Email Quick Reference Administrator Guide
Email Services Quick Reference Documentation version: 1.0 Legal Notice Legal Notice Copyright 2015 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. Symantec Corporation 350 Ellis Street Mountain View, CA 94043 http://www.symantec.com Clients are advised to seek specialist advice to ensure that they use the Symantec services in accordance with relevant legislation and regulations. Depending on jurisdiction, this may include (but is not limited to) data protection law, privacy law, telecommunications regulations, and employment law. In many jurisdictions, it is a requirement that users of the service are informed of or required to give consent to their email being monitored or intercepted for the purpose of receiving the security services that are offered by Symantec. Due to local legislation, some features that are described in this documentation are not available in some countries. Configuration of the Services remains your responsibility and entirely in your control. In certain countries it may be necessary to obtain the consent of individual personnel. Symantec advises you to always check local legislation prior to deploying a Symantec service. You should understand your company s requirements around electronic messaging policy and any regulatory obligations applicable to your industry and jurisdiction. Symantec can accept no liability for any civil or criminal liability that may be incurred by you as a result of the operation of the Service or the implementation of any advice that is provided hereto. The documentation is provided "as is" and all express or implied conditions, representations, and warranties, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement, are disclaimed, except to the extent that such disclaimers are held to be legally invalid. Symantec Corporation shall not be liable for incidental or consequential damages in connection with the furnishing, performance, or use of this documentation. The information that is contained in this documentation is subject to change without notice. Symantec may at its sole option vary these conditions of use by posting such revised terms to the website.
Technical support If you need help on an aspect of the security services that is not covered by the online Help or administrator guides, contact your IT administrator or Support team. To find your Support team's contact details in the portal, click Support > Contact us.
Contents Technical support... 3 Chapter 1 AntiSpam... 5 Getting started with AntiSpam... 5 Detecting and handling spam... 5 Blocking, approving, and excluding senders for AntiSpam... 6 Applying the same AntiSpam filters to a group of users... 7 Quarantining spam in Spam Manager... 8 Chapter 2 Anti-Malware... 9 Getting started with Anti-Malware... 9 Chapter 3 Image Control... 10 Getting started with Image Control... 10 Detecting and handling inappropriate images... 10 Blocking and approving images... 11 Excluding senders and recipients from the image scan... 12 Setting up Image Control notifications... 12
Chapter 1 AntiSpam This chapter includes the following topics: Getting started with AntiSpam Detecting and handling spam Blocking, approving, and excluding senders for AntiSpam Applying the same AntiSpam filters to a group of users Quarantining spam in Spam Manager Getting started with AntiSpam Welcome to the Quick Reference for the AntiSpam service. The AntiSpam service uses two portals: The main service configuration portal to configure how you detect and handle spam emails in your organization Spam Manager for administrators and email recipients to review and take action on quarantined spam Detecting and handling spam In the AntiSpam service, you must set the detection methods and the actions you want to take on suspected spam emails. We recommend that you change the default actions when you are sure that the AntiSpam service detects spam correctly. You change your detection settings at: Services > Email Services > Anti-Spam > Detection Settings You apply one of the following actions to any detected spam:
AntiSpam Blocking, approving, and excluding senders for AntiSpam 6 Append a header but allow the email through. Append a header and redirect the email to a bulk mail address. Tag the subject line but allow the email through. Quarantine the email. Block and delete the email. You can change the way the AntiSpam service detects spam emails for: All users. An email domain you have provisioned with cloud security services. A group of users within an email domain. Note: To ensure items such as newsletters pass through spam detection, you designate approved and excluded senders lists. The cloud security service detects spam in five ways: Use SPF (Sender Policy Framework) to detect sender spoofing, which leads to reduced phishing attempts where domain spoofing is commonplace. Match the emails against IP addresses, domains, and email addresses on a blocked senders list. Match the IP address of the sending server against a publicly-distributed list of spam sources (public block list). Match the signature of the email body against a list of known spam signatures. Run the email through our Skeptic heuristics to assess whether the email is spam. Blocking, approving, and excluding senders for AntiSpam A service administrator defines global and group lists for blocked and approved senders. You identify senders by IP address, email domain, or email address. Users define their blocked and approved sender lists within Spam Manager. The Quarantine Administrator sets up these user lists in Spam Manager.
