Admin Guide Defense With Continuity

Transcription

1 Admin Guide Defense With Continuity DOCUMENT REVISION DATE: April, 2010

2 Defense with Continuity--Admin Guide / Table of Contents Page 2 of 41 Table of Contents QUICK STAR T CHECKLIST... 3 USE ONLINE HELP... 7 SET UP YOUR SER VICE... 7 ENSURE YOU CAN RECEIVE FROM YOUR SER VICE PROVIDER... 7 SET YOUR PASSWORD FROM THE SIGN IN PAGE... 7 SIGN INTO THE CONTROL CONSOLE RESET YOUR PASSWORD FROM THE SIGN IN PAGE CONFIRM YOUR PRIMAR Y DOMAINS CREATE A DOMAIN ALIAS, IF NECESSAR Y CONFIRM YOUR INBOUND SMTP SER VER ADD IP ADDRESS OF OUTBOUND SER VER SET UP A SMART HOST REDIRECT YOUR MX RECORDS CONFIRM THE POLICIES FOR YOUR DOMAINS ACTIVATE CONTENT FILTERS CHECK MESSAGE QUARANTINE REVIEW REPORTS TO CHECK POLICIES LOCK DOWN YOUR ENVIRONMENT ADMINISTER USERS DEFINE HOW USERS LOG IN REVIEW THE CURRENT USER LIST DISABLE USER ACCESS TO THE CONTROL CONSOLE (OPTIONAL) TURN ON EXPLICIT USER CREATION (OPTIONAL) CREATE THE REMAINING USERS Add Users Manually Add Users with a Batch File CREATE USER ALIASES, IF NECESSAR Y Add Aliases User-by-User FOR MESSAGE CONTINUITY, CREATE A BATCH FILE TO ADD USERS AND PASSWORDS CUSTOMIZE INBOUND MAIL FILTERS (OPTIONAL) CREATE A CUSTOM POLICY (OPTIONAL) CREATE A NEW CONTENT FILTER (OPTIONAL) REVIEW QUARANTINED MAIL CREATE A GROUP, IF NECESSARY DETERMINE WHO NEEDS SEPARATE FILTERING CREATE A GROUP ADD USERS TO THE GROUP CREATE A CUSTOM POLICY FOR THE GROUP ASSIGN THE GROUP TO THE CUSTOM POLICY ADMINISTER DISASTER RECOVER Y SERVICES SET UP SPOOLING FOR DISASTER RECOVER Y SET UP NOTIFICATIONS OF DISASTER RECOVER Y... 41

3 Defense with Continuity--Admin Guide / Quick Start Checklist Page 3 of 41 Quick Start Checklist The following checklist lists the tasks you would typically perform after your Defense with Continuity is activated. Each task is described in more detail later in the Quick Start Guide. Task SET UP YOUR SERVICE Ensure You Can Receive from Your Service Provider Sign into the Control Console Description If you had or still have a different security or filtering service and your network is administered so that you can receive only from IP addresses associated with that security service, you must administer your network to allow incoming from the Control Console servers. You need the URL, sign-in, and password, which you will create yourself. To set your password, see Reset Your Password from the Sign in Page. Confirm Your Primary Domains On the Control Console, click Account Management > Domains. Create a Domain Alias, If Necessary On the Control Console, click Account Management > Domains. Select a domain, then click Edit Aliases. Setup Your Inbound SMTP Server Add IP Address of Outbound Server, If Necessary Set up a Smart Host (If Outbound Protection is Turned on) Redirect Your MX Records Click Protection > Setup. Select a domain from the Domain drop-down menu. Click Protection > Setup > Outbound Servers. You must enter an IP address (for example ) or a CIDR address (for example /27). To ensure that your outbound is filtered, you must designate, for each of your outbound mail servers, an Protection server as your Smart Host. The Mail Exchange (MX) record for each of your mail servers is a specification within a Domain Name Server (DNS Server) operated by your Internet Service Provider (ISP). These records must be changed by you or your ISP to fully-qualified domain names (for example, denver.acme.com) within the Defense with Continuity network. The exact changes necessary are provided in this guide. Confirm the Policies for Your Domains Click Protection > Policies. Select the default inbound policy, then browse each tab for the policy.

