SECURE Gateway FAQ

Transcription

1 SECURE Gateway FAQ Frequently Asked Questions Version /9/13

2 Contents What are the new features of this release?... 3 What does Data Redaction do?... 3 What does Document Sanitization do?... 3 What does Structural Sanitization do?... 3 What are Lexical Expression Qualifiers?... 3 What message/file formats are supported by these features?... 4 How are these features licensed?... 4 Where can I find out more about the Adaptive Redaction features?... 4 What are custom tokens?... 4 How has message tracking been enhanced?... 5 If the tracking system has changed what happens during an upgrade?... 5 I can t see how to view the SMTP diagnostics panel in Tracking?... 5 How long can tracking data be stored for?... 7 What changes have been made in Reporting?... 7 What systems have been tested with the Centralized Syslog feature?... 7 What can I configure in the Centralized Syslog feature?... 7 I ve already installed, but how do I enable FIPS mode?... 7 Following a Pen Test we were informed we were using weak TLS ciphers how can we change these?... 7 What has changed with Lexical Expressions?... 8 Page 2 of 8 2

3 What are the new features of this release? The SEG comprises of a number of new and enhanced features Enhanced Data Loss Prevention features o Data Redaction o Document Sanitization o Structural Sanitization o New and custom tokens o Lexical Qualifiers System Management Enhancements o Message Tracking enhancements o Reporting Enhancements o Transaction Export o Centralized Syslog/SIEM Support FIPS operating mode vsphere 5.1 support Improved Help What does Data Redaction do? Data Redaction is the process of looking for words, phrases or tokens in a piece of textual data and replacing the detected text items with an asterisk character. So if the keywords to redact were fox and dog, we would have the phrase: The quick brown *** jumped over the lazy ***. This process can help to reduce the chance of accidental data leakage. What does Document Sanitization do? Document Sanitization looks at the documents and removes meta data held as document properties, comments or change tracking and allows a client to remove either, some or all of these elements. This process can help to reduce the chance of data leakage. What does Structural Sanitization do? Structural Sanitization is inspecting the documents for potential active code such as macros, scripts and embedded objects and will remove them from the file/message/webpage. This can help protect clients from Advanced Persistent Threats (APT). What are Lexical Expression Qualifiers? Lexical expression qualifiers enable you to scan content for items which match specific entries in a data set. For example, you might want to detect only a particular set of account or credit card numbers which are stored in an external file. Page 3 of 8 3

4 What message/file formats are supported by these features? The following table defines what formats are supported by each feature. Format Structural Sanitization Document Sanitization Data Redaction HTML Yes N/A Yes (Outside of Tags / Scripts) XML N/A N/A Unsupported in 4.0 Microsoft Office Detection only therefore On Unsuccessful Disposal Action Triggered Detection only therefore On Unsuccessful Disposal Action Triggered Detection only therefore On Unsuccessful Disposal Action Triggered Microsoft Office Yes Yes Yes PDF Yes Yes Yes RTF Yes Unsupported in 4.0 Yes RTF Encoded HTML Yes Unsupported in 4.0 Yes How are these features licensed? The feature is charged as a percentage of the user price. There is a discount if a client purchases all three of the Data Redaction + Document Sanitization + Structural Sanitization options. Where can I find out more about the Adaptive Redaction features? There is a separate FAQ for these features and Datasheets available from the Cyber Hub ( What are custom tokens? The Gateway is delivered with a number of predefined tokens to help detect common content types such as credit card and social security numbers. However clients may have specific data types that might be appropriate for their environment such as Part Number or Patient Number. The custom token features allow a customer to build up a list of tokens that they use and be able to incorporate them in keyword searches. Page 4 of 8 4