AntiSpam Applying the same AntiSpam filters to a group of users 7 Note: Group and user lists are optional components of AntiSpam. If group and user lists are not available in your portal, contact your cloud security services representative for more information. To create a blocked sender list: Services > Email Services > Anti-Spam > Blocked Senders To create an approved sender list: Services > Email Services > Anti-Spam > Approved Senders Before you define group lists, you must set up groups within domains. You also define a list of email domains that are not tested against the AntiSpam rules: Services > Email Services > Anti-Spam > [domain name] > Exclusions Applying the same AntiSpam filters to a group of users You apply the same combination of : Blocked sender lists Approved sender lists Signature-matching Skeptic heuristics to a group of users who are registered in the same email domain. Note: Groups are optional components of AntiSpam. If group settings are not available in your portal, contact your cloud security services representative for more information. To create a group: Services > Email Services > Anti-Spam > [domain name] > Create new group To add a user to a group: Services > Email Services > Anti-Spam > [domain name] > [group name]
AntiSpam Quarantining spam in Spam Manager 8 Quarantining spam in Spam Manager Quarantined emails are stored in Spam Manager. Note: Spam Manager is an optional component of AntiSpam. If quarantine settings are not available in your portal, contact your cloud security services representative for more information. To quarantine suspected spam: Services > Email Services > Anti-Spam > Detection Settings > [detection method] > Action Your organization decides if: The text of the quarantined email can be viewed. The recipient or a Quarantine Administrator manages the quarantined email. Users are notified when spam is received. Users release spam emails from within Spam Manager or from a link in a spam notification. Spam Manager deletes quarantined emails after 14 days. Note: We recommend that you set active notifications with a release spam link, so that users do not need to access Spam Manager. You change your quarantine settings at: Services > Email Services > Anti-Spam > Domains > Quarantine Settings In the administrator's portal you: Create Spam Manager Quarantine Administrators. Allow users to receive notifications when the AntiSpam service quarantines an email. Allow users to request additions to the approved senders list.
Chapter 2 Anti-Malware This chapter includes the following topics: Getting started with Anti-Malware Getting started with Anti-Malware Welcome to the Quick Reference for the Anti-Malware service. Inbound and outbound emails are routed to the cloud security service and the Anti-Malware service scans all emails passing through the system. If an email passes successfully through a scan, the service forwards the email to the original recipient. If the email fails the scan, the service quarantines the email. The recipient must decide whether to release inbound emails. With the Anti-Malware service, you: Enable administrator and user malware alerts. Change the sending address for malware alerts. Note: You change your settings either globally or for each domain.
Chapter 3 Image Control This chapter includes the following topics: Getting started with Image Control Detecting and handling inappropriate images Blocking and approving images Excluding senders and recipients from the image scan Setting up Image Control notifications Getting started with Image Control Welcome to the Quick Reference for Image Control. You configure Image Control to scan emails and attachments for inappropriate images that are sent to or received by users in your organization. You scan against: Known lists of inappropriate images. Predictive Image Control Analysis heuristics. Detecting and handling inappropriate images You change the detection sensitivity and the action the service takes with a flagged image. You change the way the Image Control service detects inappropriate images at a global level. Alternatively you specify custom settings for each email domain that you are provisioned with in the cloud security services. Note: When the detection sensitivity is low you detect fewer images, but also have lower false-positive rates.
Image Control Blocking and approving images 11 You change your global detection settings at: Services > Email services > Image Control > Global Settings You change your email domain settings at: Services > Email services > Image Control > [domain name] You take the following actions on inbound and outbound mail: Scan Microsoft Office and PDF files. Use Image Control Analysis heuristics. Match the image against a publicly-distributed list of inappropriate images (global list). Match the image against your own list of inappropriate images (client list). You take one of the following actions on the images that the scan flags as inappropriate: Block and delete the suspected email. Redirect the suspected email to the Image Control administrator. Copy the suspected email to the Image Control administrator. Tag suspected email in the header. Tag the subject line but allow the email through. Log only. Warning: If you block and delete emails you lose all falsely-identified emails, which can annoy users. Rather than block and delete, we recommend that you copy or redirect identified emails to the Image Control administrator. Note: To ensure business-critical images pass through the Image Control filters, you must designate approved senders and recipients, and lists of approved images. Blocking and approving images If an inappropriate image passes through the Image Control scan, you add the image's signature to a blocked images list. The next time a user sends or receives the image, the Image Control service flags the email that contains the offending image. To create a blocked images list: Services > Email Services > Image Control > Blocked Images
Image Control Excluding senders and recipients from the image scan 12 If the Image Control scan incorrectly flags an image as inappropriate, you add the image signature to approved images lists. The next time a user sends or receives the image, the Image Control service allows the email that contains the image to pass through. To create an approved images list: Services > Email Services > Image Control > Approved Images Note: The cloud security service maintains global blocked and approved images lists, which you can also scan against. Excluding senders and recipients from the image scan You authorize certain users to send and receive images without an Image Control scan at: Services > Email Services > Image Control > Approved Senders Services > Email Services > Image Control > Approved Recipients Setting up Image Control notifications You enable user notifications for any inappropriate images the scan finds within emails. You also set up notifications to the administrator. You set up your global notifications at: Services > Email Services > Image Control > Notifications You change your options for each email domain you have provisioned with the cloud security services: Services > Email Services > Image Control > [domain name] > Notifications