4 Defense with Continuity--Admin Guide / Quick Start Checklist Page 4 of 41 Task Description Activate Content Filters Click Protection > Policies > Content. Select a default content group, and click Update, Click the Active checkbox, and click Save. Check Message Quarantine Click Protection > Quarantine. Select All Threats and All days. Review Reports to Check Policies Click Protection > Reports. Lock Down Your Environment Five to seven days after you have redirected your MX record, and after you have verified that is being filtered and delivered appropriately, restrict all IP access to your mail server with the exception of the Protection subnets provided in this guide. Add IP Address of Outbound Server ADMINISTER USERS Click Protection > Setup. From the Domain drop-down menu on the Setup page, select the domain whose SMTP server you want to check. The Inbound Servers Setup page is displayed. The Server IP Address Range field displays the domain name(s) or IP address(es) for the domain s outbound server. Make sure the SMTP server(s) listed are valid and correct. Ensure that all other information on the page is correct, and select Save. Define How Users Log in 1 Click Account Management > Users > Authentication. 2 From the Authentication Type drop-down menu, select Passwords. 3 Click More Options if you want to use a batch file to set or change passwords for multiple users all at once. 4 Click Save. Review the Current User List 1 Click Account Management > Users. 2 Review the users on the list for any invalid users. 3 Click Delete. if you see any invalid users. 4 In the Users List, look for users who are not administered on your mail server. 5 Highlight each invalid user and click Add to add the user to the Delete List. 6 Click Save. Disable User Access to the Control Console (Optional) Turn on Explicit User Creation (Optional) Click Protection > Policies > Anti-Spam > Reporting. Select the field Allow non-admin users to login directly to the Control Console. Click Protection > Setup > User Creation Settings. Select Explicit.

5 Defense with Continuity--Admin Guide / Quick Start Checklist Page 5 of 41 Task Description Create the Remaining Users You can add users with any of three methods: Manually Click Account Management.> Users.> Create. With a Batch File Click Account Management.> Users.> Create. Select Batch. Use Directory Integration Create User Aliases, If Necessary You can add user aliases with any of three methods: Add Aliases User-by-User Click Account Management > Users.> Create. Click a user name from the list. Click Aliases. Add Aliases with a Batch File Use Directory Integration For Message Continuity, Create a Batch File to Add Users and Passwords To use the Message Continuity service, you must add users to Protection with a method other than SMTP Discovery. The default SMTP Discovery method does not add users until they have received several s. As a result, some users might not be added for quite some time, and therefore, those users would not be immediately available in case of disaster recovery. See Create the Remaining Users. CREATE INBOUND MAIL FILTERS (OPTIONAL) Create a Custom Policy (Optional) Click Protection > Policies > New. Create a New Content Filter (Optional) Click Protection > Policies. Click the policy you want to change. Click Content. Click New. Review Quarantined Mail Click Protection > Quarantine. Select All Threats and All days.

6 Defense with Continuity--Admin Guide / Quick Start Checklist Page 6 of 41 Task Description CREATE A GROUP, IF NECCESSARY Determine Who Needs Separate Filtering Groups are used when there are users in the organization whose should be filtered according to a policy other than the default policy. To filter differently for a specific group of users, you must first determine who should be in a group. Create a Group Click Account Management > Groups. Click New. Add Users to the Group On the Groups screen, select the group to which you want to add users, then click Users. Create a Custom Policy for the Group See Create a Custom Policy (Enterprise Customer Only). Assign the Group to the Custom Policy ADMINISTER DISASTER RECOVERY SERVICES Set up Spooling for Disaster Recovery Click Protection > Policies. Select the custom policy to which you want to assign a group. Click Group Subscriptions. You will use Message Continuity for disaster recovery. So you must set up spooling. Click Protection > Setup > Disaster Recovery. From the Domain drop-down menu, select the domain you want to set up for Disaster Recovery. Set up Notifications of Disaster Recovery You can specify that notifications are ed automatically to designated recipients, typically yourself or other administrators, when the following Disaster Recovery events occur: Under the Notifications section of the Disaster Recovery Setup screen, type, in the Recipient Address field, the address of a person who should receive notification of a disaster recovery event.

7 Defense with Continuity--Admin Guide / Setup Your Service Page 7 of 41 Use Online Help Use the online help in the Control Console to find details on the administration pages for the Defense with Continuity. The online help describes the purpose of administration pages, the fields on the administration pages, and procedures that use the administration pages. This Admin Guide provides only key information on administration pages to help get you started. The Admin Guide does not provide the details on all administration fields. Instead, you must use the online help for detailed information on administration pages and fields. Set up Your Service Ensure You Can Receive from Your Service Provider If you had or still have a different security or filtering service and your network is administered so that you can receive only from IP addresses associated with that security service, you must administer your network to allow incoming from the Control Console servers. For example, a port in your company s firewall may need to be enabled to receive from the IP addresses of the Control Console servers. This enablement is necessary in order for you and your users to set the initial password for access to the Control Console. Set Your Password from the Sign in Page Note: The Console is accessed via your Control Panel (cp.collaborationhost.com), and selecting the Console button within the Defense section. If you are signing into the Control Console for the first time, you might need to obtain a password. If so, perform the following steps:

8 Defense with Continuity--Admin Guide / Setup Your Service Page 8 of 41 1 On the Sign in page, click the Forgot your password or need to create a password? link. The following screen is displayed. 2 In the Address field, type your address. 3 Choose password information to my Domain Contact,and Click Next. You will receive an momentarily with further instructions. Continue with Step 4. 4 Open the message. The subject line says Control Console Login Information. The is similar to the following: 6 Click the link in the . The link is active for only a limited time after the is sent (typically 60 minutes). 7 If you previously had selected a security question, the security question is displayed. If you had not previously selected a security question, select a question from the Security Question drop-down menu. 8 Type the answer to the question in the Security Answer field. 9 In the Password field, type a password. The password must comply with the following rules: Length must be a minimum of 8 characters. Alpha, numeric, and special character types are allowed.

