Trend Micro InterScan Messaging Security Virtual Appliance 8.5 Administrator's Guide

633 Pages·2013·8.37 MB·English

by  Trend Micro

Trend Micro Incorporated reserves the right to make changes to this document and to
the product described herein without notice. Before installing and using the product,
please review the readme files, release notes, and/or the latest version of the applicable
documentation, which are available from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/interscan-messaging-security.aspx
Trend Micro, the Trend Micro t-ball logo, Control Manager, eManager, InterScan, and
TrendLabs are trademarks or registered trademarks of Trend Micro Incorporated. All
other product or company names may be trademarks or registered trademarks of their
owners.
Copyright © 2013. Trend Micro Incorporated. All rights reserved.
Document Part No.: MSEM85911/130322
Release Date: April 2013
Protected by U.S. Patent No.: Patents pending
This documentation introduces the main features of the product and/or provides
installation instructions for a production environment. Read through the documentation
before installing or using the product.
Detailed information about how to use specific features within the product may be
available in the Trend Micro Online Help and/or the Trend Micro Knowledge Base at
the Trend Micro website.
Trend Micro always seeks to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro document, please contact us at
[email protected].
Evaluate this documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp

Table of Contents
Preface
Preface ................................................................................................................. xi
What’s New ....................................................................................................... xii
Audience ........................................................................................................... xix
InterScan Messaging Security Virtual Appliance Documentation ........... xix
Document Conventions .................................................................................. xx
Part I: Getting Started
Chapter 1: Introducing InterScan Messaging Security
Virtual Appliance
About InterScan Messaging Security Virtual Appliance ........................... 1-2
IMSVA Main Features and Benefits ............................................................ 1-2
About Cloud Pre-Filter ................................................................................ 1-10
About Email Encryption ............................................................................. 1-10
About Spyware/Grayware .......................................................................... 1-10
About Trend Micro Control Manager ...................................................... 1-12
About Trend Micro Smart Protection ....................................................... 1-15
About Command & Control (C&C) Contact Alert Services ................. 1-17
Chapter 2: Getting Started
Opening the IMSVA Management Console .............................................. 2-2
Viewing the Management Console Using Secure Socket Layer .............. 2-3
Setting Up a Child Device ............................................................................. 2-5
Using Smart Search ........................................................................................ 2-7
Changing the Management Console Password .......................................... 2-7
i
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Configuring Proxy Settings ........................................................................... 2-8
IMSVA Services ............................................................................................ 2-10
Selecting a Scan Method .............................................................................. 2-11
Chapter 3: Configuring User Accounts
Administrator Account Management .......................................................... 3-2
Adding Administrator Accounts .................................................................. 3-2
Editing or Deleting Administrator Accounts ............................................. 3-5
Chapter 4: Using the Configuration Wizard
Configuring IMSVA with the Configuration Wizard ............................... 4-2
Chapter 5: Updating Components
Updating Engine and Pattern Files .............................................................. 5-2
Specifying an Update Source ........................................................................ 5-3
Performing a Manual Update ....................................................................... 5-4
Rolling Back a Component Update ............................................................. 5-5
Configuring Scheduled Update ..................................................................... 5-6
Updating the System and Application Files ................................................ 5-8
Chapter 6: Getting Started with Cloud Pre-Filter
Understanding Cloud Pre-Filter ................................................................... 6-2
Creating a Cloud Pre-Filter Account ........................................................... 6-5
Chapter 7: Advanced Threat Scan Engine and Deep
Discovery Advisor
Scan Technology ............................................................................................. 7-2
About Advanced Threat Scan Engine ......................................................... 7-2
About Deep Discovery Advisor ................................................................... 7-4
ii
Table of Contents
Chapter 8: Getting Started with Email Encryption
Understanding Email Encryption ................................................................ 8-2
Using Email Encryption ................................................................................ 8-3
Registering for Email Encryption ................................................................ 8-3
Managing Domains ........................................................................................ 8-4
Registering Domains ...................................................................................... 8-5
Part II: Configuring IMSVA and Cloud Pre-filter
Chapter 9: Configuring Cloud Pre-Filter
Understanding Cloud Pre-Filter Policies .................................................... 9-2
Creating a Cloud Pre-Filter Policy ............................................................... 9-4
Verifying Cloud Pre-Filter Works .............................................................. 9-14
Configuring DNS MX Records .................................................................. 9-14
Suggested IMSVA Settings When Using Cloud Pre-Filter .................... 9-18
Disabling Cloud Pre-Filter .......................................................................... 9-20
Chapter 10: Configuring IP Filtering Settings
IP Filtering Service ....................................................................................... 10-2
