Service Descriptin Safecm Secure Mail Relay Versin 3.5 2006 Telecm NZ Ltd Cmmercial in Cnfidence
CONTENTS 1 INTRODUCTION... 3 2 SERVICE DEFINITION... 3 2.1 SERVICE OVERVIEW... 3 2.2 SERVICE FEATURES... 6 2.3 SERVICE OPTIONS... 7 2.4 SERVICE IMPLEMENTATION... 7 3 STANDARD FEES AND INVOICING... 9 3.1 STANDARD SAFECOM SECURE MAIL RELAY... 9 3.2 OPTIONAL COMPONENTS... 10 3.3 EXCLUSIONS... 10 2006 Telecm NZ Ltd Page 2 Cmmercial in Cnfidence
1 INTRODUCTION The purpse f this dcument is t prvide a detailed service descriptin fr the Safecm Secure Mail Relay service, whereby the verarching Safecm Service Specificatin dcument applies and this dcument describes infrmatin specific t this service. If yu require further technical infrmatin, please cntact yur accunt manager. 2 SERVICE DEFINITION 2.1 SERVICE OVERVIEW Email is a cre applicatin fr mst rganisatins, and is used fr internal as well as external cmmunicatins. At the same time, email has been targeted by hackers and virus makers as an ideal mechanism fr spreading viruses and malicius cde. Safecm Secure Mail Relay adds a security layer t custmers email slutins, by prviding a way f filtering viruses and malicius emails befre they get t the custmers mail systems. The fllwing diagram utlines the key cmpnents f the service and its bundaries: Custmer s Mail System the custmer prvides their wn Mail Server (e.g. MS Exchange, Ltus Ntes, GrupWise r thers) and email client sftware which reside n the custmer site and cnnect int Safecm Secure Mail Relay service. Safecm Cnnectivity this is cmprised f the Safecm Custmer Cnnectin service which links the Custmer Netwrk int the Gen-i Service Delivery Platfrm t prtect the custmer s netwrk and prvide custmer s mail users, access t Safecm Mail Filter relays. Safecm Mail Filter and Relay Systems - these prvide checking f messages fr plicy vilatins, scanning fr virus infected attachments and lgging messages t prvide reprting infrmatin. 3 rd Party Mail Systems these are the external destinatin servers fr mail utbund frm the custmer s recipients, r surce servers fr external inbund mail. SECURITY BOUNDARY SERVICE BOUNDARY Netwrk Interface Layer Firewall Systems IDS Firewall Systems SECURITY BOUNDARY IDS SERVICE BOUNDARY FIGURE 1: SAFECOM SECURE MAIL RELAY SERVICE OUTBOUND MAIL 2006 Telecm NZ Ltd Page 3 Cmmercial in Cnfidence
CUSTOMERS INTERNAL NETWORK MAIL CLIENTS Custmer Netwrk 4. Message retrieved frm Mail Server Telecm Netwrk 3. Acceptable filtered mail is frwarded t the custmer Mail Server Safecm Cnnectivity Gen-i SERVICE DOMAIN Gen-i Service Delivery Platfrm SAFECOM Mail Filter & Relay Systems BLOCKED 2. Mail sent t Safecm Mail Filter Systems Internet Email Sender 1. Message sent t custmer mail recipient Mail Server Safecm Base Infrastructure MAIL SERVER Security Operatins Centre Custmer Netwrk Trusted zne - security is the respnsibility f the custmer Custmer s Mail System Mail Clients are installed Mail Server (custmer s pst ffice) Safecm Cnnectivity The Safecm Custmer Cnnectin Service includes the cnnectin, firewalls, IDS and the Safecm base infrastructure Firewall plicies permit mail traffic t/ frm the custmers Mail Server t the Mail Filter Systems Mail Filter Systems Plicy enfrcement Cntent filter Lgging Virus screening 3rd Party Mail System External mail systems whse users send mail t the custmer Mail sent frm the client s wrkstatin is received by their external Mail Server Safecm Secure Mail Relay Service - INBOUND FIGURE 2: SAFECOM SECURE MAIL RELAY SERVICE INBOUND MAIL Cmpanies are becming mre aware f the risks assciated with email, such as virus epidemics infecting and disabling mail systems thrughut the wrld, and the time in managing high vlumes f unslicited email. Secure Mail Relay cntrls email t and frm the Internet as well as t and frm a custmer s mail system, allwing rganisatins t use email with a greater level f cntrl and security. Mst custmers have mail systems r pst ffices which prvide a central stre f email messages as well as methds f transferring sent messages t the crrect destinatin. Mail systems are cnfigured t differentiate internal email frm external email. Internal mail will be sent frm