9 Defense with Continuity--Admin Guide / Setup Your Service Page 9 of 41 There must be at least one character that differs in character type (alpha, numeric, or special) from the majority of characters. Thus, if the password contains mostly alpha characters, then at least one character must be either a special character or numeric. For example, majordude is invalid, but majordude9 is valid. Allowed special characters are: left parenthesis ( ( ) ampersand ( & ) right bracket ( ] ) right parenthesis ( ) ) asterisk ( * ) colon ( : ) apostrophe ( `) hyphen ( - ) semicolon ( ; ) tilde ( ~ ) plus sign ( + ) double quotes ( " ) exclamation (! ) equals sign ( = ) single quotes ( ' bar ( ) less than sign ( < ) hash ( # ) backslash ( \ ) greater than sign ( > ) dollar sign ( $ ) left curly bracket ( { ) period (. ) percentage sign ( % ) right curly bracket ( }) question mark (? ) caret ( ^ ) left bracket ( [ ) Spaces are not allowed. Passwords are case-sensitive (for example, Password, password, and PASSword would be different passwords). Make sure you can remember your password, but do not use obvious passwords (for example, password, your name, or a family member s name). Keep your password safe and private. 10 Retype your password in the Confirm Password field. 11 Click Save.

10 Defense with Continuity--Admin Guide / SETUP Sign into the Control Console Page 10 of 41 Sign into the Control Console To administer Defense with Continuity, you must sign into the Control Console with the following steps: Note: The first time you sign in, you might need to create your password. If so, see Set Your Password from the Sign in Page. 1 Open a browser on your computer and enter the URL for the Control Console ( 2 Click on the Console Page link to open the Defense Console.. 2 At the Control Console Sign in page, enter your address and password. 3 Click Sign in. If you have not previously entered an answer to a security question, the Security Question screen will pop up.

11 Defense with Continuity--Admin Guide / SETUP Sign into the Control Console Page 11 of 41 The answer to the security question is used is used to validate you, the user, if you forget your password. You can later change your security question and/or security answer on the Preferences page of your user account. 4 Select a security question and type the answer. Your answer is not case-sensitive. Note: With the Defense with Continuity service, you can also sign into the Control Console from a Spam Quarantine Report.

12 Defense with Continuity--Admin Guide / SETUP Confirm Your Primary Domains Page 12 of 41 Reset Your Password from the Sign in Page Note: This capability may not be available if the user authentication method is set to LDAP, POP3, or IMAP or if the ability to change passwords has been disabled at the system level. If you forget your password, perform the same steps as in Set Your Password from the Sign in Page. Confirm Your Primary Domains A primary domain is typically, though not always, associated with a single mail server. Let s say your company, Acme Company, uses six mail servers, each with its own primary domain name. Your domain(s) should have already been assigned within the Control Console. You must confirm that these domains, as provisioned, match the actual domain names within your network. 1 Click Account Management.> Domains. The Domain Management page is displayed. The page lists the primary domains assigned in the Control Console. 2 Make sure that the list of domains matches those established in your network. Check with your network or mail server administrator to verify the domains. If a domain that Defense with Continuity should protect is missing, you must add it from the Domain section of the Control Panel.

13 Defense with Continuity--Admin Guide / SETUP Create a Domain Alias Page 13 of 41 Create a Domain Alias, If Necessary You company also may use domain aliases. For example, acme.org and acme.net might be domain aliases for your company s acme.com domain so that mistakenly sent to addresses using acme.org or acme.net actually are sent to acme.com. You must add these domain aliases in the Control Console to ensure to these domains are filtered and delivered. 1 Click Account Management > Domains. 2 On the Domain Management page, click the domain for which you want to add aliases. In our example, you would click acme.com. The Domain Details page is displayed. 3 Click Edit Aliases. The Domain Aliases page is displayed. 4 Complete the Add field, and click Add. For more information, click Help.

14 Defense with Continuity--Admin Guide / SETUP Confirm Your Inbound SMTP Page 14 of 41 Confirm Your Inbound SMTP Server Defense with Continuity checks destined for your inbound Simple Mail Transfer Protocol (SMTP) server or servers. To configure these servers, perform the following steps: 1 Click Protection > Setup. 2 From the Domain drop-down menu on the Setup page, select the domain whose SMTP server you want to check. 3 Enter an SMTP Host address to deliver inbound SMTP traffic. 4 Enter a Server Port Normally SMTP is port 25. If different, specify here. 5 Enter a Preference MX Preference for this server. When delivering mail, the service will attempt to deliver to the lowest numbered server(s) first. If that fails, the service will attempt to deliver to the SMTP Host Address with the next highest number, and so on. 6 Active Indicates if this SMTP Host Address is currently accepting traffic. Uncheck this check box to temporarily stop this Host from accepting traffic. 7 Delete To remove an SMTP Host Address from the list, click the check box, then click Save. Add New Host Allows you to add a new IP address or URL to the list. 8 Click Save to finish 9 Repeat steps 2 through 4 for any other domains in your network. For more information on this page, click Help. NOTE: You must set a Server Port (default is 25) and a Preference value (default is none) for each new Host. If one of these fields is blank (no number), when you click Save a warning message will appear and the service sets a default of Port = 25, Preference = 0, and sets the Host to Inactive. You need to change these default settings if they are incorrect for your server(s).

