Trend Micro InterScan Messaging Security Virtual Appliance Administrator's Guide

623 Pages·2014·10.24 MB·English

by  Trend Micro

Trend Micro Incorporated reserves the right to make changes to this document and to
the product described herein without notice. Before installing and using the product,
please review the readme files, release notes, and/or the latest version of the applicable
documentation, which are available from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/interscan-messaging-security.aspx
Trend Micro, the Trend Micro t-ball logo, Control Manager, eManager, InterScan, and
TrendLabs are trademarks or registered trademarks of Trend Micro Incorporated. All
other product or company names may be trademarks or registered trademarks of their
owners.
Copyright © 2012. Trend Micro Incorporated. All rights reserved.
Document Part No.: MSEM85803/121129
Release Date: December 2012
Protected by U.S. Patent No.: Patents pending
This documentation introduces the main features of the product and/or provides
installation instructions for a production environment. Read through the documentation
before installing or using the product.
Detailed information about how to use specific features within the product may be
available in the Trend Micro Online Help and/or the Trend Micro Knowledge Base at
the Trend Micro website.
Trend Micro always seeks to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro document, please contact us at
[email protected].
Evaluate this documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp

Table of Contents
Preface
Preface ................................................................................................................. xi
What’s New ....................................................................................................... xii
Audience ......................................................................................................... xviii
InterScan Messaging Security Virtual Appliance Documentation ........ xviii
Document Conventions ................................................................................. xix
Part I: Getting Started
Chapter 1: Introducing InterScan Messaging Security
Virtual Appliance
About InterScan Messaging Security Virtual Appliance ........................... 1-2
IMSVA Main Features and Benefits ............................................................ 1-2
About Cloud Pre-Filter ................................................................................ 1-10
About Email Encryption ............................................................................. 1-10
About Spyware/Grayware .......................................................................... 1-11
About Trend Micro Control Manager ...................................................... 1-13
Trend Micro Smart Protection Network .................................................. 1-16
Chapter 2: Getting Started
Opening the IMSVA Management Console .............................................. 2-2
Viewing the Management Console Using Secure Socket Layer .............. 2-3
Creating an SSL Certificate ........................................................................... 2-4
Setting Up a Child Device ............................................................................. 2-5
Using Smart Search ........................................................................................ 2-7
Changing the Management Console Password .......................................... 2-7
i
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Configuring Proxy Settings ........................................................................... 2-8
IMSVA Services ............................................................................................ 2-10
Chapter 3: Configuring User Accounts
Administrator Account Management .......................................................... 3-2
Adding Administrator Accounts .................................................................. 3-2
Editing or Deleting Administrator Accounts ............................................. 3-5
Chapter 4: Using the Configuration Wizard
Configuring IMSVA with the Configuration Wizard ............................... 4-2
Chapter 5: Updating Components
Updating Scan Engine and Pattern Files .................................................... 5-2
Specifying an Update Source ........................................................................ 5-3
Performing a Manual Update ....................................................................... 5-4
Rolling Back a Component Update ............................................................. 5-5
Configuring Scheduled Update ..................................................................... 5-5
Updating the System and Application Files ................................................ 5-7
Chapter 6: Getting Started with Cloud Pre-Filter
Understanding Cloud Pre-Filter ................................................................... 6-2
Creating a Cloud Pre-Filter Account ........................................................... 6-5
Chapter 7: Advanced Threat Scan Engine and Deep
Discovery Advisor
Scan Technology ............................................................................................. 7-2
About Advanced Threat Scan Engine ......................................................... 7-3
About Deep Discovery Advisor ................................................................... 7-4
ii
Table of Contents
Chapter 8: Getting Started with Email Encryption
Understanding Email Encryption ................................................................ 8-2
Using Email Encryption ................................................................................ 8-3
Registering for Email Encryption ................................................................ 8-3
Managing Domains ........................................................................................ 8-4
Registering Domains ...................................................................................... 8-5
Part II: Configuring IMSVA and Cloud Pre-filter
Chapter 9: Configuring Cloud Pre-Filter
Understanding Cloud Pre-Filter Policies .................................................... 9-2
Creating a Cloud Pre-Filter Policy ............................................................... 9-4
Verifying Cloud Pre-Filter Works .............................................................. 9-14
Configuring DNS MX Records .................................................................. 9-14
Suggested IMSVA Settings When Using Cloud Pre-Filter .................... 9-18
Disabling Cloud Pre-Filter .......................................................................... 9-20
Chapter 10: Configuring IP Filtering Settings
