Transcription

1

2 Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the applicable user documentation, which are available from the Trend Micro Web site at: Trend Micro, the Trend Micro t-ball logo, and ScanMail are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright Trend Micro Incorporated. All rights reserved. Document Part No. APEM16092_ Release Date: November 2013 Document Version No.: 1.0 Product Name and Version No.: ScanMail Mobile Security for Microsoft Exchange 1.0 Protected by U.S. Patent No.: 5,951,698

3 The user documentation for Trend Micro ScanMail Mobile Security for Microsoft Exchange 1.0 is intended to introduce the main features of the software and installation instructions for your production environment. You should read through it prior to installing or using the software. Detailed information about how to use specific features within the software are available in the online help file and the Knowledge Base at Trend Micro Web site. Trend Micro is always seeking to improve its documentation. Your feedback is always welcome. Please evaluate this documentation on the following site:

4

5 Table of Contents Preface Preface... v ScanMail Mobile Documentation... vi Audience... vi Document Conventions... vii Part I: Introducing ScanMail Mobile and Getting Started Chapter 1: Introducing Trend Micro ScanMail Mobile Security for Microsoft Exchange About ScanMail Mobile Security for Microsoft Exchange System Requirements Features and Benefits How ScanMail Mobile Protects the Microsoft Exchange Environment 1-7 Chapter 2: Getting Started with ScanMail Mobile Getting Started Understanding the Product Console Understanding the Server Management Console Understanding ScanMail Mobile Icons ScanMail Mobile Registration ScanMail Mobile Activation Part II: Configuring Scans and Scan Filters i

6 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Chapter 3: Configuring Device Access Control About Device Access Control Managing Device Access Control Rules Configuring Device Access Control Rules Chapter 4: Configuring Device Management About Device Management About Device Wipe About Security Policies Chapter 5: Configuring Attachment Blocking About Attachment Blocking Enabling Attachment Blocking Configuring an Attachment Blocking Exception Global Attachment Blocking Policy Chapter 6: Configuring Data Loss Prevention About Data Loss Prevention (DLP) Data Identifier Types About Data Loss Prevention Templates About Data Loss Prevention Policies Part III: Managing ScanMail Chapter 7: Monitoring ScanMail Mobile Viewing the Summary Screen Understanding Real-time Monitor Notifications ii

7 Table of Contents About Alerts About Reports About Logs Chapter 8: Performing Administrative Tasks Configuring Proxy Settings Global Notification Settings About Access Control About Special Groups About the Device Exception List Product License Using Trend Support / System Debugger Part IV: Getting Help Chapter 9: Contacting Trend Micro Contacting Technical Support Speeding Up Your Support Call Knowledge Base Security Information Site Appendix A: ScanMail Mobile Windows Event Log Codes Appendix B: Database Schema for 64-bit Operating Systems Log Database Schema... B-2 Log View Database Schema... B-7 Report Database Schema... B-12 Appendix C: Best Practices iii

8 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Device Access Control Policies... C-2 Sample Usage Scenarios... C-3 Device Management... C-3 Attachment Blocking Policies... C-4 Exception Rule Replication... C-4 Sample Usage Scenarios... C-5 Data Loss Prevention... C-6 Data Identifiers and Template Creation... C-6 Data Loss Prevention: Hidden Keys... C-7 Index Index... IN-1 iv

9 Preface Preface Welcome to the Trend Micro ScanMail Mobile Security for Microsoft Exchange Administrator s Guide. This book contains basic information about the tasks you need to perform to manage ScanMail Mobile to protect your Exchange servers. It is intended for novice and advanced users of ScanMail Mobile who want to manage ScanMail Mobile. This preface discusses the following topics: ScanMail Mobile Documentation on page vi Audience on page vi Document Conventions on page vii v

10 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide ScanMail Mobile Documentation The product documentation consists of the following: Online Help: Web-based documentation that is accessible from the product console The Online Help contains explanations about ScanMail Mobile features. Installation Guide: PDF documentation that discusses requirements and procedures for installing the product Administrator s Guide: PDF documentation that discusses getting started information and product management Readme File: Text-based documentation that contains late-breaking product information that might not be found in the other documentation. Topics include a description of features, installation tips, known issues, and product release history. Knowledge Base: Web portal that contains the latest information about all Trend Micro products. Other inquiries that were already answered are also posted and a dynamic list of the most frequently asked questions is also displayed. Tip Trend Micro recommends checking the corresponding link for documentation updates: Audience The ScanMail Mobile documentation assumes a basic knowledge of security systems, including: Network concepts (such as IP address, netmask, topology, LAN settings) Various network topologies vi

