INTRODUCTION PRE-CONFIGURATION

Transcription

1 INTRODUCTION This article has been written to assist Office 365 (O365) tenant administrators implement and apply configurations for Identillect Technologies implementation of our Secure Send product offering. Secure Send provides the functionality needed to trigger a behind-the-scenes secure message delivery based on pre-defined keywords and patterns that warrant such action. Almost all of these configuration steps can be performed manually using the Exchange Admin Center in Office 365 user interface (UI). The pre-requisite step of disabling the Transport Neutral Encapsulation Format (TNEF) must be done using a PowerShell script. Note: This task is made up of a series of complex actions and should be handled by administrative personnel familiar with PowerShell and the O365 environment at an administrative level. Note: This article assumes that the O365 tenant these steps will be performed in has been implemented and is already being used at a production level. Note: The Pre-Configuration section of this article is mandatory. Please perform this action before moving forward. PRE-CONFIGURATION To successfully implement Identillect Technologies Secure Scan offering for the O365 environment, you must first disable Transport Neutral Encapsulation Format (TNEF). You can find more information on TNEF here. O365 tenant implementations do vary, as such, TNEF may already be disabled within your environment. If that is the case, you may skip this section. If TNEF is enabled, within your O365 tenant, please run the following commands omitting non-executed lines (#) or create a PowerShell script from all lines: # Disabling TNEF #Command to connect to Exchange Online $UserCredential = Get-Credential #Connect-msolservice -credential $UserCredential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session Write-Output "Imported Exchange Online PowerShell Session" # Disable TNEF

2 Set-RemoteDomain Default -TNEFEnabled $false Write-Output "Disabled TNEF" #Command to disconnect the remote session Remove-PSSession $Session Write-Output "Removed PS Session" Note: To re-enable TNEF at any time, simply set the Set-RemoteDomain Default -TNEFEnabled variable to $true CONFIGURATION Note: The configuration for Identillect Technologies Secure Scan for O365 offering is configured within the Exchange Online Admin Center. You must be an administrator for your O365 tenant to complete the following steps. Note: This article assumes you ve already signed into the Exchange Online Admin Center. Note: Screens may vary. Click Admin.

3 Expand Admin centers and click Exchange. Creating the Connector Identillect Technologies Secure Scan leverages our SMTP network to deliver secure messages. The following actions will guide you through establishing that connector. Click connectors under the mail flow category. Click the + icon to begin building the new connector.

4 Match the values with the provided screen and click Next. Match the values with the provided screen and click Next.

5 Choose the radio button for Only when I have a transport rule set up that redirects messages to this connector and click Next. Choose the radio button for Route through these smart hosts, click the + icon, and add securescan.identillect.com as the name for the new smart host and click Next. Choose the radio button for Any digital certificate, including self-signed certificates and click Next. Click Next to confirm the connector settings. Validating the Connector Validating the connector is a requirement to save the connection state.

6 Click the + icon to provide the test (s) of your choice and click Validate. Click Close and then click Save. Click Validate to begin the validation process.

7 Click Finish to close the general results screen. Note: If you d like to get more information for each validation task that is run, simply double-click the item. Click Close when you re done. This completes the process for creating and validating the connector.

8 Creating Mail Flow Rules Identillect Technologies Secure Scan for O365 offering utilizes keywords and patterns to determine what should be delivered as a secure message. The following actions will help you build the dictionary that will trigger the Secure Scan process and redirect messages to our SMTP network. Note: These actions assume that you are back in the Exchange Admin Center with access to all administrator categories. Click rules in the mail flow category. Click the + icon and click Create a new rule You ll now be presented with the new rule dialog. The following section(s) will walk you through fleshing out your Secure Scan dictionary.

9 Creating Mail Flow Rules Subject or Body Words The following steps will walk you through developing your dictionary for any trigger words/phrases contained within the subject or body of the message. Click More options to be presented with the full option set for the new rule dialog. Enter Secure Scan Keywords for Subject and Body in the Name: field. In the Apply this rule if drop-down field, choose the following nested options: The sender... > is external/internal. The value should be set to Inside the organization. Click the add condition button. Choose the following nested options: The subject or body > subject or body includes any of these words. This will launch the specify words or phrases dialog. The specify words or phrases dialog is where you will supply the words or phrases you want to trigger the Secure Scan process and redirect messages to our secure back-end. Entering words or phrases is as simple as typing in the word or phrase and clicking the + icon to add it to the dictionary. Words/Phrases we recommend are as follows: Social Security Number Credit Card Number SSN DOB Password Once you ve completed building out this list, click OK and move on.

10 In the *Do the following drop-down field, choose the following nested options: Redirect the message to > the following connector. In the select connector dialog, choose the Secure Scan SMTP connector you created earlier and click OK. To help prevent calendaring message items like meeting/appointment invites from getting captured by Secure Scan, add the following exception: Click add exception and choose the following nested options: The message properties > include the message type Select Calendaring from the drop-down options and click OK. Your mail flow rule should look similar to this: Click Save. Important Note: For organizations with existing mail flow rules, the rules created for Secure Scan should have a lower priority than the existing rules.

