User manual SONICWALL EMAIL SECURITY SOFWARE ADMINISTRATOR

[. . . ] SonicWALL® Email Security Software Administrator Guide Version 7. 2 SonicWALL, Inc. 2001 Logic Drive San Jose, CA 95124-3452 Phone: +1. 408. 745. 9600 Fax: +1. 408. 745. 9300 E-mail: info@sonicwall. com Part Number: 232-001702-00 Rev B SonicWALL Email Security Administrator Guide i SonicWALL® Email Security Software Administrator's Guide Version 7. 2 SonicWALL, Inc. 2001 Logic Drive San Jose, CA 95124-3452 Phone: +1. 408. 745. 9600 Fax: +1. 408. 745. 9300 E-mail: info@sonicwall. com Copyright Notice © 2009 SonicWALL, Inc. Under the copyright laws, this manual or the software described within, can not be copied, in whole or part, without the written consent of the manufacturer, except in the normal use of the software to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. This exception does not allow copies to be made for others, whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or loaned to another person. [. . . ] SonicWALL Email Security also collects incidences of phishing and summarizes the email addresses, text, phone numbers, and domains of phishing perpetrators in a database, which stores the thumbprints of the phishing message. Report Phishing and Other Enterprise Fraud to SonicWALL Email Security SonicWALL Email Security alerts organizations to phishing attacks. SonicWALL Email Security needs you to report fraudulent email messages to mailto:fraud@sonicwall. com. Reporting phishing enables SonicWALL Email Security to alert other users to the phishing attacks you experienced. CHAPTER 4 Anti-Virus Techniques SonicWALL Email Security's Anti-Virus modules protect your organization from inbound emailborne viruses and prevent your employees from sending viruses with outbound email. Once SonicWALL Email Security has identified the email message or attachment that contains a virus or is likely to contain a virus, you choose how to manage the virus-infected email. Optional virus-protection modules for the entire organization are available. How Virus Checking Works The Anti-Virus modules use virus-detection engines to scan email messages and attachments for viruses, Trojan horses, worms, and other types of malicious content. The virus-detection engines receive periodic updates to keep them current with the latest definitions of viruses. SonicWALL Email Security supports McAfee ® and Kaspersky virus-detection engines. You can choose to buy and deploy one or both virus-detection engines supported by SonicWALL Email Security. Messages determined to be dangerous by McAfee or Kaspersky engine are categorized as Viruses. SonicWALL Email Security also supports the SonicWALL GRID antivirus automatically. GRID virus-detection works in with the McAfee and Kaspersky virus-detection engines to improve your protection from virus payloads. When any one of the virus-detection engines is activated, you also get the benefit of SonicWALL Email Security's Time Zero Virus Technology. This technology uses heuristic statistical methodology and virus outbreak responsive techniques to determine the probability that a message contains a virus. If the probability meets certain levels, the message is categorized as Likely Virus. This technology complements virus-detection engines and enabling this technology provides the greatest protection for time zero viruses, the first hours that a virus is released, when major anti-virus companies have not yet modified their virus definitions to catch it. Preventing Viruses and Likely Viruses in Email To configure anti-virus protection 1. The Anti-Virus window appears. SonicWALL Email Security Administrator's Guide|48 If you have licensed more than one virus-detection engines, they will all work in tandem. Licensed virus-detection engines can be used on both inbound and outbound paths. Action Virus Filtering Off Consequence SonicWALL Email Security passes this email through to users without stripping the viruses or likely viruses. SonicWALL Email Security permanently deletes this message. Additional Information This choice provides no screening for viruses or likely viruses. Permanently Delete This is a secure option for the enterprise because the virus or likely virus is permanently deleted. However, neither the receiver nor the sender knows that the email message contained a virus or likely virus, and once the message is deleted, you cannot retrieve it. If you click the Allow Users To Unjunk button users can receive the message, with the virus or likely virus removed. NOTE: SonicWALL Email Security recommends this option because you can retrieve the message after SonicWALL Email Security strips the virus. Option allows messages to be copied to a specific email address You can enter another tag in the text box or use the default [VIRUS] or [LIKELY VIRUS]. Bounce Back to Sender Store in Junk Box (default setting) SonicWALL Email Security bounces email back to the sender with the virus removed. [. . . ] The Profiler can be configured to work with each supported email client. Similar to a Honeypot, an account that is established on the Internet for the sole purpose of collecting spam and tracking hackers. A list of Internet TCP/IP addresses known to send spam, or by hosts considered friendly to spam. An SMTP proxy placed in the email flow, and performs a spam analysis to determine whether email is good or junk. [. . . ]