11 Preface Microsoft Exchange Server administration Microsoft Exchange Server 2013 and 2010 server role configurations Various message formats Document Conventions The documentation uses the following conventions. TABLE 1. Document Conventions CONVENTION UPPER CASE Bold Italics Monospace Navigation > Path Note DESCRIPTION Acronyms, abbreviations, and names of certain commands and keys on the keyboard Menus and menu commands, command buttons, tabs, and options References to other documents Sample command lines, program code, web URLs, file names, and program output The navigation path to reach a particular screen For example, File > Save means, click File and then click Save on the interface Configuration notes Tip Recommendations or suggestions Important Information regarding required or default configuration settings and product limitations vii

12 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide CONVENTION WARNING! DESCRIPTION Critical actions and configuration options viii

13 Part I Introducing ScanMail Mobile and Getting Started

14

15 Chapter 1 Introducing Trend Micro ScanMail Mobile Security for Microsoft Exchange This chapter introduces Trend Micro ScanMail Mobile Security for Microsoft Exchange and provides an overview of its features and capabilities. Topics include: About ScanMail Mobile Security for Microsoft Exchange on page 1-2 System Requirements on page 1-2 Features and Benefits on page 1-5 How ScanMail Mobile Protects the Microsoft Exchange Environment on page

16 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide About ScanMail Mobile Security for Microsoft Exchange ScanMail Mobile Security for Microsoft Exchange provides protection to Exchange servers from mobile device access. ScanMail Mobile secures messaging on mobile devices, across multiple mobile platforms, that connect to the Exchange server. ScanMail Mobile integrates the Trend Micro Data Protection portfolio, monitoring confidential data on mobile devices, preventing non-compliant device access to the Exchange server, and protecting corporate data by enforcing mobile device security policies. ScanMail Mobile is server-side (CAS) protection that limits the impact on users and deployment costs. System Requirements The following lists the system requirements for running Trend Micro ScanMail Mobile Security for Microsoft Exchange. ScanMail Mobile with Exchange Server 2013 The following table lists the system requirements for running ScanMail Mobile with Exchange Server TABLE 1-1. System Requirements for Installation with Exchange Server 2013 RESOURCE REQUIREMENTS Processor x64 architecture-based processor that supports Intel 64 architecture (formally known as Intel EM64T) x64 architecture-based computer with AMD 64-bit processor that supports AMD64 platform Memory Disk space 1GB RAM exclusively for ScanMail Mobile (2GB RAM recommended) 2GB free disk space 1-2

17 Introducing Trend Micro ScanMail Mobile Security for Microsoft Exchange RESOURCE REQUIREMENTS Operating system Microsoft Windows Server 2012 Standard or Datacenter (64-bit) Microsoft Windows Server 2008 R2 Standard with Service Pack 1 or above (64-bit) Microsoft Windows Server 2008 R2 Enterprise with Service Pack 1 or above (64-bit) Microsoft Windows Server 2008 R2 Datacenter RTM or above (64-bit) Mail server Microsoft Exchange Server 2013 Web server Microsoft Internet Information Services (IIS) 8.0 SQL server SQL Server 2012 Microsoft Internet information Services (IIS) 7.5 SQL Server 2008 R2 SQL Server 2008 Browser Microsoft Internet Explorer 7.0 or above Tip Trend Micro recommends operating Internet Explorer 10 in compatibility view. Mozilla Firefox 3.0 or above ScanMail Mobile with Exchange Server 2010 The following table lists the system requirements for running ScanMail Mobile with Exchange Server

18 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide TABLE 1-2. System Requirements for Installation with Exchange Server 2010 RESOURCE REQUIREMENTS Processor x64 architecture-based processor that supports Intel Extended Memory 64 Technology (Intel EM64T) x64 architecture-based computer with AMD 64-bit processor that supports AMD64 platform Memory Disk space 1GB RAM exclusively for ScanMail Mobile (2GB RAM recommended) 2GB free disk space Operating system Microsoft Windows Server 2012 (64-bit) Standard or Datacenter Microsoft Windows Server 2008 with Service Pack 2 or above (64-bit) Microsoft Windows Server 2008 R2 or above (64-bit) Mail server Microsoft Exchange Server 2010 or above Web server Microsoft Internet Information Services (IIS) 8.0 Microsoft Internet Information Services (IIS) 7.5 Microsoft Internet information Services (IIS) 7.0 SQL server SQL Server 2012 SQL Server 2008 R2 SQL Server 2008 Browser Microsoft Internet Explorer 7.0 or above Tip Trend Micro recommends operating Internet Explorer 10 in compatibility view. Mozilla Firefox 3.0 or above 1-4

