300-720: Securing Email with Cisco Email Security ApplianceDemo

Cisco Email Security Sender Groups can use geolocation to classify or reject email servers by country, and they can use Cisco SenderBase Reputation Scores to apply policies based on a sender’s reputation. These controls operate at the sender/connection level to filter unwanted email traffic.

Cisco Secure Email Gateway evaluates the safelist immediately before anti-spam scanning. Messages from a safelisted sender skip anti-spam scanning but continue through antivirus scanning and other configured email-pipeline processing.

Cisco Secure Email Forged Email Detection uses content-dictionary entries representing users’ names to compare against the From header. The configuration requires entering the user’s name, rather than an email address, and prohibits regular expressions.

Forged Email Detection compares the message’s From header with user names in a content dictionary. Configure that dictionary with friendly names, then configure an incoming content or message filter that uses the Forged Email Detection rule and the dictionary.

Cisco ESA encrypts messages through CRES by using an encryption profile that contains the CRES key-service connection and message-security settings. The profile must be provisioned for the CRES account before the appliance can use CRES to encrypt mail.

Cisco ESA domain signing profiles use the DKIM or DomainKeys type. If profiles of both types are configured and enabled in a mail flow policy, AsyncOS signs outbound messages with both a DKIM signature and a DomainKeys signature.

Cisco ESA message-filter actions are either final actions, which stop further message processing, or non-final actions, which allow processing to continue.

The spam threshold determines the cutoff for classifying a message as spam. Lowering or raising that cutoff changes the sensitivity—and therefore the aggressiveness—of spam detection.

Cisco ESA processes email through the Receipt, Work Queue, and Delivery phases. The Work Queue performs message processing and scanning, and Delivery applies outbound delivery limits and policies.

Cisco Secure Email multi-layer antivirus scanning runs the McAfee engine first and the Sophos engine second. If McAfee detects a virus, the appliance applies the configured antivirus action and does not continue to Sophos scanning.

Sending a message to a policy quarantine requires a policy quarantine to be defined on the email gateway. Subject modification and custom-header actions are supported for messages sent to policy quarantine.

Centralized PVO cannot be enabled for a cluster when content filters or DLP actions are configured at a machine or group level rather than uniformly at the cluster level. A machine-level content-filter configuration on esa1 therefore conflicts with the cluster-level PVO configuration.

Cisco ESA supports encryption of messages up to 25 MB. Cisco recommends a 10 MB message size for performance reasons, but the configurable encryption maximum is 25 MB.

Cisco Secure Email Gateway message filters can identify flagged messages and deliver them through a specified host IP interface (Virtual Gateway address) or interface group. Cisco documents this as more flexible and powerful than altsrchost, which maps delivery using sender IP address or envelope-sender information.

Cisco Secure Email Outbreak Filters protect against nonviral attacks such as phishing, and their detection integrates with the anti-spam service. Anti-spam must therefore be configured to use Outbreak Filters for nonviral threats. Cisco Secure Email: URL Rewriting and Analysis

Cisco ESA end-user safelists allow recipients to designate senders or domains that are never treated as spam. A sender on an end user’s safelist bypasses anti-spam scanning, allowing its messages to be delivered rather than acted on according to a spam verdict.

Cisco Outbreak Filters delay messages that may belong to a virus outbreak or non-viral attack so they can be rescanned with updated intelligence. They also redirect URLs in non-viral attack messages through a web security proxy, allowing potentially malicious destinations to be blocked or warned on.

Cisco ESA’s graymail management solution consists of an integrated graymail scanning engine, which identifies graymail for policy handling, and a cloud-based Unsubscribe Service, which enables users to unsubscribe from unwanted messages. The end-user interface, secure unsubscribe capability, and improved mail efficacy are solution features or outcomes rather than the two components.

A content filter uses conditions to determine which messages match and actions to define the processing performed on matching messages.

Cisco ESA LDAP profiles support failover and load balancing for redundant LDAP servers. Failover moves to the next configured LDAP server when a connection cannot be made; load balancing distributes LDAP-query connections among the configured servers.

On Cisco Secure Email Gateway, local spam-quarantine settings are accessed from Monitor > Spam Quarantine. Disabling the local service requires clearing the Enable Spam Quarantine checkbox before external quarantine configuration is enabled.

Cisco ESA LDAP queries include recipient acceptance queries and routing queries. Acceptance queries validate whether a recipient should be accepted, while routing queries use directory information to route messages to the appropriate recipient address or mail host.

Cisco Secure Email Gateway (ESA) supports the SMTP STARTTLS extension, enabling TLS-encrypted SMTP communications between mail transfer agents.

Cisco ESA supports a preinstalled trusted certificate-authority list, named the system list, and an imported user-defined list, named the custom list. Either list, or both, can be used to validate certificates from remote domains.