15 Defense with Continuity--Admin Guide / SETUP--Add IP Address of Outbound Server Page 15 of 41 Add IP Address of Outbound Server Your service includes Outbound Message filtering, you must identify one or more outbound mail servers through which your users send outgoing mail. While your outbound server might use a Domain Name Server (DNS) name within your network (for example, lewisoutbound.acme.com), you identify the outbound sever within Defense with Continuity with an IP address (for example, ). Alternatively, you can specify a Classless Interdomain Routing (CIDR) address for a range of outbound servers (for example, /27) only. The address must be a public address. 1 Click Protection > Setup> Outbound Servers. The Outbound Server Setup page is displayed: 2 Click Add New Address, and add the address of the outbound server. Important: You or your network administrator should also do the following before or immediately after adding your outbound server(s): Update Sender Policy Framework (SPF) records on your mail server(s) to ensure only authorized sources are sending outbound . Scan your network for open relays, viruses and malware. Set up a Smart Host To ensure that your outbound is filtered, you must designate, for each of your outbound mail servers, an Defense with Continuity server as your Smart Host. Your outbound is then relayed through Defense with Continuity before continuing to its final destinations. Note: This task is performed on your outbound server or servers, on your network router, or on some other server, depending on your network s configuration.

16 Defense with Continuity--Admin Guide / SETUP--Redirect Your MX Records Page 16 of 41 Redirect Your MX Records The Mail Exchange (MX) record for each of your mail servers is a specification within a Domain Name Server (DNS Server) operated by your Internet Service Provider (ISP). Each MX record specifies a host name and preference that determines where and how your ISP routes your company s . Your MX record or records at your ISP must be changed to fully-qualified domain names (for example, denver.acme.com) within the Defense with Continuity network. These changes allow Defense with Continuity to filter your before it arrives at your company s mail servers. Your Network Administrator or Domain Registrar will be responsible for making these changes to your DNS Record: MX Record: server1.inboundmx.com (preference 10) server2.inboundmx.com (preference 20) TXT Record: v=spf1 ptr:mxlogic.net ptr:collaborationhost.net ip4: /24 include:mxlogic.net ~all Additional domains should be redirected in the same manner. Do not re-direct your mail exchange (MX) record to anything other than what you see listed above. Use of other MX records may cause mail to bypass the filtering system, increasing threat exposure.

17 Defense with Continuity--Admin Guide / SETUP--Confirm Domain Policies Page 17 of 41 Confirm the Policies for Your Domains Defense with Continuity has default inbound and outbound mail filters. These filters are called policies. The default policies are automatically assigned to each of your domains after the domain is defined. For many companies, the default policy filters effectively and doesn t require changes. However, it is strongly recommended that you review the default policy to make sure the policy meets your needs. If the policy does not meet your needs, you can customize the policy. For information on customizing policies, see Customize Inbound Mail Filters. To confirm your policies, perform the following steps 1 Click Protection > Policies. The list of policies is displayed. Because the same default policy applies to all domains, you do not need to select a domain to see the default policy. 2 Click Default Inbound. 3 Click the Edit button. 4 Click each of the following tabs and review the options that are selected and those that are available: For information on what the all options mean, see the online help. Virus Look at both the Action and Notifications tabs. Spam Look at all three tabs Classification, Content Groups, and Reporting. Content Look at all four tabs Content Groups, Notifications, HTML Shield, and ClickProtect. Attachments Look at the following three tabs File Types, Filename Policies, and Notifications. Allow/Deny Look at the following three tabs Sender Allow, Sender Deny and Recipient Shield. a Notifications Look at all three tabs Virus, Content, and Attachments. Group Subscriptions

18 Defense with Continuity--Admin Guide / SETUP--Activate Content Filters Page 18 of 41 Activate Content Filters By default, the Profanity, Racial Insensitivity, and Sexual Overtones content filters within the default inbound policy are inactive. If you choose not to customize your inbound policy (see Customize Inbound Mail Filters (Optional), you should activate these content filters in the default Inbound Policy. 1 Click Protection > Policies. 2 Click Default Inbound. 3 Click Content. The Content Groups screen is displayed. 4 Select Profanity, and click Edit. The Edit Content Group Policy section is displayed. 5 Click the Enable checkbox, then click Save.

19 Defense with Continuity--Admin Guide / SETUP--Check Message Quarantine Page 19 of 41 Check Message Quarantine To ensure Defense with Continuity is filtering messages in a way that is acceptable, check the messages that appear in the Message Quarantine areas. To check the quarantine, perform the following steps: 1 Click Protection > Quarantine. 2 From the Threat drop-down menu, select All Threats. 3 From the Day drop-down menu select All Days. 4 From the Direction drop-down menu, select Inbound or Inbound and Outbound if you also use outbound filtering. 5 Click Search.