19 Introducing Trend Micro ScanMail Mobile Security for Microsoft Exchange Features and Benefits ScanMail Mobile provides the following features and benefits. Web-based Product Console Use SSL to access remote servers through a secure product console. Installation and Support Install to a single or multiple Microsoft Exchange servers using a single installation program. Multiple Scan Filters TABLE 1-3. Multiple Scan Filters FEATURE BENEFITS Device Access Control Allow access to the Exchange server based on user, operating system, and / or client Specify the access granted to specific mailbox components Attachment Blocking Block named attachments or block attachments by true file type, file extension, or file name Active Directory integrated exception rules Data Loss Prevention Use rule-based filters to detect, filter, and mask sensitive data before it transmits out of the network Select from over 100 predefined templates and data identifiers, or create customized expressions and keyword lists to meet company-specific mandates Create customized rules to block, mask, log, and delete sensitive data transmitting across the network 1-5

20 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide FEATURE BENEFITS Device Management Perform a device wipe on lost or stolen devices Apply security settings to specific users including: Password strength requirements Automatic device lock after being inactive Encryption Unsuccessful sign-in data purge Device Exception List Exempt specific user devices from all scans or specific scan types Informative Monitoring Tools TABLE 1-4. Informative Monitoring Tools FEATURE Notifications BENEFITS ScanMail Mobile can automatically send notifications when it does the following: Blocks an infected attachment Filters out undesirable content from an message Detects a significant system event Note For correct resolution of ScanMail Mobile notifications with Simple Network Management Protocol (SNMP), you can import the Management Information Base (MIB) file to your network management tools from the following path in the ScanMail Mobile Installation Package: tool\admin\trend.mib. Informative and Timely Reports and Logs Keep up-to-date using activity logs that detail significant events Send or print graphical reports 1-6

21 Introducing Trend Micro ScanMail Mobile Security for Microsoft Exchange How ScanMail Mobile Protects the Microsoft Exchange Environment Trend Micro recognizes the unique dangers posed by security threats to Microsoft Exchange servers. Trend Micro designed ScanMail Mobile to protect Exchange from these numerous and diverse security risks. ScanMail Mobile uses a filtering strategy to protect Exchange. ScanMail Mobile subjects the message to each filter in the following order: 1. Device Access Control 2. Attachment Blocking 3. Data Loss Prevention 4. Device Management 5. Device Exception List In addition, ScanMail Mobile provides notifications and log queries to assist administrators to monitor and react to security risks. TABLE 1-5. How ScanMail Mobile Protects the Microsoft Exchange Environment FEATURE Device Access Control Attachment Blocking DESCRIPTION ScanMail Mobile can prevent unauthorized users, devices, and clients from accessing the Exchange server or specific mail components. Administrators can granularly configure Device Access Control, allowing access to specific users, running specific operating system versions, using specific clients. ScanMail Mobile can block undesirable attachments according to administrator-defined types or specific names. During scanning, ScanMail Mobile can replace the detected file with a text message and then deliver the message to the intended recipient. 1-7

22 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide FEATURE Data Loss Prevention Device Management Device Exception List Alerts and notifications Reports and logs DESCRIPTION ScanMail Mobile can filter content for sensitive information in different message parts based on policies set by the administrator. ScanMail Mobile filters outgoing messages and can perform specific actions on messages that contain sensitive information. Device Management allows administrators to configure specific security requirements at the user level and perform automated actions whenever a device does not adhere to the policy parameters. Administrators can configure ScanMail Mobile to lock or wipe devices that violate security rules, or that are lost or stolen. ScanMail Mobile provides a device exception list which allows administrators to exclude specific devices from scans. Administrators can create global rules to manage the majority of users and then exclude specific devices, granting greater access to the Exchange server. ScanMail Mobile can send alerts about outbreaks and significant system events. Outbreak alerts notify administrators when the number of detected security risks exceeds a set number. This enables administrators to react quickly to security breaches in their Exchange environment. ScanMail Mobile provides logs and reports to keep administrators informed about the latest security risks and system status. ScanMail Mobile logs significant events such as component updates and scan actions. Administrators can query these events to create log reports providing current and detailed information about the security of the Exchange environment. ScanMail Mobile can generate reports for system analysis that can be printed or exported. 1-8

23 Chapter 2 Getting Started with ScanMail Mobile This chapter explains how to register and activate ScanMail Mobile. Topics include: Getting Started on page 2-2 Understanding the Product Console on page 2-2 Understanding the Server Management Console on page 2-8 Understanding ScanMail Mobile Icons on page 2-10 ScanMail Mobile Registration on page 2-11 ScanMail Mobile Activation on page

24 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Getting Started After installing ScanMail Mobile, there are a number of tasks administrators can perform to ensure that everything is set up and working properly. Procedure 1. Open the ScanMail Mobile product console. 2. Configure ScanMail Mobile to recognize an existing proxy server (if not completed during Setup). Understanding the Product Console Access and control ScanMail Mobile through the intuitive product console. Use the product console to manage multiple Exchange servers and remote servers from any endpoint on the network. The ScanMail Mobile product console is password protected, ensuring that only authorized administrators can modify ScanMail Mobile settings. 2-2