ne internal user t anther, and as such remains within the custmer s netwrk. External mail is typically sent acrss the Internet using SMTP Simple Mail Transfer Prtcl. The Secure Mail Relay service prvides filtering and cntrl ver this external mail, implementing plicies t blck threats and prevent them entering the mail systems r reaching end users. The Safecm Mail Relay system prvides a high level f cntrl and virus screening, althugh there can be n guarantees that this service will never allw a virus thrugh. This emphasises the requirement fr custmers t als implement virus screening n their mail servers and desktp systems. The abve diagrams represent the flw f email traffic t and frm custmer s mail systems. The time taken t carry ut tasks such as virus screening and cntent filtering will be dependent upn: Size f email attachment the Secure Mail Relay service extracts the attachment, uncmpresses if it is a cmpressed file, and checks with the virus scanning engine. Size f email message when applying cntent filters, the Secure Mail Relay service scans each message lking fr matches n key wrds. Number f embedded links spam filters can be applied t check fr embedded links t knwn spam sites, validating each link. Number f ther messages being prcessed at the same time the Safecm Secure Mail Relay systems have been designed t handle peaks in usage. 2006 Telecm NZ Ltd Page 4 Cmmercial in Cnfidence
The main security threats addressed by the Safecm Secure Mail Relay service are: Virus infected attachments ne f the mst cmmn methds f spreading viruses is t attach them t an email message. The Safecm Mail Relay service prvides virus screening f all email messages that are transferred thrugh the service. This is prvided by industry leading virus scanning systems as well as specific rules implemented as required by the Specialist Supprt Centre (SSC) t blck new viruses. SSC cnstantly mnitrs email lists and security web sites t get early warning f new virus utbreaks, allwing them t implement specific rules which help t prtect all Safecm custmers. Attacks n custmer s devices and mail servers with this service, the nly cmpnent visible t the Internet is the Safecm Mail Relay system, which has been security hardened and is mnitred 24 hurs x 7 days per week, 365 days per year. Attack frm new threats prir t sftware updates it is difficult fr mst rganisatins t keep up t date with changes in security threats such as a new utbreak. Mdern viruses spread ver the Internet in a matter f hurs; therefre, it is essential t be able t implement cntrls r filters immediately if a threat is recgnised. While there can be n guarantees, Safecm security experts mnitr new security threats and pr-actively intervene where new threats can be blcked prir t vendr sftware patches being released. Unmanaged nn-business related email traffic by implementing rules such as attachment type restrictins (fr example JPG r GIF pictures), custmers can limit the impact f emplyees using email fr nn prductive use, such as sending pictures, music r vides. Fr instance, the plicy can be either: blck emails with specific attachment types r alternatively allw the email thrugh and reprt n vilatins. Attacks and nn-prductivity due t nuisance emails SPAM, virus haxes, chain mail and ther unslicited email can have a dramatic effect n the prductivity f an rganisatin as well as transprting malicius cde. This type f email can chke mailbxes and take time fr users t srt and delete as well as use up valuable resurces fr delivery and strage. Safecm Secure Mail Relay can implement filters t help blck these emails befre they get t the custmer s mail systems. Unmanaged bjectinable cntent and attachments there is a significant negative impact n business frm SPAM (ver 50% f email received ver the Internet) i.e. time wasting jke emails, chain letters, and emails cntaining bjectinable cntent r attachments. Custmer pre-requisites fr use f this service are: Safecm Cnnectivity the Safecm Custmer Cnnectin as detailed in the Safecm Custmer Cnnectin service descriptin is required t be cnfigured prir t implementatin f the Safecm Secure Mail Relay service. Custmer s Mail System this must be capable f using Simple Mail Transfer Prtcl (SMTP) t transfer mail t and frm the Internet. Internet Dmain fr each email dmain a custmer wishes t use fr mail, they must have this dmain registered and hsted with an Internet Service Prvider. If this is nt currently set-up, the Safecm implementatin team can prvide assistance. In the implementatin phase f Safecm, changes will need t be made t the MX (Mail Exchange) recrds assciated with the dmain. T d this, custmers will need t have authrity r access t the pass-cdes t mdify these recrds. 2006 Telecm NZ Ltd Page 5 Cmmercial in Cnfidence
