Trend Micro Incorporated reserves the right to make changes to this document and to the product described herein without notice. Before installing and using the product, please review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: http://docs.trendmicro.com/en-us/enterprise/interscan-messaging-security.aspx Trend Micro, the Trend Micro t-ball logo, Control Manager, eManager, InterScan, and TrendLabs are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright © 2012. Trend Micro Incorporated. All rights reserved. Document Part No.: MSEM85803/121129 Release Date: December 2012 Protected by U.S. Patent No.: Patents pending This documentation introduces the main features of the product and/or provides installation instructions for a production environment. Read through the documentation before installing or using the product. Detailed information about how to use specific features within the product may be available in the Trend Micro Online Help and/or the Trend Micro Knowledge Base at the Trend Micro website. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Table of Contents Preface Preface ................................................................................................................. xi What’s New ....................................................................................................... xii Audience ......................................................................................................... xviii InterScan Messaging Security Virtual Appliance Documentation ........ xviii Document Conventions ................................................................................. xix Part I: Getting Started Chapter 1: Introducing InterScan Messaging Security Virtual Appliance About InterScan Messaging Security Virtual Appliance ........................... 1-2 IMSVA Main Features and Benefits ............................................................ 1-2 About Cloud Pre-Filter ................................................................................ 1-10 About Email Encryption ............................................................................. 1-10 About Spyware/Grayware .......................................................................... 1-11 About Trend Micro Control Manager ...................................................... 1-13 Trend Micro Smart Protection Network .................................................. 1-16 Chapter 2: Getting Started Opening the IMSVA Management Console .............................................. 2-2 Viewing the Management Console Using Secure Socket Layer .............. 2-3 Creating an SSL Certificate ........................................................................... 2-4 Setting Up a Child Device ............................................................................. 2-5 Using Smart Search ........................................................................................ 2-7 Changing the Management Console Password .......................................... 2-7 i Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide Configuring Proxy Settings ........................................................................... 2-8 IMSVA Services ............................................................................................ 2-10 Chapter 3: Configuring User Accounts Administrator Account Management .......................................................... 3-2 Adding Administrator Accounts .................................................................. 3-2 Editing or Deleting Administrator Accounts ............................................. 3-5 Chapter 4: Using the Configuration Wizard Configuring IMSVA with the Configuration Wizard ............................... 4-2 Chapter 5: Updating Components Updating Scan Engine and Pattern Files .................................................... 5-2 Specifying an Update Source ........................................................................ 5-3 Performing a Manual Update ....................................................................... 5-4 Rolling Back a Component Update ............................................................. 5-5 Configuring Scheduled Update ..................................................................... 5-5 Updating the System and Application Files ................................................ 5-7 Chapter 6: Getting Started with Cloud Pre-Filter Understanding Cloud Pre-Filter ................................................................... 6-2 Creating a Cloud Pre-Filter Account ........................................................... 6-5 Chapter 7: Advanced Threat Scan Engine and Deep Discovery Advisor Scan Technology ............................................................................................. 7-2 About Advanced Threat Scan Engine ......................................................... 7-3 About Deep Discovery Advisor ................................................................... 7-4 ii Table of Contents Chapter 8: Getting Started with Email Encryption Understanding Email Encryption ................................................................ 8-2 Using Email Encryption ................................................................................ 8-3 Registering for Email Encryption ................................................................ 8-3 Managing Domains ........................................................................................ 8-4 Registering Domains ...................................................................................... 8-5 Part II: Configuring IMSVA and Cloud Pre-filter Chapter 9: Configuring Cloud Pre-Filter Understanding Cloud Pre-Filter Policies .................................................... 9-2 Creating a Cloud Pre-Filter Policy ............................................................... 9-4 Verifying Cloud Pre-Filter Works .............................................................. 9-14 Configuring DNS MX Records .................................................................. 9-14 Suggested IMSVA Settings When Using Cloud Pre-Filter .................... 9-18 Disabling Cloud Pre-Filter .......................................................................... 9-20 Chapter 10: Configuring IP Filtering Settings IP Filtering Service ....................................................................................... 10-2 Using Email Reputation .............................................................................. 10-2 Configuring IP Filtering .............................................................................. 