25 Getting Started with ScanMail Mobile Administrators can view the product console from any endpoint on the network that is running a supported browser. FIGURE 2-1. The product console Product Console Elements Banner The banner identifies and describes the product and provides access to Trend Micro support. FIGURE 2-2. Product console banner The banner displays the following: Current server: The server you manage from this console Real-time monitor: Click to access the Real-time Monitor For more information, see Understanding Real-time Monitor on page

26 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Server management: Click to access the Server management console For more information, see Understanding the Server Management Console on page 2-8. Log Off: Click to end your session and close the product console Note Logging off the product console prevents unauthorized users from modifying the settings. Help: Get support by selecting an option from the drop-down list Help options include: Contents and Index: Opens the online help table of contents and index Knowledge Base: Access the Knowledge Base to get the latest information about product troubleshooting and frequently asked questions Security Info: Visit the Trend Micro Security Information page to read about the latest security risks Sales: View the Trend Micro web page to find resellers and service providers in your area Support: Access the Trend Micro technical support website About: View ScanMail Mobile and component version numbers and ScanMail Mobile system information 2-4

27 Getting Started with ScanMail Mobile Side Menu The side menu provides access to the main menu items for ScanMail Mobile. FIGURE 2-3. Product console side menu 2-5

28 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Configuration Area The configuration area allows administrators to configure and modify all ScanMail Mobile configurations and options. FIGURE 2-4. Product console configuration area Viewing the Product Console on a Local Server Procedure 1. Click Start > Programs > Trend Micro ScanMail Mobile Security for Microsoft Exchange > ScanMail Mobile Security Management Console. Note On Windows 2012 platforms, only a desktop shortcut is available. 2. Type the user name and password. 3. Click Log on. 2-6

29 Getting Started with ScanMail Mobile Note Use the account that belongs to Management Group configured during Setup to log on the ScanMail Mobile installations. Viewing the Product Console from a Remote Server Procedure 1. Use a supported browser to access: <http OR https>://<servername>:<portnumber>/smms Where "servername" is the name of the server with the ScanMail Mobile installation and "port number" is the port number used to access the server. Note By default, HTTP uses port and HTTPS uses port Type the user name and password. 3. Click Log on. Getting Help While Using the ScanMail Mobile Product Console ScanMail Mobile offers the following types of help: Procedure To get help using ScanMail Mobile features, read the context-sensitive help. Access context-sensitive help by clicking the help icon ( ) or open the Table of Contents by selecting Contents and Index from the Help drop-down list in the banner area. 2-7

30 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide To access troubleshooting and FAQ information, select Knowledge Base from the drop-down list in the banner area. To access general information about computer security threats and alerts, select Security Info from the drop-down list in the banner area. To get information about how to contact Trend Micro sales representatives or service providers, select Sales from the drop-down list in the banner area. Understanding the Server Management Console The ScanMail Mobile Server Management console allows you to view all of the ScanMail Mobile servers on a network. You will only see servers with the same type of Activation Code. View all ScanMail Mobile servers in a forest when you install ScanMail Mobile with Exchange. Access the Server Management console by clicking Server management in the banner. A brief description of the options is available below: Replicate: Click to copy configurations from one server to another Show: Select to display Scanning result, Scanning status, and Last replication Filter by server name: Type the name of a server to search for Server Name: Click to see Server Name, Server FQDN, and Server Role 2-8

31 Getting Started with ScanMail Mobile FIGURE 2-5. The Server Management console Using the Server Management Console Use the Server Management console to do the following: TABLE 2-1. Server Management Console Features FEATURE View scan results DESCRIPTION View information about the total messages scanned and the scan results for remote ScanMail Mobile servers Scanning results also show the number of detected: Blocked attachments Data Loss Prevention violations View scan status Indicates whether the scan type is enabled or disabled View the following scan status types for remote ScanMail Mobile servers: Attachment Blocking Data Loss Prevention Device Access Control View last replication Displays information regarding the last run replication of the server(s) listed 2-9

32 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Using Server Management to Replicate Configurations The Server Management console replicates any or all configurations from one ScanMail Mobile server to another automatically. Replicating servers in this way is much faster and easier than configuring each server separately. In addition, automatically replicating configurations ensures that all ScanMail Mobile servers that provide the same kind of protection share the same configuration. Administrators can use the Server Management console to turn off the automatic server replication. Procedure 1. Click Server management to open the Server Management screen. 2. Select target servers. 3. Click Replicate. The Replication Settings screen appears. 4. Disable the Automatically replicate all settings to other servers option to stop automatic replication. Understanding ScanMail Mobile Icons The following table displays ScanMail Mobile icons. TABLE 2-2. ScanMail Mobile Icons ( ) Help ICON DESCRIPTION Click to view the ScanMail Mobile Help. ( ) Enabled Click to disable a rule or policy. When this icon displays, the rule or policy is currently enabled. 2-10