2.2 SERVICE FEATURES The Safecm Secure Mail Relay service prvides a mail relay and filter system using industry standard Simple Mail Relay Transfer Prtcl (SMTP) that includes the fllwing features: Safecm Cnnectivity Safecm Custmer Cnnectin Additins - the Secure Mail Relay service requires the Safecm Custmer Cnnectin Service as a pre-requisite service. One feature f this service is enhanced specifically fr Secure Mail Relay. Reprting the Safecm Reprting System prvides reprting infrmatin specific t email users and usage f the service. Firewall Plicies Cntrl Access firewall plicies permit SMTP t and frm the custmer s Mail Server t the Safecm Mail Filter and Relay System. Secure Mail Filter & Relay System Virus Scanning f Mail Attachments this plicy ensures that all files attached t email messages are scanned fr viruses. If a virus is detected, the attachment is remved and the message is frwarded t the destinatin. If the attachment is required, the sender will need t remve the virus and resend. Attachment Plicies this allws plicies t be implemented t cntrl email attachments. This includes blcking attachments f certain types r abve a certain size. Fr incming mail (frm the Internet) the SMTP Mail Relay will receive email and check it against the plicies defined and frward t mail systems within the custmer s netwrk. Fr utging mail (t the Internet) the SMTP Mail Relay will check the message against the plicies defined, and then frward the mail t the apprpriate destinatin. Plicies are defined during implementatin by the custmer and can be mdified using the apprpriate change cntrl mechanism. Cntent Scanning f Emails - ability t scan email messages bdy text and attached files fr keywrds specified in the custmer s plicy, which trigger actins such as blcking r frwarding t quarantine mail accunts. SPAM Filters - the ability t detect SPAM messages based n predefined criteria. SPAM messages are typically unslicited messages that fld mail systems with advertising and are increasingly used as carriers fr viruses. The SMTP Mail Relay system will scan inbund messages lking fr messages that meet the SPAM plicy, and ntifies end users when a spam plicy vilatin ccurs. It can prvide the capability t end users t autmatically release emails they deem legitimate. Alternately, nminated users can be setup t manage spam n behalf f ther users. If specified by the custmer, the SMTP Mail Relay system will remve what is cnsidered t be certain spam, withut generating ntificatins. This typically reduces the vlume f spam ntificatins by tw thirds. Virus Hax Filters - the ability t detect Virus Hax messages based n predefined criteria. Virus Hax messages are typically messages that warn f a nn-existent threat. Chain Mail Filters - the ability t detect Chain Mail messages based n predefined criteria. Chain Mail messages are typically unslicited messages that are generated by direct marketing rganisatins. Ntificatin Plicies when Mail Relays plicies are vilated, ntificatin plicies are activated. These will ntify administratrs and the sender and receiver abut these vilatins, depending n the type f plicy in use fr the custmer. Any emails that are rejected due t plicy vilatin r virus attachments will trigger ntificatin messages t be sent. The cnfiguratin f ntificatins is part f the service implementatin. Event Lgging - all plicy and system events will be lgged t the event lg. 2006 Telecm NZ Ltd Page 6 Cmmercial in Cnfidence
