User manual SONICWALL EMAIL SECURITY SOFWARE ADMINISTRATOR

[. . . ] SonicWALL® Email Security Software Administrator Guide Version 7. 2 SonicWALL, Inc. 2001 Logic Drive San Jose, CA 95124-3452 Phone: +1. 408. 745. 9600 Fax: +1. 408. 745. 9300 E-mail: info@sonicwall. com Part Number: 232-001702-00 Rev B SonicWALL Email Security Administrator Guide i SonicWALL® Email Security Software Administrator's Guide Version 7. 2 SonicWALL, Inc. 2001 Logic Drive San Jose, CA 95124-3452 Phone: +1. 408. 745. 9600 Fax: +1. 408. 745. 9300 E-mail: info@sonicwall. com Copyright Notice © 2009 SonicWALL, Inc. Under the copyright laws, this manual or the software described within, can not be copied, in whole or part, without the written consent of the manufacturer, except in the normal use of the software to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. This exception does not allow copies to be made for others, whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or loaned to another person. [. . . ] You manage policy by creating filters in which you specify the words to search for in content, senders, or other parts of the email. After filtering for specified characteristics, you can choose from a list of actions to apply to the message and its attachments. SonicWALL Email Security Administrator's Guide|57 Defining Word Usage In the context of Policy Management, a word is a series of alphabetic characters and numbers with no spaces. Punctuation Slash Punctuation allowed as first or last character but not in the middle. Dollar sign Percent sign Punctuation allowed in the middle but not as first or last character Period Character / Character value Example http://example. com Example $ % Character value $100 100% Example . "at" sign Ampersand Colon Hyphen @ & : - http://example. com is allowed. ktran@sonicwall. com AT&T http://example. com xxx-yyy All other punctuation is used as word separators to split words. Punctuation included in this category includes the following characters: ~ !# ^ * + = { } [ ] ; " < > , ?\ | `()" For example, X~Y is treated as two words, X and Y. Defining Email Address Matching Policy Management can do intelligent matching for email addresses in the From and To/CC/BCC fields. Address field jdoe@company. com asmith@company. com jdoe@yahoo. com Matching strings jdoe Match No Match Match company. com Match Match No Match jdoe@company. com Match No Match No Match Defining Intelligent Email Attachment Matching When you create a policy to detect attachments based on file extension, by default, SonicWALL Email Security will do simple matching based on the specified file extension. If the attachment has been renamed to have a different file extension, this simple matching will not detect that. To accurately detect attachments without relying on the file extension, select Intelligent SonicWALL Email Security Administrator's Guide|58 Attachment Matching checkbox. For example, an executable attachment renamed to . txt extension can be matched as an executable. SonicWALL Email Security supports Intelligent Attachment Matching for the following file extensions. File Format Bitmap format FITS format GIF format Graphics Kernel System IRIS rgb format ITC (CMU WM) format JPEG File Interchange Format NIFF (Navy TIFF) PM format PNG format Postscript format Sun Rasterfile Targa format TIFF format (Motorola - big endian) Extension . bmp . fits . gif . gks . rgb . itc . jpg . nif . pm . png . [e]ps . ras . tga . tif TIFF format (Intel - little endian) . tif X11 Bitmap format XCF Gimp file structure Xfig format XPM format Bzip Compress gzip format pkzip format TAR (pre-POSIX) TAR (POSIX) MS-DOS, OS/2 or MS Windows Unix elf pgp public ring pgp security ring pgp security ring pgp encrypted data . xbm . xcf . fig . xpm . bz . Z . gz . zip . tar . tar . exe SonicWALL Email Security Administrator's Guide|59 Defining Disguised Text Identification SonicWALL Email Security provides disguised text identification to prevent users in your organization from sending or receiving messages with unwanted words with substituted, inserted, constructed, or deleted characters. Using traditional word matching or spell checking finds exact matches or known frequent misspellings, such as hte for the. Disguised text identification is as simple and intuitive as traditional word matching; and is more powerful than using regular expressions to find specific words or terms. In addition, it is far easier to use and less potentially dangerous than regular expressions. Disguised text identification provides the following types of matches: Variations Constructed characters Inserted characters Substituted characters Deleted characters Imaginative spelling Note: Resulting Words or Phrases \ / for V, or \. /\/ for W, for example, \/\/ork at home - or _, for example, c-o-m-m-e-n-t or f_e_e_s @ for a or 1 for i, for example, p@ntyhose or Sat1sfact10n wnderful opprtunty Purrfection or garunteeed suxess Disguised text identification might result in false positives due to unexpected conditions, and can be computationally intensive. Disguised text identification is not meant to be a spam catcher. SonicWALL Email Security has developed extensive heuristic statistical techniques for catching spam. Instead, this feature allows you to detect terms that are important to your organization and build policies based on them. You can use this feature to capture specific terms, for example, route incoming messages with your product's name with appropriate trademarks for your sales departments. It can also be used to filter outgoing mail. As an example, if your organization prohibits sending source code outside of the company, you could use various programming keywords as search terms and route messages with those terms to the appropriate manager. Inbound vs. [. . . ] SSL uses a private key to encrypt data that is transferred over the SSL connection. Any unsolicited commercial email that a user does not want. Spam frequently contains false advertising, get-rich-quick schemes, and other offensive material. Post Office Protocol Version 3 (POP3) Policy Management Profiler Probe Account Quarantine Realtime Blackhole List. (RBL) Remote Analyzer Privilege Roles Sender ID Simple Mail Transfer Protocol (SMTP) Secure Socket Layer (SSL) Spam SonicWALL Email Security Administrator's Guide|135 Term SPF Definition (Continued) Sender Policy Framework (SPF) is an extension to the Simple Mail Transfer Protocol (SMTP). [. . . ]