33 Getting Started with ScanMail Mobile ICON DESCRIPTION ( ) Disabled Click to enable a rule or policy. When this icon displays, the rule or policy is currently disabled. ( ) Refresh ( ) Warning ( ) Enabled ( ) Disabled ( ) Delete ( ) Cancel wipe Click to refresh the information on the screen. This indicates a warning status. This indicates an enabled status. This indicates a disabled status. Click to delete a template. Click to cancel a device wipe notification. ( ) Tooltip Mouse over this icon to see helpful information about a feature. ( ) Show details ( ) Hide details Click to expand the drop-down. Click to collapse the drop-down. ScanMail Mobile Registration The product package or Trend Micro reseller provides a Registration Key for ScanMail Mobile. Registering ScanMail Mobile entitles administrators to standard support and telephone and online technical support. The length of the maintenance agreement depends on the contract arranged with the Trend Micro representative, but is usually 12 months. Administrators must register and activate ScanMail Mobile to enable all scanning features (even when using an evaluation version Activation Code). 2-11

34 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Online Purchase After completing an online purchase, Trend Micro sends licensing and registration information, including a number that is used during the product registration process. The number needed for registration is either a Serial Number or a Registration Key. A Serial Number is 24 characters in length, including hyphens, in the following format: XXXX-XXXX-XXXX-XXXX-XXXX A Registration Key is 22 characters in length, including hyphens, in the following format: XX-XXXX-XXXX-XXXX-XXXX Most Trend Micro products use a Registration Key. When ready to register, go to the following Trend Micro website: Registering ScanMail Mobile Use one of the following methods to register: Procedure During installation The installation program prompts for an online registration using the Registration Key. Follow the link to the Trend Micro website, register the product, and then return to the installation program to complete the installation process. Online Visit the following Trend Micro website to register online and receive an Activation Code: Contact Trend Micro directly 2-12

35 Getting Started with ScanMail Mobile Provide a Trend Micro representative with the Registration Key to receive an Activation Code. Trend Micro maintains a list of North American contacts at: Note For maintenance renewal, contact Trend Micro sales or your reseller. Click Update License to manually update the maintenance expiration date on the Product License screen. For more information, see Contacting Technical Support on page 9-2. ScanMail Mobile Activation The following conditions require activation. Installing ScanMail Mobile for the first time For example, after purchasing a product version from a Trend Micro reseller and using the registration key to obtain an Activation Code. Changing the version type For example, after obtaining a new Activation Code from a Trend Micro representative and using the product console to activate the new version. Note The evaluation version is fully functional for 30 days, after which ScanMail Mobile disables all scanning. Activate ScanMail Mobile during installation or using the product console. Standard Activation Code Using the standard Activation Code activates ScanMail Mobile. 2-13

36 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide TABLE 2-3. Standard Activation Code Features MAINTENANCE AGREEMENT Evaluation Fully licensed STANDARD FEATURES Using the evaluation Activation Code allows administrators to implement all ScanMail Mobile functions for a limited duration. A fully licensed Activation Code entitles administrators to the standard maintenance agreement and implements all ScanMail Mobile functions available for standard activations. ScanMail Mobile provides a warning when the license agreement is close to expiration. Activating ScanMail Mobile During Installation Procedure 1. Run the installation program. 2. Type the Activation Code on the Product Activation screen. 3. Complete the installation to activate ScanMail Mobile. Activating ScanMail Mobile Using the Product Console Procedure 1. Click Administration > Product License. 2. Click Upgrade Instruction to register ScanMail Mobile. The Trend Micro website opens which allows online registration. Register online to obtain an Activation Code. 3. Click New Activation Code on the Product License screen. 4. Type the Activation Code in the space provided. 2-14

37 Getting Started with ScanMail Mobile 5. Click Activate. Reactivating ScanMail Mobile Administrators may need to reactivate ScanMail Mobile when changing the product version. Reactivating involves changing the Activation Code from one number to another. After clicking New Activation Code, type the new Activation Code to receive all the benefits of the new ScanMail Mobile version. Procedure 1. Click Administration > Product License. The Product License screen appears. 2. Click New Activation Code. The Product License > New Activation Code screen appears. 3. Type or paste the new Activation Code. 4. Click Activate. This activates the new version of ScanMail Mobile and enables all the functions available according to that license. 2-15

38

39 Part II Configuring Scans and Scan Filters

40

41 Chapter 3 Configuring Device Access Control This chapter explains how to configure Device Access Control to protect the Exchange environment. Topics include: About Device Access Control on page 3-2 Managing Device Access Control Rules on page 3-2 Configuring Device Access Control Rules on page