20 Defense with Continuity--Admin Guide / SETUP--Check Message Quarantine Page 20 of 41 The list of quarantined messages is displayed at the bottom of the screen. 6 Review the type of threat of each message, as well as the sender, recipient, and subject. 7 To view more detail about a message, hover your cursor over the From column of the message. Different information is displayed depending on the type of violation incurred. For a SPAM violation, you see the SPAM score. For an attachment violation, you see the attachment name that invoked the violation. For a virus violation, you see the Virus name that invoked the violation. For a content violation, you see the Content Keyword that invoked the violation. 8 Ensure that messages from senders of desired organizations are not being quarantined unnecessarily. Those sender addresses may be added to the Policy-level Allow List. 9 Ensure that senders from undesired organizations can also be determined by Message Quarantine monitoring, and those senders can be added to the Policy-level Deny List.

21 Defense with Continuity--Admin Guide / SETUP--Review Reports Page 21 of 41 Review Reports to Check Policies To ensure Defense with Continuity is filtering messages in a way that is acceptable, review the various service mail flow statistical reports. To review reports, perform the following steps: 1 Click Protection > Reports. 2 From the Report drop-down menu, select a report. 3 From the Period calendar, select the month whose data you want to view. 4 Check the reports for data such as the following: Threats encountered Messages released from the Quarantine Inbound server connections

22 Defense with Continuity--Admin Guide / SETUP--Lock Down Your Environment Page 22 of 41 Lock Down Your Environment Five to seven days after you have redirected your MX record, and after you have verified that is being filtered and delivered appropriately, restrict all IP access to your mail server with the exception of the following subnets. This action ensures that no mail is presented to your mail server without filtering. The preferred setting is to include the Classless Inter-Domain Routing (CIDR) for the entire Class 8 C notation. Alternate settings are also provided below. Preferred Setting If your firewall solution accepts Classless Inter-Domain Routing (CIDR) and can support Class 8 C notation please include the following: CIDR Starting IP Ending IP / / Alternate Setting (1) If your firewall solution accepts Classless Inter-Domain Routing (CIDR) and only supports Class 1 C notation, you will need to include the following entries to the entire subnet: CIDR Starting IP Ending IP / / / / / / / / / / / / Alternate Setting (2) If your firewall solution does not accept Classless Inter-Domain Routing (CIDR) notation, you will need to include the starting and ending IP address for either the Class 8 C addresses or the Class 1C addresses which are included above. Note: This task is performed on your inbound server or servers or on your network firewall server.

23 Defense with Continuity--Admin Guide / ADMIN USERS--Define User Login Page 23 of 41 Administer Users Define How Users Log in You can use one of four methods for authenticating users when they log in: Passwords LDAP POP3 IMAP The latter three methods cause the Account Management software to query a server for user credentials. Note: If you plan to use the User Synchronization process to add users, it is recommended that you use LDAP User Authentication since this method allows you to take advantage of Active Directory and can save you a lot of time. Passwords Authentication means that users log into the Control Console with the standard user name and password method. If this authentication method is selected, each user must have a defined user account with a non-null password in the Control Console. Note: This feature does not affect users logging in by clicking a hyperlink in the Spam Quarantine Report. 1 Click Account Management > Users > Authentication. 2 From the Authentication Type drop-down menu, select Passwords. 3 Click More Options if you want to use a batch file to set or change passwords for multiple users all at once. Only passwords for users in the domain currently being viewed can be changed. Only passwords for users who have a role less than or equal to your own can be changed. Note: Depending on your role, this area may or may not be accessible. 4 See the online help for more information.

24 Defense with Continuity--Admin Guide / ADMIN USERS--Review User List Page 24 of 41 Review the Current User List The default method for adding users to Defense with Continuity is SMTP Discovery. SMTP Discovery is a method in which Defense with Continuity checks incoming messages for recipients, and if multiple messages are addressed to the same recipient, that recipient is added to the system as an Defense with Continuity user. As a result, there may be user accounts initially added in the Control Console that do not actually exist on your mail server. Administrators are encouraged to delete these invalid User Accounts. To delete invalid users, perform the following steps: 1 Click Account Management > Users. 2 Click Delete. 3 In the Users List, look for users who are not administered on your mail server. 4 Highlight each invalid user and click Add to add the user to the Delete List. Note: You can add multiple users to the Delete List at one time. To do this, hold down the Ctrl button on your keyboard as you click each user. Each selected user stays highlighted and is added to the Delete List when you click Add. 5 Click Save. Note: It is not recommended to use the SMTP Discovery method of adding new users with the Message Continuity service. See the section Turn on Explicit User Creation for the proper method of adding users with Message Continuity.