Using Email Reputation .............................................................................. 10-2
Configuring IP Filtering .............................................................................. 10-8
Displaying Suspicious IP Addresses and Domains ............................... 10-23
Chapter 11: Scanning SMTP Messages
Configuring SMTP Routing ........................................................................ 11-2
About Domain-based Delivery ................................................................ 11-10
Chapter 12: Configuring Transport Layer Security Settings
About Transport Layer Security ................................................................. 12-2
iii
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Prerequisites for Using TLS with IMSVA ................................................ 12-3
TLS Settings for Messages Entering IMSVA ........................................... 12-4
TLS Settings for Messages Exiting IMSVA ............................................. 12-7
Deploying IMSVA in TLS Environments ................................................ 12-8
Creating and Deploying Certificates in IMSVA .................................... 12-14
Chapter 13: Configuring POP3 Settings
Scanning POP3 Messages ........................................................................... 13-2
Enabling POP3 Scanning ............................................................................ 13-3
Configuring POP3 Settings ......................................................................... 13-4
Configuring POP3 Scan Service ................................................................. 13-5
Part III: IMSVA Policies
Chapter 14: Managing Policies
Policies ........................................................................................................... 14-2
How the Policy Manager Works ................................................................ 14-2
Chapter 15: Common Policy Objects
Configuring Common Policy Objects ....................................................... 15-2
Understanding Address Groups ................................................................ 15-2
Using the Keyword & Expression List ................................................... 15-13
Using Compliance Templates ................................................................... 15-26
Using the Notifications List ...................................................................... 15-37
Using Stamps .............................................................................................. 15-41
Using the DKIM Approved List ............................................................. 15-45
Using the Web Reputation Approved List ............................................. 15-46
iv
Table of Contents
Chapter 16: Internal Addresses
Configuring Internal Addresses ................................................................. 16-2
Adding an Address Group .......................................................................... 16-5
Searching for Users or Groups .................................................................. 16-6
Searching for an LDAP User or Group .................................................... 16-7
Chapter 17: Configuring Policies
Adding Policies ............................................................................................. 17-2
Specifying a Route ........................................................................................ 17-2
Specifying Scanning Conditions ................................................................. 17-9
Specifying Actions ...................................................................................... 17-32
Finalizing a Policy ....................................................................................... 17-41
Chapter 18: Encryption Settings
Configuring Encryption Settings ................................................................ 18-2
Encrypting Message Traffic ........................................................................ 18-3
Configuring Encryption Policies ................................................................ 18-3
Chapter 19: Scanning Exceptions
Setting Scan Exceptions .............................................................................. 19-2
Configuring Exceptions for Security Settings Violations ....................... 19-3
Setting Scan Actions for Security Setting Violations .............................. 19-4
Setting Scan Actions for Malformed Messages ........................................ 19-5
Configuring Exceptions for Encrypted Messages ................................... 19-7
Setting Scan Actions for Encrypted Messages ......................................... 19-7
Chapter 20: Existing Policies
Modifying Existing Policies ........................................................................ 20-2
v
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Policy Example 1 .......................................................................................... 20-4
Policy Example 2 .......................................................................................... 20-8
Using the Asterisk Wildcard ..................................................................... 20-13
Part IV: Monitoring the Network
Chapter 21: Monitoring the Network
Monitoring Your Network .......................................................................... 21-2
Viewing System Status ................................................................................. 21-2
Chapter 22: Working with the Dashboard and Widgets
Using the Dashboard ................................................................................... 22-2
Understanding Tabs ..................................................................................... 22-2
Understanding Widgets ............................................................................... 22-6
Chapter 23: Reports
Generating Reports ...................................................................................... 23-2
Managing One-time Reports ...................................................................... 23-5
Using Scheduled Reports ............................................................................ 23-8
Chapter 24: Logs
About Logs .................................................................................................... 24-2
Configuring Log Settings ............................................................................. 24-2
Querying Logs ............................................................................................... 24-4
Chapter 25: Mail Areas and Queues
About Mail Areas and Queues ................................................................... 25-2
Configuring Quarantine and Archive Settings ......................................... 25-3
Managing Quarantine Areas ....................................................................... 25-5
vi