42 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide About Device Access Control Device Access Control allows administrators to manage the mobile devices that attempt to connect to the Exchange server. Administrators can configure ScanMail Mobile to only allow authorized users, using specified operating systems, versions, and clients to access the Exchange server, preventing all other rogue, non-compliant or vulnerable devices from gaining access to sensitive data. Administrators can further limit the level access granted to authorized users to specific mailbox components within the Exchange environment. Device Access Control comes with a global rule to manage devices not defined in other rules. The global rule encompasses less popular mobile device types and operating systems to ensure that all mobile connections to the Exchange server are secure. Managing Device Access Control Rules Procedure 1. On the left navigation pane, click Device Access Control. The Device Access Control screen appears. 2. To enable Device Access Control: a. Select Enable Device Access Control. b. Click Save. 3. In the Device Access Control list, perform the following tasks: Click Add to create a new rule. Click the Owner, OS, Version, or Client hyperlink to edit an existing rule. To reorder the Device Access Control rule priority: a. Select the check box next to the policy or exception name in the list. b. Click Reorder. 3-2

43 Configuring Device Access Control c. Type the priority number in the Priority field. d. Click Save Reorder. Note ScanMail Mobile processes Device Access Control rules based on a first match basis. If a device matches rule 2, ScanMail Mobile does not subject the device to further rules. Enable or disable access to specific mailbox components by clicking the enable ( ) and disable ( ) icons. Configuring Device Access Control Rules Note Device Access Control does not prevent users from creating new objects for mailbox components, even if the mailbox component access is blocked. For example, the administrator configures Mail as Block. Mobile users can still create and send new messages, but cannot receive messages from Exchange. Procedure 1. On the left navigation pane, click Device Access Control. The Device Access Control screen appears. 2. Add or edit a rule: For new rules, click Add. For preexisting rules, click the Owner, OS, Version, or Client hyperlink. The Device Access Control: Add/Edit Policy screen appears. 3. Select the following device owners: 3-3

44 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide Anyone: Select to include all devices owners. Specific owners: Select from Active Directory users, groups, or ScanMail Mobile special groups. 4. In the Operating Systems section, select any operating system or specific operating systems and/or versions. Note Versions automatically add a wildcard (*) character to represent all subsequent minor versions or revisions if not typed by the administrator (for example, "1" represents "1.*" and "1.0" represents "1.0.*"). ScanMail Mobile supports versioning to the revision level (for example, "1.1.1"). When determining the versions to include in a policy or exception, the Exclude versions value overrides the From and To values (for example, From: 1.*, To: 2.5.2, Exclude versions: 2.5.* results in all versions starting with "2.5" being excluded from the policy or exception). To select a single version of an operating system, select Specific version range and type the version number in both the From and To fields. Use the Exclude versions field to exclude a version from the version range. For example, to add all Android versions from 3.0 to but not version 3.2.1: a. In the From field, type 3.0. b. In the To field, type c. In the Exclude versions field, type In the Client section, select: Any client Specific client: Built-in client: The prepackaged client shipped with the device TouchDown: A third-party ActiveSync client with Exchange Server support 6. In the Mailbox Components section, select to Allow or Block access to the following: 3-4

45 Configuring Device Access Control Mail Calendar Contacts Tasks 7. Click Save. Note ScanMail Mobile uses the access granted to Tasks and applies the access rights to Notes for devices that are capable of syncing Notes with the Exchange server. 3-5

46

47 Chapter 4 Configuring Device Management This chapter explains how to configure Device Management to protect the Exchange environment. Topics include: About Device Management on page 4-2 About Device Wipe on page 4-2 About Security Policies on page

48 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide About Device Management Device Management allows administrators to enforce minimum security requirements on all devices attempting to connect with the Exchange server. Administrators can configure devices to comply with password standards and encryption requirements before granting access to Exchange. ScanMail Mobile also provides administrators the ability to take action on devices that do not comply with the company's security standards, or that a user reports lost or stolen. Administrators can automatically lock devices that are inactive for a specified time. ScanMail Mobile can also wipe lost or stolen devices, or when a user makes consecutive unsuccessful attempts to sign in to a device after a specified number of times. For details about the features available in Device Management, see the following: About Device Wipe on page 4-2 About Security Policies on page 4-4 About Device Wipe ScanMail Mobile provides administrators with the Device Wipe feature to protect sensitive data from unauthorized access on lost or stolen devices. After a user reports that a device is missing, the administrator can configure ScanMail Mobile to send a wipe command to the device. If anyone attempts to turn on the device, the device receives the wipe command and automatically deletes all information on the storage device(s). The Device Wipe List The Device Wipe list displays information regarding devices that ScanMail Mobile has already wiped and devices waiting to receive the wipe command. The Device Wipe list displays the following device details: 4-2