25 Defense with Continuity--Admin Guide / ADMIN USERS--Disable User Access Page 25 of 41 Disable User Access to the Control Console (Optional) Users can access quarantined by clicking on the links within the Spam Quarantine Reports that they receive. By default, users also can log into the Control Console to create Allow or Deny lists or customize their Defense with Continuity notifications and displays. To prevent Control Console access to users, you must disable this access. To disable user access to the Control Console, perform the following steps: 1 Click Protection > Policies > Spam > Reporting 2 Unselect the field Allow non-admin users to login directly to the Control Console. 3 Click Save.

26 Defense with Continuity--Admin Guide / ADMIN USERS--Explicit User Creation Page 26 of 41 Turn on Explicit User Creation (Optional) The default method for populating users in Defense with Continuity is SMTP Discovery. SMTP Discovery automatically adds a user within Defense with Continuity after Defense with Continuity receives several incoming s for that user. At times, incorrectly addressed to a user that does not exist in your system can cause invalid users to be added to Defense with Continuity. Therefore, it is strongly recommended that you set the User Creation option to Explicit, which you can do at any time. Explicit requires you to add users using one of the methods provided within Account Management, including: Batch file Directory Integration Manual user creation. 1 Click Protection > Setup > User Creation 2 Select Explicit. 3 Under When a recipient is invalid, select an option to handle messages when the recipient is not a valid user. 4 Click Save.

27 Defense with Continuity--Admin Guide / ADMIN USERS--Create Remaining Users Page 27 of 41 Create the Remaining Users You can add users with any of three methods: Use Directory Integration This is the recommended method if your server uses Active Directory. You cannot add passwords with this method. Add Users Manually This is the simplest, but most time-consuming, method. You can also add passwords with this method. Add Users with a Batch File This method requires you to create a text file with user addresses. You cannot add passwords with this method. Add Users Manually 1 Click Account Management > Users > Create 2 In the Creation Modes drop-down list, select Individual. 3 See the online help for how to complete the remaining fields for adding users. Note: Group administration currently applies only to Defense with Continuity and Web Protection.

28 Defense with Continuity--Admin Guide / ADMIN USERS--Create Remaining Users Page 28 of 41 Add Users with a Batch File You can upload a text file with the all addresses. Note: If you are also adding alias addresses, you can include them in the batch file. If you add users with a batch file, but do not add aliases at the same time, and later you want to add aliases with a batch file, you must re-add the users along with the aliases. See Create User Aliases, If Necessary. 1 Open a text editor, for example Notepad, to create your file of addresses. On the first line of the file, type the primary domain address for a user, as well as any other alias recipient names desired, separated by a single space or a comma. Do not enter the domain portion followed by a domain name) of the address to the alias names. See the following example: In the previous figure, the line jsmith@acme.com joesmith josephsmith adds the primary address jsmith@acme.com, and two alias addresses jsmith@acme.com and josephsmith@acme.com. Up to five aliases can be created per user, depending on your company s configuration. 2 Press the Enter key or an equivalent key to create a hard return and start a new line in the file. 3 Create one line of addresses per user. addresses must be unique. Valid and invalid characters are as follows: Valid Characters Alphanumeric characters (A-Z and/or 0-1) Invalid Characters Spaces at the beginning or end of the user account name Spaces within the name Comma (, ) Hyphen ( - ) Plus sign ( + ) Single apostrophe ( ' ) Double quotes ( " ) Ampersand ( & ) Left arrow ( < ) Right arrow ( > ) Semi-colon ( ; ) Hash sign ( # ) 4 Save the file to your computer s hard drive with a filename of your choice. The file size can be up to 100 KB. 5 Click Account Management > Users > Create. 6 From the Creation Mode drop-down list under Create Users, select Batch. The Create Users screen changes to show batch creation fields

29 Defense with Continuity--Admin Guide / ADMIN USERS--Create Remaining Users Page 29 of 41 7 See the online help for how to complete the remaining fields for batch creation. The alias recipient names are automatically added as alias addresses with the primary domain.

30 Defense with Continuity--Admin Guide / ADMIN USERS--Create User Aliases Page 30 of 41 Create User Aliases, If Necessary User aliases might be administered on your server to provide alternative addresses for your users. For example, Joe Smith might have a primary address of joesmith@acme.com and alias addresses of jsmith@acme.com and josephsmith@acme.com. If your users have aliases on your mail server, it is recommended that you add these aliases to the Control Console. By adding aliases, you ensure that: Defense with Continuity can consolidate s received for multiple addresses into a single set of quarantine areas (Virus, Spam, Content, and Attachments). Defense with Continuity sends a single Spam Quarantine Report to the user for all quarantined spam s. The Spam Quarantine Report and any s released from any quarantine are sent to the primary address. Defense with Continuity can filter the s received for the alias addresses with the same policies defined for the primary address. You can add aliases in one of three ways: Add Aliases User-by-User Use the Alias Addresses screen. Add Aliases with a Batch File See Add Users with a Batch File. Use Directory Integration This is the recommended method if your server uses Active Directory. You cannot add passwords with this method. Add Aliases User-by-User 1 Click Account Management > Users > Create. 2 Click a user name from the list. 3 Click Aliases. The screen lists all existing alias addresses. 4 Type an alias prefix into the Alias Address field. The system automatically creates an alias address beginning with the prefix for every alias domain associated with the primary domain. For Message Continuity, Create a Batch File to Add Users and Passwords To use the Message Continuity service, it is recommended you add users to Defense with Continuity with a method other than SMTP Discovery. The default SMTP Discovery method does not add users until they have received several s. As a result, some users might not be added for quite some time, and therefore, those users would not be immediately available in case of disaster recovery. See Create the Remaining Users.