11 Creating Mail Flow Rules Attachment Words or Phrases The following steps will walk you through developing your dictionary for any trigger words/phrases contained within any attachments added to the message. Click the + icon and click Create a new rule Click More options to be presented with the full option set for the new rule dialog. Enter Secure Scan Keywords for Attachments in the Name: field. In the Apply this rule if drop-down field, choose the following nested options: The sender... > is external/internal. The value should be set to Inside the organization. Click the add condition button. Choose the following nested options: Any attachment > content includes any of these words. This will launch the specify words or phrases dialog. Recommendations for this list are the same as those provided in the previous mail flow section for Subject and Body Words or Phrases. Feel free to build out the list in greater detail. Click OK when you ve completed this action. In the *Do the following drop-down field, choose the following nested options: Redirect the message to > the following connector. In the select connector dialog, choose the Secure Scan SMTP connector you created earlier and click OK. To help prevent calendaring message items like meeting/appointment invites from getting captured by Secure Scan, add the following exception: Click add exception and choose the following nested options: The message properties > include the message type Select Calendaring from the drop-down options and click OK.

12 Your mail flow rule should look similar to this: Click Save. Creating Mail Flow Rules Text Patterns in the Subject or Body The following steps will walk you through developing your dictionary for any trigger text patterns contained within the subject or body of an message. We strongly recommend creating a separate mail flow rule for each pattern type you will be scanning for (i.e. xxx-xx-xxxx).

13 Click the + icon and click Create a new rule Click More options to be presented with the full option set for the new rule dialog. Enter US Social Security Number in the Name: field. In the Apply this rule if drop-down field, choose the following nested options: The sender... > is external/internal. The value should be set to Inside the organization. Click the add condition button. Choose the following nested options: The subject or body > subject or body matches these text patterns. This will launch the specify words or phrases dialog. As done in previous sections, you ll use the specify words or phrases dialog to populate your dictionary. Here you ll be using complex expressions to locate and take action on common patterns that may need to be delivered securely, such as social security numbers or phone numbers. For social security numbers, you may want to use the following regular expressions: SSN plain (no spaces or hyphens): \b(?!( ))\d{3}(?!00)\d{2}(?!0000)\d{4}\b SSN with hyphens: \b(?!( ))\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b SSN with spaces: \b(?!( ))\d{3}[ ](?!00)\d{2}[ ](?!0000)\d{4}\b Once you ve completed building out this list, click OK and move on.

14 In the *Do the following drop-down field, choose the following nested options: Redirect the message to > the following connector. In the select connector dialog, choose the Secure Scan SMTP connector you created earlier and click OK. To help prevent calendaring message items like meeting/appointment invites from getting captured by Secure Scan, add the following exception: Click add exception and choose the following nested options: The message properties > include the message type Select Calendaring from the drop-down options and click OK. Your mail flow rule should look similar to this: Click Save.

15 To create regular expressions for patterns consistent with credit card number providers, follow the same steps used to create a rule for social security numbers but use the following patterns for credit card numbers: Amex plain (no spaces or hyphens): \b3[47][0-9]{13}\b Amex with hyphens: \b3[47][0-9]{2}-[0-9]{6}-[0-9]{5}\b Amex with spaces: \b3[47][0-9]{2}[ ][0-9]{6}[ ][0-9]{5}\b Visa plain (no spaces or hyphens): \b4[0-9]{12}(?:[0-9]{3})?\b Visa with hyphens: \b4[0-9]{3}-[0-9]{4}-[0-9]{4}-[0-9](?:[0-9]{3})?\b Visa with spaces: \b4[0-9]{3}[ ][0-9]{4}[ ][0-9]{4}[ ][0-9](?:[0-9]{3})?\b MasterCard plain (no spaces or hyphens): \b5[1-5][0-9]{14}\b \b2[2-7][0-9]{14}\b MasterCard with hyphens: \b5[1-5][0-9]{2}-[0-9]{4}-[0-9]{4}-[0-9]{4}\b \b2[2-7][0-9]{2}-[0-9]{4}-[0-9]{4}-[0-9]{4}\b MasterCard with spaces: \b5[1-5][0-9]{2}[ ][0-9]{4}[ ][0-9]{4}[ ][0-9]{4}\b \b2[2-7][0-9]{2}[ ][0-9]{4}[ ][0-9]{4}[ ][0-9]{4}\b IMPORTANT NOTE: It is crucial that you test these pattern matching rules to make sure that they are selecting the text patterns that you want. Failure to do so may result in messages being delivered without Identillect Technologies secure framework. Creating Mail Flow Rules Text Patterns in Attachments

16 The following steps will walk you through developing your dictionary for any trigger text patterns contained within attachments added to an message. We strongly recommend creating a separate mail flow rule for each pattern type you will be scanning for (i.e. xxx-xx-xxxx). Click the + icon and click Create a new rule Click More options to be presented with the full option set for the new rule dialog. Enter Secure Scan Keywords for Attachments in the Name: field. In the Apply this rule if drop-down field, choose the following nested options: The sender... > is external/internal. The value should be set to Inside the organization. Click the add condition button. Choose the following nested options: Any attachment > content includes any of these words. This will launch the specify words or phrases dialog. To help prevent calendaring message items like meeting/appointment invites from getting captured by Secure Scan, add the following exception: Click add exception and choose the following nested options: The message properties > include the message type Select Calendaring from the drop-down options and click OK. The same regular expressions apply for attachments as they do for subject and body. Simply replicate the actions you took in the previous sections to create the dictionary for scanning attachments for trigger patterns with Identillect Technologies Secure Scan offering.

17 Disabling Mail Flow Rules If you find the need to turn off the Secure Scan functionality outlined in this article, the process couldn t be simpler. Click Admin. Expand Admin centers and click Exchange. Click rules under the mail flow section.

18 Uncheck any rules that apply to the Secure Scan functionality. Secure Scan will no longer function. This concludes the workflow for adding Identillect Technologies Secure Scan for O365 to an O365 Tenant.