49 Configuring Device Management TABLE 4-1. Device Wipe List Information ITEM DESCRIPTION Device Type Device Model Owner OS Device ID Wipe Time The type of device The model name or number of the device The owner of the device The operating system and version of the device The manufacturer's ID of the device The time the wipe command completed Status Wipe pending: Click the wipe icon to cancel the command. Wipe successful: Click the trash icon to remove the device from the list Note Devices in the Device Wipe list continue to receive wipe commands until the administrator removes the device from the list. ScanMail Mobile continually "rewipes" devices to prevent any subsequent attempts to access the Exchange server using a stolen device. Configuring Device Wipe Procedure 1. On the left navigation pane, click Device Management > Device Wipe. The Device Wipe screen appears. 2. Click Select Devices. The Device Wipe: Select Devices screen appears. 4-3

50 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide 3. Type the name of the device owner in the Search by owner text field and click Search. All devices associated with the selected owner appear in the list. 4. Select the check box beside the device(s) to wipe. Note 5. Click Wipe. Administrators cannot send a wipe command to devices that display the Wipe pending or Wipe successful statuses. Administrators must cancel the current wipe command or wait until the device has completed the wipe process and remove the device from the Device Wipe list. About Security Policies Administrators can configure Device Management security policies for users to ensure that all devices connecting to the Exchange server meet a minimum security level before ScanMail Mobile grants access to any sensitive data. Security policies allow administrators to set standards on password strength, device inactivity times, and encryption. If a device does not comply with these standards, ScanMail Mobile blocks access to the Exchange server. Administrators can further protect the Exchange server by configuring behavioral rules for devices. When devices are inactive for a specified time, ScanMail Mobile can automatically lock the device to prevent access by unauthorized individuals. When a user unsuccessfully tries to sign in to a device for a specified number of times, ScanMail Mobile can perform a wipe action on the device to protect the data stored on the device from whoever is attempting to gain access. The Security Policies List The Security Policies list displays information regarding the current policies that ScanMail Mobile associates with accounts. ScanMail Mobile applies a default policy for all accounts not defined by the administrator in other policies. 4-4

51 Configuring Device Management Note Administrators cannot select accounts for the Default Policy. Administrators can only configure the rules that apply to all accounts not specified in other policies. ScanMail Mobile does not preconfigure any settings for the default policy. The Security Policies list displays the following details: TABLE 4-2. Security Policies List Information ITEM DESCRIPTION Policy The name of a security policy defined by the administrator Password Minimum Length: The minimum required length for passwords Password Complexity: The configured password complexity option For details on the complexity requirements for specific operating systems, see Password Complexity Requirements on page 4-7. Inactivity Lock (minutes) The number of minutes that ScanMail Mobile allows a device to remain inactive before automatically locking the device Note To unlock the device, users must type the correct password. Sign-in Attempts Before Auto-Wipe The number of concurrent unsuccessful sign-in attempts on a device before ScanMail Mobile wipes all data from the device storage WARNING! Configuring a low number may result in accidental data loss. Trend Micro recommends using caution when determining whether to perform an automatic wipe of data. 4-5

52 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide ITEM Device Encryption DESCRIPTION Indicates whether encryption is required Configuring Security Policies Procedure 1. On the left navigation pane, click Device Management > Security Policies. The Security Policies screen appears. 2. Add or edit a policy: For new policies, click Add. For preexisting policies, click the Policy Name hyperlink. The Security Policies: Add/Edit Policy screen appears. 3. Type a name and optionally provide a description for the policy. 4. In the Apply to Accounts section, select the Active Directory accounts to which ScanMail Mobile associates the policy. 5. In the Security Criteria section, configure the following settings as required: Minimum password length: Requires users to use passwords that are a minimum number of characters as specified by the administrator Require password complexity: Requires users to include a minimum complexity requirement for device passwords, based on device type and operating system For details on the complexity requirements for specific operating systems, see Password Complexity Requirements on page 4-7. Lock device after inactivity: Specify the amount of time ScanMail Mobile allows a device to remain inactive before automatically locking the device 4-6

53 Configuring Device Management Note To unlock the device, users must type the correct password. Require encryption on device: Select to enforce Exchange encryption on the device Wipe device after unsuccessful sign-in: Specify the number of sign-in attempts allowed before ScanMail Mobile wipes all data from the device storage 6. Click Save. WARNING! Configuring a low number may result in accidental data loss. Trend Micro recommends using caution when determining whether to perform an automatic wipe of data. Password Complexity Requirements The password complexity requirements differ for different device types and operating systems. The following tables list the behavior of each complexity Option for the devices tested at the time of the ScanMail Mobile 1.0 release. Note The functionality of password complexity is dependent on the device type and operating system version. If the specified password does not comply with the complexity requirements, most devices provide users with a message that indicates what the specific requirements are for the device. 4-7