31 Defense with Continuity--Admin Guide / CUSTOMIZE INBOUND--Filters Page 31 of 41 Customize Inbound Mail Filters (Optional) You can customize the default inbound policy for groups of users to fit your business needs. To create and use custom policies, you must create a group or groups of users, and for each group, you can create a custom policy. A group can be created according to domain membership (see Figure 5) or according to any other user characteristics that may apply across multiple domains (see Figure 6). For procedures, see Create a Group (Enterprise Customer Only)). Note: Because a group defined can contain users from different domains, a group policy does not necessarily apply to a domain, but rather to the group of users to which it is defined. A custom group policy supersedes the default policy that is assigned to all domains. Figure 5: Enterprise Custom Policy Assignment (Groups by Domain) Figure 6: Enterprise Custom Policy Assignment (Groups by Other Attributes)

32 Defense with Continuity--Admin Guide / CUSTOMIZE INBOUND--Custom Policy Page 32 of 41 Create a Custom Policy (Optional) 1 Click Protection > Policies. 2 Click New. The New Policy Set fields are displayed: 3 See the online help for more information on completing the fields. 4 Click Save. The Policy Sets list is updated with the new policy. You can now modify the new policy to meet your business needs. See Create a New Content Filter, which is a typical portion of a policy that is customized.

33 Defense with Continuity--Admin Guide / CUSTOMIZE INBOUND--Content Filter Page 33 of 41 Create a New Content Filter (Optional) A policy component that is typically customized is the content filter. The content filter does the following: Blocks or quarantines the that contains prohibited keywords. Notifies the sender or recipient when an has been quarantined or blocked. Blocks HTML malicious tags or prohibited images. Manages the ability for users to click on links in . To create a new policy content filter, perform the following steps: 1 Click Protection > Policies. 2 Click the policy you want to change. 3 Click Content. The Content Groups screen is displayed. 4 Click New. The New Content Group Policy fields are displayed. 5 In the Group Name field, type the name of your content group. 6 In the Keywords field, type words for which you want Defense with Continuity to filter . Note: Each keyword or phrase you want to filter must be followed by a hard return. See the online help for more keyword formatting information. 7 From the Action drop-down menu, select an action to take on the s that are in violation. See the online help for more information. 8 If desired, select a silent copy option. You can choose None or a previously- configured distribution list to which to send a copy of any that violates the content restrictions. Distribution lists for this option are configured from Account Management > Customers > Distribution Lists. 9 Select Enable to turn on filtering for this content group.

34 Defense with Continuity--Admin Guide / CUSTOMIZE INBOUND--Content Filter Page 34 of 41 To customize a policy s content filter, perform the following steps: 1 Click Protection > Policies. 2 Click the policy you want to change. 3 Click Content. The Content Groups screen is displayed. 4 Click on a default content category you want change and click Edit. The Edit fields are displayed. Note: You cannot change keywords in a default content group. 5 From the Action drop-down menu, select an action to take on the s that are in violation. See the online help for more information. 6 If desired, select a silent copy option. You can choose None or a previously- configured distribution list to which to send a copy of any that violates the content restrictions. Distribution lists for this option are configured from Account Management > Customers > Distribution Lists. 7 Select Active to turn on filtering for this content group.

35 Defense with Continuity--Admin Guide / CUSTOMIZE INBOUND--Review Quarantine Page 35 of 41 Review Quarantined Mail Review quarantined of your users to ensure the following: Messages from senders of desired organizations are not quarantined unnecessarily. These sender addresses may be added to the Policy-level Allow List. Senders from undesired organizations are quarantined. These sender addresses can be added to the Policy-level Deny List. As a customer administrator, you can view quarantined mail from all users. Personnel with domain administrator and quarantine manager permission can also review all user quarantine messages. To review quarantined mail, perform the following steps: 1 Click Protection > Quarantine. 2 From the Threat drop-down menu, select All Threats. 3 From the Day drop-down menu, select All Days. 4 From the Direction drop-down menu, select Inbound or Inbound and Outbound if you also use outbound filtering. 5 Click Search. The list of matching messages is displayed. 6 Review the type of threat of each message, as well as the sender, recipient, and subject. 7 To view more detail about a message, hover your cursor over the From column of the message. Different information is displayed depending on the type of violation incurred. For a SPAM violation, you see the SPAM score. For an attachment violation, you see the attachment name that invoked the violation. For a virus violation, you see the Virus name that invoked the violation. For a content violation, you see the Content Keyword that invoked the violation. Note: From this screen, you can also release mail from quarantine so the returns to the users inbox, or you can delete quarantined mail.

