Open Mic: IBM SmartCloud Notes Mail Hygiene. Robert Newell SmartCloud Notes Support July, 20 th 2016

Size: px

Start display at page:

Download "Open Mic: IBM SmartCloud Notes Mail Hygiene. Robert Newell SmartCloud Notes Support July, 20 th 2016"

Carol Bradley
6 years ago
Views:

1 Open Mic: IBM SmartCloud Notes Mail Hygiene Robert Newell SmartCloud Notes Support July, 20 th 2016

2 SmartCloud Notes Mail Hygiene Agenda What do the IBM Hygiene servers check How to control Spam What to collect How to report a message as SPAM Additional Resources 2016 IBM Corporation 2

3 Definitions Virus - A virus is a piece of code that is capable of copying itself in order to do damage to your computer, including corrupting your system or destroying data Malware Malware is an umbrella term that stands for a variety of malicious software, including Trojans, spyware, worms, adware, ransomware, and yes, viruses. Phishing - Phishing is a technique used to gain personal information for purposes of identity theft, using fraudulent messages that appear to come from legitimate businesses. Spam - Spam is sent to thousands and sometimes millions of people without prior approval, promoting a particular product, service or a scam IBM Corporation 3

4 NRPC versus SMTP What do our IBM Hygiene servers do with NRPC mail? Virus, Malware, Phishing What do our IBM Hygiene servers do with SMTP mail? Virus, Malware, Phishing Spam Can I control how Virus, Malware and Phishing are managed? No, IBM handles the scanning of these messages 2016 IBM Corporation 4

5 Option available for Hybrid environments Currently for SmartCloud Notes Hybrid environments external mail will go to the Onpremise SMTP server first and then be transferred to the Smartcloud service. IBM has recently decided to open an exciting opportunity to allow incoming mail for Smartcloud Hybrid customers to go directly to the service. After the request has been submitted with the required information and approval has been obtained. You will point your MX records to our SmartCloud host address. All incoming mail will now be filtered by the SmartCloud Hygiene servers rather then an Open-premise Virus/Spam appliance IBM Corporation 5

6 SC Admin UI: System Filter How do I control Spam? Spam: System Filter is a system-provided filter that cannot be deleted and is managed by IBM. Options: Display Report as Spam control to end users Send periodic reports to users that list messages recently delivered or moved to the Junk folder IBM Corporation 6

SC Admin UI: Email System Filter You have the following options on any filter: Allow (deliver to inbox) Filter (deliver to

7 SC Admin UI: System Filter You have the following options on any filter: Allow (deliver to inbox) Filter (deliver to Junk) Block (do not deliver) * If you select the block option the message will not be available to review IBM Corporation 7

8 A quick dive into two of our analysis methods Structure Analysis 1 1) Message is containing HTML is received 2 2) An analysis of the HTML code is performed 3) Unique signatures (MD5) are given to the HTML code based upon their binary structure. 3 4 sig://e44b43373e0f6513 (MD5) SPAM 4) The unique signature can then be checked against the Spam filter database and the action taken as defined in the System Filter if it matches previously reported signatures 8

000 2) Each part is evaluated against the Bayes Tokens and given a weighted value. 3) The weighted values are added up.

9 A quick dive into two of our analysis methods Bayes 1 1) Bayes analysis breaks down the content of the message into smaller parts. 2 Bayes Tokens 3 4 Combined score = ) Each part is evaluated against the Bayes Tokens and given a weighted value. 3) The weighted values are added up. 4) If the combined score of the message exceeds a certain threshold the message will be consider Spam and the action taken as defined in the System filter (based on Robinson inverse chi-square) 9

10 SC Admin UI: Attachment Filters What can you do to control Spam. Can I filter by message attachments? Yes, select the Attachment Filter button to chose file type. 10

11 SC Admin UI: Attachment Filters Select the type of attachment for this filter. Then select the action to be taken. You can create filters to allow, filter or block messages based on selected attachment types Example: Attachment Type - Application or Executable Files Action: Block (do not deliver) 2016 IBM Corporation 11

12 SC Admin UI: Address/Domain filters Can I filter mail by internet addresses or domains? Yes, select Address Filter to create a filter based on internet addresses or domains 2016 IBM Corporation 12

13 SC Admin UI: Address/Domain filters Enter a name for the filter Enter the address you want to filter: *@Renovations.com Select the action for the filter: Allow (deliver to inbox) This filter will allow messages from any address to be delivered to the recipients inbox, unless met by another filter condition IBM Corporation 13

