categories, each has unique actions: Medium likelihood default action = quarantine) High likelihood default action = deny) Graymail default action = allow) Newsletters and retail marketing from reputable sources are examples of graymail that was once desirable but have since become a distraction. The graymail filter is designed to aggressively reduce this traffic. Tuning is achieved by adding graymail senders that you want to receive mail from to your policy-level or user-level Sender Allow list. You may find that enabling the Graymail filter more closely matches the default level of filtering Postini applied to graymail senders.

10 End User Spam Report Configuration Delegating spam quarantine management to end users can be a useful cost savings measure for your IT department. End users interact with McAfee SaaS via the end user version of the Control Console or through Spam Report s, or both. McAfee SaaS simplifies end user access to the Control Console by including auto sign-on links in Spam Report s.

11 By default, your users will receive a spam report every morning, Monday through Friday, featuring new entries since the last report to reduce clutter. Spam Report settings can be found on the Reporting tab under the Spam tab. Spam Reports can be customized in a number of useful ways. Here are just a few highlights: Delivery time and frequency, up to twice per day Delegate control of various settings to end users Adjust Spam Report link settings to balance the need for easy user access to the Control Console with security best practices Define a custom message that will be included at the top of each Spam Report Understanding the End User Experience The Spam Report has a clean and efficient design to minimize the amount of time users spend reviewing their quarantines. When users click on an action link in the report, the action is carried out in the Control Console via the user s default web browser. End users don t have access to s blocked by virus, attachment, and content policies. Tip: Selected delivery times are approximate and may vary up to one hour. Any actions taken in the Spam Report are carried out in the end user version of the Control Console, which has limited functionality compared with the administrator version. The exact experience varies based on the settings you apply in the Spam Reporting tab described above. From the end user Control Console, users can perform these highlighted actions and more: View and release quarantined spam messages View and define aliases Adjust spam filter sensitivity Adjust the Allowed and Blocked Senders lists Access their personal archive (if available) The Quarantine tab allows users to recall messages quarantined up to 14 days back.

12 Policy Level Sender Allow/Deny Lists Your policy-level Sender Allow and Sender Deny lists can be populated with up to 1500 entries each, per policy. There is no character limit. These lists can be populated with domains, addresses, IP address, and CIDR-formatted IP ranges (for example: /24). Tip: The Sender Allow list includes a feature called SPF Validation that improves on the Postini IP Lock feature. When creating a new Sender Allow entry, check the Require SPF Validation box to prevent your entry from being exploited by spammers. SPF validation checks the sender s DNS SPF records to ensure that the is coming from an allowed IP address. This implementation saves you from having to know what IP addresses a sender uses now or in the future. Authentication The Authentication tab contains several mechanisms that you can use to increase the use of authentication best practices: Enforced TLS Enforced SPF Enforced DKIM For instance, the Enforced SPF feature makes it easy to block phishing attempts that mimic large financial and retail institutions, which have made a more consistent effort to utilize SPF.

13 Task 6: Configure outbound policies Outbound policies are very similar to inbound policies but you will notice some important differences, the most important of which is the inclusion of more granular content filtering and the option use of the encrypt action on content triggers. These features are package-dependent, so if these are things you are interested in, be sure to discuss them with your account representative. Content and Data Leakage Protection McAfee s DLP functionality includes these enhancements over base level content filtering: Over 100 pre-defined compliance dictionaries Ability to detect content using regular expressions Registered Documents, also known as file fingerprinting, allows you to train McAfee SaaS to detect confidential file attachments, even if they have been modified from the original Attachment content inspection for over 400 business file formats Ability to require encryption for messages that trigger content rules

14 Content Detection with Regular Expressions From any Outbound Policy, navigate to the Content tab >Custom Content Groups sub tab and click the Enable regular expressions checkbox. Enter your regular expressions strings, one per line, into the Content box and select an action like Encrypt from the Action combo list. To test your regular expressions, we ve included an easy to use validator which can be accessed by clicking on the Launch Validator button at the bottom of the screen.

15 Secure Web Delivery (SWD) Encryption McAfee SaaS SWD makes encryption effortless for end users, allowing them to send encrypted to anyone in the world without the hassle of key management or certificate exchange, by delivering S/MIME encrypted s via McAfee s secure website. Encryption is triggered automatically under these conditions: An outbound content rule with the action of encrypt matches an outbound message A user tags a message subject or body with the string [Encrypt] A user sends an using McAfee s Send Encrypted Add-in for Microsoft Outlook When a third-party recipient receives their first encrypted from your organization through McAfee SaaS, they are prompted via notification to create an account on McAfee s SWD system. Registration takes less than a minute and only has to be performed one-time. Once registered, the recipient can view the encrypted message securely in the Control Console, which uses SSL to protect the web session. The encryption version of the Control Console is feature-rich and easy to use. Recipients can even reply to the original sender (your end user) and if McAfee can establish TLS to your server, the reply will be sent directly to your user s inbox for maximum simplicity. Task 7: Inbound cutover Before switching your inbound flow from Postini to McAfee SaaS, verify that McAfee s IP space is allowed to connect through your firewall to your infrastructure over SMTP. Your firewall may have been configured to restrict inbound SMTP to Postini s IP space per their configuration instructions. MX Records and IP Space The MX records and IP space used by McAfee SaaS can be found by navigating to the Setup tab >MX Records link >Recommended MX Record Settings and Locking Down [your domain] Mail Servers.

16 You should now be ready to cutover to McAfee SaaS Protection by changing your domain s DNS MX Records. Task 8: Outbound cutover In order for McAfee SaaS to accept outbound from your network you must first list the IP ranges you will be connecting from into the Outbound Servers screen under the Setup tab, for each of your domains. Once entered, wait 30 minutes to ensure the change has fully populated through the McAfee network before setting up your server outbound mail relaying or smart hosting to the host name listed at the bottom of the Outbound Servers screen. This concludes your high level overview of McAfee SaaS Protection. Thank you for the opportunity to win your business! 2821 Mission College Boulevard Santa Clara, CA McAfee and the McAfee logo and/or other noted McAfee related products contained herein are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other marks and brands may be claimed as the property of others. The product plans, specifications and descriptions herein are provided for information only and subject to change without notice, and are provided without warranty of any kind, express or implied. Copyright 2013 McAfee, Inc faq_saas- _0313_fnl_ASD