IP Filtering Service ....................................................................................... 10-2
Using Email Reputation .............................................................................. 10-2
Configuring IP Filtering .............................................................................. 10-8
Displaying Suspicious IP Addresses and Domains ............................... 10-23
Chapter 11: Scanning SMTP Messages
Scanning SMTP MessagesSMTP messagesscanscanSMTP messages .. 11-2
Configuring SMTP Routing ........................................................................ 11-2
About Domain-based Delivery .................................................................. 11-9
iii
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Chapter 12: Configuring Transport Layer Security Settings
About Transport Layer Security ................................................................. 12-2
Prerequisites for Using TLS with IMSVA ................................................ 12-3
TLS Settings for Messages Entering IMSVA ........................................... 12-4
TLS Settings for Messages Exiting IMSVA ............................................. 12-7
Deploying IMSVA in TLS Environments ................................................ 12-8
Creating and Deploying Certificates in IMSVA .................................... 12-14
Chapter 13: Configuring POP3 Settings
Scanning POP3 Messages ........................................................................... 13-2
Enabling POP3 Scanning ............................................................................ 13-3
Configuring POP3 Settings ......................................................................... 13-4
Configuring POP3 Scan Service ................................................................. 13-6
Part III: IMSVA Policies
Chapter 14: Managing Policies
Policies ........................................................................................................... 14-2
How the Policy Manager Works ................................................................ 14-2
Chapter 15: Common Policy Objects
Configuring Common Policy Objects ....................................................... 15-2
Understanding Address Groups ................................................................ 15-2
Using the Keyword & Expression List ................................................... 15-13
Using Compliance Templates ................................................................... 15-24
Using the Notifications List ...................................................................... 15-36
Using Stamps .............................................................................................. 15-40
Using the DKIM Approved List ............................................................. 15-44
iv
Table of Contents
Using the Web Reputation Approved List ............................................. 15-45
Chapter 16: Internal Addresses
Configuring Internal Addresses ................................................................. 16-2
Adding an Address Group .......................................................................... 16-5
Searching for Users or Groups .................................................................. 16-6
Searching for an LDAP User or Group .................................................... 16-7
Chapter 17: Configuring Policies
Adding Policies ............................................................................................. 17-2
Specifying a Route ........................................................................................ 17-2
Specifying Scanning Conditions ................................................................. 17-9
Specifying Actions ...................................................................................... 17-29
Finalizing a Policy ....................................................................................... 17-38
Chapter 18: Encryption Settings
Configuring Encryption Settings ................................................................ 18-2
Encrypting Message Traffic ........................................................................ 18-3
Configuring Encryption Policies ................................................................ 18-3
Chapter 19: Scanning Exceptions
Setting Scan Exceptions .............................................................................. 19-2
Configuring Exceptions for Security Settings Violations ....................... 19-3
Setting Scan Actions for Security Setting Violations .............................. 19-4
Setting Scan Actions for Malformed Messages ........................................ 19-5
Configuring Exceptions for Encrypted Messages ................................... 19-7
Setting Scan Actions for Encrypted Messages ......................................... 19-7
v
Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide
Chapter 20: Existing Policies
Modifying Existing Policies ........................................................................ 20-2
Policy Example 1 .......................................................................................... 20-4
Policy Example 2 .......................................................................................... 20-8
Using the Asterisk Wildcard ..................................................................... 20-13
Part IV: Monitoring the Network
Chapter 21: Monitoring the Network
Monitoring Your Network .......................................................................... 21-2
Viewing System Status ................................................................................. 21-2
Chapter 22: Working with the Dashboard and Widgets
Using the Dashboard ................................................................................... 22-2
Understanding Tabs ..................................................................................... 22-2
Understanding Widgets ............................................................................... 22-6
Chapter 23: Reports
Generating Reports ...................................................................................... 23-2
Managing One-time Reports ...................................................................... 23-5
Using Scheduled Reports ............................................................................ 23-8
Chapter 24: Logs
About Logs .................................................................................................... 24-2
Configuring Log Settings ............................................................................. 24-2
Querying Logs ............................................................................................... 24-4
Chapter 25: Mail Areas and Queues
About Mail Areas and Queues ................................................................... 25-2
vi