54 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide TABLE 4-3. Android Devices COMPLEXITY LEVEL COMPLEXITY REQUIREMENTS ANDROID 4 ANDROID 2 Option 1 Option 2 Option 3 Option 4 A combination of the following types of characters: At least one uppercase (A-Z) or lowercase (a-z) character At least one number (0-9) or special character (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of the following types of characters: At least one uppercase (A-Z) or lowercase (a-z) character At least two numbers (0-9) or special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of the following types of characters: At least one uppercase (A-Z) or lowercase (a-z) character At least three numbers (0-9) or special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of the following types of characters: At least one uppercase (A-Z) or lowercase (a-z) character At least four numbers (0-9) or special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) Alphanumeric A combination of the following types of characters: Alphanumeric At least two numbers (0-9) or special characters (!@#$ %^&*()_- =+~`[]{}\ ;:'"?/<>,.) A combination of the following types of characters: Alphanumeric At least three numbers (0-9) or special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of the following types of characters: Alphanumeric At least four numbers (0-9) or special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) 4-8

55 Configuring Device Management TABLE 4-4. ios Devices COMPLEXITY LEVEL Option 1 COMPLEXITY REQUIREMENTS A combination of the following types of characters: Alphanumeric At least one special character (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) Option 2 A combination of the following types of characters: Alphanumeric At least two special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) Option 3 A combination of the following types of characters: Alphanumeric At least three special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) Option 4 A combination of the following types of characters: Alphanumeric At least four special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) TABLE 4-5. Windows Phone Devices COMPLEXITY LEVEL COMPLEXITY REQUIREMENTS WINDOWS PHONE 8 WINDOWS PHONE 7 Option 1 At least one of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of at least two of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) 4-9

56 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide COMPLEXITY LEVEL COMPLEXITY REQUIREMENTS WINDOWS PHONE 8 WINDOWS PHONE 7 Option 2 Option 3 Option 4 A combination of at least two of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of at least three of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of all of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of at least two of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of at least three of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) A combination of all of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$ %^&*()_-=+~`[]{}\ ;:'"?/<>,.) TABLE 4-6. BlackBerry Devices COMPLEXITY LEVEL Option 1 COMPLEXITY REQUIREMENTS At least one uppercase (A-Z) or lowercase (a-z) character 4-10

57 Configuring Device Management COMPLEXITY LEVEL Option 2 COMPLEXITY REQUIREMENTS A combination of at least two of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$%^&*()_-=+~`[]{}\ ;:'"?/<>,.) Option 3 A combination of at least three of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$%^&*()_-=+~`[]{}\ ;:'"?/<>,.) Option 4 A combination of all of the following types of characters: Uppercase characters (A-Z) Lowercase characters (a-z) Numeric characters (0-9) Special characters (!@#$%^&*()_-=+~`[]{}\ ;:'"?/<>,.) 4-11

58

59 Chapter 5 Configuring Attachment Blocking This chapter explains how to configure Attachment Blocking to protect your Exchange environment. Topics include: About Attachment Blocking on page 5-2 Enabling Attachment Blocking on page 5-2 Configuring an Attachment Blocking Exception on page 5-3 Global Attachment Blocking Policy on page

60 ScanMail Mobile Security for Microsoft Exchange 1.0 Administrator s Guide About Attachment Blocking Attachment blocking prevents messages containing suspicious attachments from being delivered. ScanMail Mobile can block attachments according to the following: Attachment type Attachment name Attachment extension Attachment size The extension of an attachment identifies the file type, for example.doc,.exe, or.dll. Many viruses/malware are closely associated with certain types of files. By configuring ScanMail Mobile to block according to file type, administrators can decrease the security risk to Exchange servers from those types of files. Similarly, specific attacks are often associated with a specific file name. Recipients for messages can match one attachment blocking exception or the attachment blocking global rule based on priority. If the recipient matches an attachment blocking exception, then targets selected in the exception are excluded from attachment blocking global rule. If the recipient does not match any attachment blocking exceptions, then the attachment blocking global rule is applied. Enabling Attachment Blocking Procedure 1. Click Attachment Blocking on the main menu. The Attachment Blocking screen displays. 2. Select Enable Attachment Blocking. 3. Click Save. 5-2

61 Configuring Attachment Blocking Configuring an Attachment Blocking Exception Attachment Blocking exceptions can exclude recipients from the Global Policy based on the configured target settings. Create a new exception by clicking Attachment Blocking > Add Exception. Modify an existing policy by clicking Attachment Blocking > [Policy Name]. Configure Attachment Blocking exceptions through the following three step process: 1. Selecting Devices on page Configuring Attachment Blocking Targets on page Enabling an Attachment Blocking Exception on page 5-6 Selecting Devices Use the Device Exclusion Criteria table to exclude devices from the policy. Procedure 1. Click Attachment Blocking on the main menu. The Attachment Blocking screen displays. 2. Add or edit a policy or exception: For new policies or exceptions: Click Add Exception. For preexisting policies or exceptions: a. Click the exception Policy or Devices hyperlink to edit an exception. b. Click the Devices tab. 3. To configure device exclusions: Click Add. 5-3