5 In this example we have defined an Expiry Date using a regular expression of [0-9]{2}/[0-9]{2}\s to find a format of mm/yy to assist our keyword search to find credit card details in some piece of data. How has message tracking been enhanced? Message tracking has been enhanced in a number of areas: 1. The system now uses a database to store the data. Whilst this has an impact on the disk space consumed by the system, it does mean that big searches are faster and it offers more criteria to search on 2. Increased number of search terms, such as Filename, Reject Reason, Time period, Message encryption and Transport level encryption option 3. Simplified presentation of information 4. More detail shown about messages, such as attachment names 5. Ability to show SMTP diagnostics from within tracking If the tracking system has changed what happens during an upgrade? After the upgrade process has taken place, new data will be added to the new database system and any searches will use a hybrid query to search in both stores. In the background the old tracking logs will be imported automatically into the database. The time taken to import all this data depends on system load and amount of log files. I can t see how to view the SMTP diagnostics panel in Tracking? The SMTP service logging levels needs to be raised to value that starts to show transactional level logging. As a minimum the logging level needs to be at least 5 with more detail available as the logging level increases. Page 5 of 8 5

6 Examples of logging level 5 Sep 12 20:09:41 sm-inbound[20657]: r8cj9fkt020657: from=<bertie@btinternet.com>, size=57132, class=0, nrcpts=1, msgid=<b76cf25147ef4a0f8ab2a976c7e70445@clearswift.org>, proto=smtp, daemon=daemon0, relay=patrickm-d220s.clearswift.org [ ] (may be forged) Examples of logging level 9 Sep 12 11:19:06 sm-inbound[13614]: r8caiujp013614: to=<alyn@clearswift-test.com>, delay=00:00:09, mailer=esmtp, pri=146231, stat=queued Sep 12 11:19:08 sm-outbound[14190]: ruleset=try_tls, arg1=[ ], relay=[ ], reject= alyn@clearswift-test.com... do not try TLS with [ ] [ ] Sep 12 11:19:08 sm-outbound[14190]: r8caiujp013614: to=alyn@clearswift-test.com, delay=00:00:01, xdelay=00:00:00, mailer=esmtp, pri=180000, relay=[ ] [ ], dsn=2.0.0, stat=sent (r8caj8dd Message accepted for delivery) Examples of logging level 12 Sep 12 19:53:54 sm-inbound[15165]: NOQUEUE: connect from patrickm-d220s.clearswift.org [ ] (may be forged) Sep 12 19:53:55 sm-inbound[15165]: r8cirs8j015165: from=<bertie@btinternet.com>, size=205814, class=0, nrcpts=1, msgid=<eebe652f50ce4f04a6af03a71c9e7acb@clearswift.org>, proto=smtp, daemon=daemon0, relay=patrickm-d220s.clearswift.org [ ] (may be forged) Sep 12 19:53:56 sm-inbound[15165]: r8cirs8j015165: to=<alyn@clearswift-test.com>, delay=00:00:02, mailer=esmtp, pri=235814, stat=queued Sep 12 19:53:58 sm-outbound[15186]: r8cirs8j015165: SMTP outgoing connect on seg Sep 12 19:53:58 sm-outbound[15186]: ruleset=try_tls, arg1=[ ], relay=[ ], reject= alyn@clearswift-test.com... do not try TLS with [ ] [ ] Sep 12 19:53:58 sm-outbound[15186]: r8cirs8j015165: TLS_Requested=0 Sep 12 19:53:58 sm-outbound[15186]: r8cirs8j015165: to=alyn@clearswift-test.com, delay=00:00:01, xdelay=00:00:00, mailer=esmtp, pri=180000, relay=[ ] [ ], dsn=2.0.0, stat=sent (r8cirwh Message accepted for delivery) Sep 12 19:53:58 sm-outbound[15186]: r8cirs8j015165: done; delay=00:00:01, ntries=1 Examples of logging level 15 Sep 12 19:57:56 sm-inbound[31589]: NOQUEUE: connect from patrickm-d220s.clearswift.org [ ] (may be forged) Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: SMTP ESMTP Relay Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <-- HELO AlynHE6530 Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: seg.clearswift-test.com Hello patrickm-d220s.clearswift.org [ ] (may be forged), pleased to meet you Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <-- MAIL FROM: <Bertie@btinternet.com> Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <Bertie@btinternet.com>... Sender ok Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <-- RCPT TO: <alyn@clearswift-test.com> Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <alyn@clearswift-test.com>... Recipient ok Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: <-- DATA Sep 12 19:57:56 sm-inbound[31589]: r8civuek031589: Enter mail, end with "." on a line by itself Sep 12 19:57:57 sm-inbound[31589]: r8civuek031589: from=<bertie@btinternet.com>, size=167321, class=0, nrcpts=1, msgid=<d1c814cfa2c74fc1aad59a6dfc822175@clearswift.org>, proto=smtp, daemon=daemon0, relay=patrickm-d220s.clearswift.org [ ] (may be forged) Sep 12 19:57:57 sm-inbound[31589]: r8civuek031589: <alyn@clearswift-test.com>... queued Sep 12 19:57:57 sm-inbound[31589]: r8civuek031589: to=<alyn@clearswift-test.com>, delay=00:00:01, mailer=esmtp, pri=197321, stat=queued Sep 12 19:57:57 sm-inbound[31589]: r8civuek031589: r8civuek Message accepted for delivery Sep 12 19:57:57 sm-inbound[31589]: r8civuel031589: <-- QUIT Sep 12 19:57:57 sm-inbound[31589]: r8civuel031589: seg.clearswift-test.com closing connection Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: alyn@clearswift-test.com... Connecting to [ ] port 25 via esmtp... Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: SMTP outgoing connect on seg Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < prodman01.europe.clearswift.com ESMTP Sendmail Ready; Thu, 12 Sep :58: Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: >>> EHLO seg.clearswift-test.com Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < prodman01.europe.clearswift.com Hello [ ], pleased to meet you Page 6 of 8 6