Exclusins This service des nt prvide: Nn-SMTP based Mail Relay - services using prtcls ther than SMTP are nt supprted. Virus Scanning f Encrypted Attachments attachments that are encrypted using systems such as PGP and WinZip (passwrd prtected) cannt be pened r inspected fr virus cntent. These files will typically be quarantined in Safecm and can be released n request. 2.3 SERVICE OPTIONS The fllwing ptins exist fr the Safecm Secure Mail Relay service. Mnthly Reprting Safecm has the ability t prvide additinal reprts n a per mnthly basis. Reprts available can be btained via the custmer s accunt manager. 2.4 SERVICE IMPLEMENTATION This sectin f the service descriptin prvides infrmatin n the prvisining prcess fr the Safecm Secure Mail Relay service, and the steps invlved. The verarching Safecm Service Specificatin shuld be reviewed as this table is specific t the Safecm Secure Mail Relay service. The fllwing is an utline f a typical implementatin f this service: Implementatin Team Respnsibilities Custmer Respnsibilities Pre-requisite/s Cnfigure the Safecm Custmer Cnnectin if nt already cnfigured fr ther services. As per the Safecm Custmer Cnnectin service descriptin. Pre-Sales Scpe pre-implementatin wrk and estimate csts. Cmplete Design Prpsal (if applicable). Prvide accurate infrmatin fr business and technical requirements, including identifying email dmains, mail server/s and plicies required. Cntract, Technical Specificatin & Statement f Wrk Design and Integratin Engineer cmpletes the Safecm Secure Mail Relay service sectin f the Technical Specificatin. Prepare Safecm Cntract Variatin (if applicable). Prepare Statement f Wrk. Signff Safecm Cntract Variatin (if applicable) Develp a test plan t set the criteria fr successful implementatin f all functinality. Agree and signff Statement f Wrk. Cnfigure Firewalls, Mail Filters and Relays The Safecm Implementatin Engineer will cnfigure the custmer instance f the Secure Mail Relay service based n the custmer s requirements i.e. cnfigure firewalls, ruting, email dmains, plicies, cntent scanning, filters etc, and prvide the custmer with the Mail Relay address and access t reprts. Ensure skilled technical expertise is available t assist the Safecm Implementatin Engineer during the integratin phases. 2006 Telecm NZ Ltd Page 7 Cmmercial in Cnfidence
Cut ver Outbund Mail and Test The Safecm Implementatin Engineer will wrk with the custmer t cut ver utbund mail. Typically this is crdinated s that when the change is made t the custmer s mail server, the Implementatin Engineer is mnitring the messages ut, and can immediately identify prblems if they ccur. The custmer s technical persn will wrk with the Safecm Implementatin Engineer t test the service utbund frm the custmer s site. Cut ver Inbund Mail and Test This requires changes t the dmain recrds held by the Internet Service Prvider (ISP) where the dmain is hsted. If this ISP is XTRA, the Safecm Implementatin Engineer will crdinate this change. The Safecm Implementatin Engineer will assist with testing DNS changes are successful and that mail cmmunicatins frm an external mail client t a custmer recipient is successful. If the ISP is nt XTRA, the custmer s technical persn will crdinate the dmain recrd changes when given the g ahead frm the Safecm implementatin engineer. The custmer s technical persn will wrk with the Safecm Implementatin Engineer t test the service inbund frm the custmer s site. This includes: Prviding skills t diagnse integratin issues that arise within the custmer s envirnment. Testing all services accrding t the test plan. Integratin Cmpletin Wrk with custmer t ensure all requirements in the Statement f Wrk are met. Sign ff Safecm slutin t acknwledge delivery f functinality as agreed. Handver t SOC (Security Operatins Centre) Ensure custmer is aware that the services are in prductin and are aware f SOC s prblem management and change cntrl prcesses. Ensure supprt prcesses are cmmunicated t all relevant internal parties. Each f the abve stages includes discussins between the Safecm Implementatin Engineer and the custmer technical cntact, as well as testing and sign-ff prcesses. MAIL RELAY CONFIGURATION Cnfiguratin Requirements The custmer s mail system will need t be mdified t send mail destined fr