10-8 Displaying Suspicious IP Addresses and Domains ............................... 10-23 Chapter 11: Scanning SMTP Messages Scanning SMTP MessagesSMTP messagesscanscanSMTP messages .. 11-2 Configuring SMTP Routing ........................................................................ 11-2 About Domain-based Delivery .................................................................. 11-9 iii Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide Chapter 12: Configuring Transport Layer Security Settings About Transport Layer Security ................................................................. 12-2 Prerequisites for Using TLS with IMSVA ................................................ 12-3 TLS Settings for Messages Entering IMSVA ........................................... 12-4 TLS Settings for Messages Exiting IMSVA ............................................. 12-7 Deploying IMSVA in TLS Environments ................................................ 12-8 Creating and Deploying Certificates in IMSVA .................................... 12-14 Chapter 13: Configuring POP3 Settings Scanning POP3 Messages ........................................................................... 13-2 Enabling POP3 Scanning ............................................................................ 13-3 Configuring POP3 Settings ......................................................................... 13-4 Configuring POP3 Scan Service ................................................................. 13-6 Part III: IMSVA Policies Chapter 14: Managing Policies Policies ........................................................................................................... 14-2 How the Policy Manager Works ................................................................ 14-2 Chapter 15: Common Policy Objects Configuring Common Policy Objects ....................................................... 15-2 Understanding Address Groups ................................................................ 15-2 Using the Keyword & Expression List ................................................... 15-13 Using Compliance Templates ................................................................... 15-24 Using the Notifications List ...................................................................... 15-36 Using Stamps .............................................................................................. 15-40 Using the DKIM Approved List ............................................................. 15-44 iv Table of Contents Using the Web Reputation Approved List ............................................. 15-45 Chapter 16: Internal Addresses Configuring Internal Addresses ................................................................. 16-2 Adding an Address Group .......................................................................... 16-5 Searching for Users or Groups .................................................................. 16-6 Searching for an LDAP User or Group .................................................... 16-7 Chapter 17: Configuring Policies Adding Policies ............................................................................................. 17-2 Specifying a Route ........................................................................................ 17-2 Specifying Scanning Conditions ................................................................. 17-9 Specifying Actions ...................................................................................... 17-29 Finalizing a Policy ....................................................................................... 17-38 Chapter 18: Encryption Settings Configuring Encryption Settings ................................................................ 18-2 Encrypting Message Traffic ........................................................................ 18-3 Configuring Encryption Policies ................................................................ 18-3 Chapter 19: Scanning Exceptions Setting Scan Exceptions .............................................................................. 19-2 Configuring Exceptions for Security Settings Violations ....................... 19-3 Setting Scan Actions for Security Setting Violations .............................. 19-4 Setting Scan Actions for Malformed Messages ........................................ 19-5 Configuring Exceptions for Encrypted Messages ................................... 19-7 Setting Scan Actions for Encrypted Messages ......................................... 19-7 v Trend Micro InterScan™ Messaging Security Virtual Appliance Administrator’s Guide Chapter 20: Existing Policies Modifying Existing Policies ........................................................................ 20-2 Policy Example 1 .......................................................................................... 20-4 Policy Example 2 .......................................................................................... 20-8 Using the Asterisk Wildcard ..................................................................... 20-13 Part IV: Monitoring the Network Chapter 21: Monitoring the Network Monitoring Your Network .......................................................................... 21-2 Viewing System Status ................................................................................. 21-2 Chapter 22: Working with the Dashboard and Widgets Using the Dashboard ................................................................................... 22-2 Understanding Tabs ..................................................................................... 22-2 Understanding Widgets ............................................................................... 22-6 Chapter 23: Reports Generating Reports ...................................................................................... 23-2 Managing One-time Reports ...................................................................... 23-5 Using Scheduled Reports ............................................................................ 23-8 Chapter 24: Logs About Logs .................................................................................................... 24-2 Configuring Log Settings ............................................................................. 24-2 Querying Logs ............................................................................................... 24-4 Chapter 25: Mail Areas and Queues About Mail Areas and Queues ................................................................... 25-2 vi