7 Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < ENHANCEDSTATUSCODES Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < PIPELINING Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < BITMIME Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < SIZE Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < DSN Sep 12 19:58:01 sm-outbound[31655]: r8civuek031589: < ETRN How long can tracking data be stored for? The database method will keep data for 1 year online in a db. If you want to keep records of transactions for longer, you can use the Transaction Log export feature which will allow you to export data at regular intervals for long term storage in a date stamped CSV file. What changes have been made in Reporting? The reports have been extended to offer drill downs on the: 1. Threats per day 2. Threats summary 3. Content Rules rate per day And a new Encryption methods reports allows reports to demonstrate: 1. Number of messages by Encryption method (S/MIME, PGP, Password and Portal) 2. Number of messages sent by Transport level encryption (TLS forced, Opportunistic TLS, None) What systems have been tested with the Centralized Syslog feature? There are too many Syslog servers available on the market to test all of them. We ve focused on 3 of the top brands and have successfully tested ArcSight, EnVision and Splunk. What can I configure in the Centralized Syslog feature? We made the feature as flexible as we can; rather than sending everything to your central syslog server, we only send what you want to send. We also enable you to set your log update frequency from 1m to 60m between updates. The port is also configurable in case you re chosen system is running on an alternate port. The original logfiles are retained on the SEGs. This means that if you do have an issue with the product the logs are still easy to access. I ve already installed, but how do I enable FIPS mode? To enable FIPs mode, you have to select the option during the installation wizard. It s not possible to enable FIPS once you have installed the Gateway. It s also not possible to convert a FIPs mode Gateway back to a normal one post install. Following a Pen Test we were informed we were using weak TLS ciphers how can we change these? In this release you can set the cipher strength used by the system in the TLS Certificates and Private Keys panel. Page 7 of 8 7

8 What has changed with Lexical Expressions? To provide greater flexibility a number of changes have been carried out to the Lexical Expression lists and their use in related Content Rules. The following settings are now controlled in the Lexical Expression list itself, not in the Content Rule. Threshold Each Expression may trigger only once for each part of the message The function to Combine the scores from all message parts that the expression list is applied to has been deprecated. Page 8 of 8 8