14 SC Admin UI: Filters * Messages will always be examined for Viruses, Malware & Phishing first regardless of any filters The order of the filters are from top to bottom Example: Messages from any address@renovations will be delivered. Any message that contains an application or executable will be blocked System filters will block messages determined to be SPAM 2016 IBM Corporation 14 *There is a total limit of 99 filters

15 SC Admin UI: Filters Examples Example#1 Will the message get delivered or blocked? A message comes in from John@Renovations.com The message contain a tryme.exe attachment Based on the filter conditions and the order of the filters the message will be received. This is because the message met the conditions in filter #1 to Allow messages from to be delivered IBM Corporation 15

16 SC Admin UI: Filters Examples Example#2 Will the message get delivered or blocked? A message comes in from Sarah@Renovations.com The message contain an attachment that contains a virus. Messages containing viruses, Malware or Phishing will always be blocked first IBM Corporation 16

17 SC Admin UI: Filters Examples Example#3 Will the message get delivered or blocked? A message comes in from Fred@Renovations.com The message contains an attachment that is an application file. The order of Filter#1 and Filter#2 have been switched 2016 IBM Corporation 17 Even though the message is from a domain that has been allowed, the message met the condition in Filter#1 and will take the defined action

18 Report as Spam button Feature must be enabled for the Organization in the Account Settings -> Filter section of the Admin UI The feature is available in the SmartCloud Notes web client by default To enable the Report as Spam feature for IBM Notes users, the use of a custom Notes mail template is needed. Contact support to get the custom mail template notes853_esm1018.ntf The template contains the custom elements needed to enable the Report as Spam button in the Notes client which can be used as a reference to update your own mail template(s). Customizing the mail template requires a short service contract with an IBM Software Services for Collaboration representative (ISSC), and they will validate the design changes. If approved, they will upload the template to the service. The full process on how to modify the template may be found in the following wiki article: IBM Corporation 18

They evaluate the message and determine if it should be classified as Spam.

19 Report as Spam button What happens when a message is reported as spam? 1. The message is sent to spam.smartcloud@kassel.ibm.com 2. The message is delivered to the Trash Folder 3. Message evaluated by Kassel team The Kassel team receives the messages requesting to be blocked. They evaluate the message and determine if it should be classified as Spam. The evaluation is necessary to avoid messages from getting falsely blocked. If determined to be Spam it will be added to the filter database to block the message product wide via the Spam: System filter IBM Corporation 19

20 Reporting spam without the Report as Spam feature If you do not enable the Report as Spam feature, you can provide these instructions to users for reporting spam manually. Procedure 1) Perform one of the following steps to save the spam message as an.eml file: From the web client, select the spam message, click More > Show MIME Full, select all, copy the entire contents to a text file, and save the file with the extension.eml. From the Notes client, drag the spam message to the desktop. The message is automatically saved as an.eml file. 2) Attach the.eml file to a new message. 3) Mail the new message to one of the following addresses: If you want to receive a confirmation from the service, mail the message to spam.smartcloud.feedback@kassel.ibm.com. If you do not want to receive a confirmation from the service, mail the message to spam.smartcloud@kassel.ibm.com IBM Corporation 20

21 References Enabling the Report as Spam feature for Notes users providing_the_report_as_spam_to_notes_users_t.html Reporting spam without the Report as Spam feature dm_reporting_spam_t.html 2016 IBM Corporation 21

22 Questions Press *1 on your telephone to ask a question. Visit our Support Technical Exchange page or our Facebook page for details on future events. To help shape the future of IBM software, take this quality survey and share your opinion of IBM software used within your organization: ibm.biz/bdxqb2 IBM Collaboration Solutions Support page IBM Collaboration Solutions Support IBM Corporation 22

23 Spam Analysis mitigating the malware threat Phishing Example IP Reputation Heuristics URL analysis Text Fingerprinting Bayesian Classifier Structure Analysis Attachment Fingerprinting Virus Scanning Office Macro Detection Filetype Recognition 2016 IBM Corporation 23

24 SC Admin UI: Keyword Filter 2016 IBM Corporation 24

IBM SmartCloud Notes (SCN) Mail Routing

IBM SmartCloud Notes (SCN) Mail Routing Open Mic Date: 21 st Oct, 2015 IBM Collaboration Solutions Open Mic Team Naresh Luthra L3 Smart Cloud Notes Presenter Ranjit Rai - IBM ICS SWAT Focusing on entire