36 Defense with Continuity--Admin Guide / GROUPS--Determine Needs Page 36 of 41 Create a Group, If Necessary Determine Who Needs Separate Filtering Groups are used when there are users in the organization whose should be filtered according to a policy other than the default policy. For example, you might have a support group that needs to receive from a wide variety of customers, some of whom might send many advertisements via . In this case, those customers might be blocked periodically by the default policy. In this case, you can create a group for Support, and then create a new policy just for Support. Creating and applying groups is a three step process: 1 Create a new group. 2 Assign individual User Accounts to the group. 3 Create a new policy with special filtering rules and associate the group to the policy. Once completed, the users in the group will have their filtered according to the newly created policy, instead of the filtering rules in the default policy. Note: All users who are not assigned a group continue to receive according to the default policy. Also, users from up to three different domains can be assigned to the same group.

37 Defense with Continuity--Admin Guide / GROUPS Create a Group Page 37 of 41 Create a Group To create a group, perform the following steps: 1 Click Account Management > Groups. 2 Click New. 3 In the Name field, type a unique name for the group. In our example, type Sales. 4 In the Description field, type the purpose of the group and a high-level description of who is in it. For example, type Extensive allow list for customers. Includes all support associates. 5 Click Save. If this is the first group, the Users tab is created so that you can assign users to the group.

38 Defense with Continuity--Admin Guide / GROUPS Add Users Page 38 of 41 Add Users to the Group 1 On the Groups screen, select the group to which you want to add users, then click Users. A list of users for the current domain is displayed. 2 Select the name of a user you want to add to the group. You can also press the Ctrl key on your keyboard and select multiple users to add at one time. 3 Click Add. 4 Repeat steps 2 and 3 for all users you want to add to the group. 5 From the Domain drop-down menu at the top of the screen, select a different domain from which to add users to the group. 6 Repeat steps 2 through 4 for the users you want to add from the selected domain. 7 Repeat steps 5 and 6 for adding users from a third domain, if desired.

39 Defense with Continuity--Admin Guide / GROUPS Custom Policy Page 39 of 41 Create a Custom Policy for the Group See Create a Custom Policy (Optional). Assign the Group to the Custom Policy 1 Click Protection > Policies. 2 Select the custom policy to which you want to assign a group. 3 Click Group Subscriptions. The Policy Configuration Groups screen is displayed. 4 Select the group you want to assign. 5 Click Add

40 Defense with Continuity--Admin Guide / DISASTER RECOVERY Setup Spooling Page 40 of 41 Administer Disaster Recovery Services Message Continuity Message Continuity saves messages for later delivery if your mail server becomes unavailable. When your mail server becomes available, Message Continuity intelligently delivers the messages to your on premise Server. Users can access their messages through a Web- based interface while messages are in Message Continuity only. Message Continuity also has unlimited storage capacity and removes messages that have been in Message Continuity storage for more than 60 days. Set up Spooling for Disaster Recovery 1 Click Protection > Setup > Disaster Recovery. 2 From the Domain drop-down menu, select the domain you want to set up for Disaster Recovery. 3 In the Configuration Settings section, select one of the following options: Automatic This option automatically spools all incoming when Defense with Continuity detects a loss of connectivity with your server(s). With this option, you must also specify how long Defense with Continuity should wait after connectivity is lost to begin spooling. o Note: It may take several minutes to determine that your inbound server is unavailable. During this time, and during the time delay, received s can be temporarily failed if your inbound server is unavailable Manual T h i s option allows you to start and stop Disaster Recovery spooling manually for planned server outages such as server maintenance. When necessary, you then select Start Spooling to initiate manual spooling; and select Stop Spooling to stop it. o Note: It may take a few minutes for manual spooling of incoming mail to start and stop. 4 If you selected the Manual option, check the Deliver spooled when connectivity is available box to deliver spooled when connectivity to the server(s) is restored. 5 With Message Continuity, check the checkbox Allow users to use Message Continuity to set the default permission for users to get messages through Message Continuity. This setting applies to the domain. You can override this setting on the Disaster Recovery screen under Policies if you have some groups that you don t want to allow access.

41 Defense with Continuity--Admin Guide / DISASTER RECOVERY Notifications Page 41 of 41 Set up Notifications of Disaster Recovery You can specify that notifications are ed automatically to designated recipients, typically yourself or other administrators, when the following Disaster Recovery events occur: Automatic spooling has started Automatic unspooling has started Automatic or manual unspooling has completed. 1 Under the Notifications section of the Disaster Recovery Setup screen, type, in the Recipient Address field, the address of a person who should receive notification of a disaster recovery event. Note: In order to minimize the possibility that Disaster Recovery notifications cannot be delivered to listed recipients, it is recommended that notifications be sent to addresses associated with cell phones or pagers. 2 Click Add. 3 Repeat steps 1 and 2 for up to three more notification recipients.