external mail systems t the Safecm Mail Relay servers. MAIL RELAY POLICIES During the sales prcess, the custmer will chse which plicies they require t be implemented as well as assciated ptins, such as wh t ntify fr plicy vilatins. This infrmatin is cllated int a Technical Specificatin (Tech Spec) dcument. The fllwing plicy ptins frm the basis f the cnfiguratin f the Mail Relay system: Inbund Ntificatin wh t send an email ntificatin t if the Safecm Mail system receives an email destined fr the custmer mail systems which vilates the plicies. Typically this is autmatically sent t the receiver and an administratr. Outbund Ntificatin wh t send an email ntificatin t if the Safecm Mail system receives an email frm the custmer s mail systems which vilates the plicies. Typically ntificatins such as this are nly sent t the sender and an administratr, nt t the recipient. 2006 Telecm NZ Ltd Page 8 Cmmercial in Cnfidence
Inbund Plicies these plicies cntrl email messages frm external systems acrss the Internet destined fr Safecm custmers: Virus checking plicy by default scan all attachments. Attachments filter by type stps VBS, EXE, BAT, COM and CMD attachments. SPAM filter this is based n a glbal plicy t blck mst cmmn SPAM messages. Chain Mail filter - this is based n a glbal plicy t blck mst cmmn chain mail messages. Virus Hax filter - this is based n a glbal plicy t blck mst cmmn virus hax messages. Outbund Plicies these are the plicies cntrlling email sent frm Safecm custmers ut t external email systems acrss the Internet: Virus checking plicy by default scan all attachments. Attachments filter by type stps VBS, EXE, BAT, COM and CMD attachments. 3 STANDARD FEES AND INVOICING The actual csts fr this service are detailed in the Safecm Price Schedule. In additin t the Safecm Service Specificatin fee infrmatin, the fllwing infrmatin pertains t the Safecm Secure Mail Relay service specifically. 3.1 STANDARD SAFECOM SECURE MAIL RELAY ONE-OFF INSTALLATION FEES Installatin fees are charged per email dmain in arrears and cver items such as: Creatin f access cntrls frm Safecm t the custmer s mail system. Cnfiguratin f mail dmains, filters and plicies. Migratin and tests f custmer s mail utbund and inbund frm mail clients t the custmer s mail system in crdinatin with the custmer s technical resurce. Liaisn with the custmer fr service establishment, training and rll-ut. FIXED MONTHLY FEES Nt applicable t this service. VARIABLE MONTHLY FEES Usage fees are inviced in arrears and cver items such as: Per Mail Accunt Charge this is an nging mnthly price per individual mail accunt using this service. This is measured by the number f mail accunts detected sending mail utbund t external mail systems frm the custmer s mail system. As this amunt is based n accunts sending email, custmers are nt charged fr aliases unless users are sending frm each different alias. This charge includes: Autmatic Virus screening f attachments. Attachment filter plicies quarantining based n extensin (*.EXE *.VBS *.COM *.SCR). Inbund SPAM filter plicies. Inbund Virus Hax filter plicies. Inbund Chain-mail filter plicies. Specific Cntent plicies. Autmatic ntificatin f plicy vilatin t nminated custmer email accunt. 2006 Telecm NZ Ltd Page 9 Cmmercial in Cnfidence
Usage fees billed per MB fr Secure Mail Relay traffic csts this is the cumulative amunt f mail traffic that is generated by a custmer s mail system sending and receiving email. This is charged per megabyte f data and is measured in and ut f Safecm. Installatins, mves, adds and changes are inviced in arrears. Fr mre infrmatin n these see the verarching Safecm Services Specificatin. 3.2 OPTIONAL COMPONENTS Mnthly Reprting Safecm has the ability t prvide additinal reprts n a per mnthly basis. Reprt pricing can be btained via the custmer s accunt manager 3.3 EXCLUSIONS Other Safecm services such as the Secure Custmer Cnnectin are detailed in separate Service Descriptins and pricing f each service can be btained frm the Safecm Price Schedule. Csts f separate services are nt included in the pricing f the Safecm Secure Mail Relay service. 2006 Telecm NZ Ltd Page 10 Cmmercial in Cnfidence