WEBVTT

1
00:00.000 --> 00:00.870 align:middle line:84%


2
00:00.870 --> 00:02.490 align:middle line:90%
One of the things
that I absolutely

3
00:02.490 --> 00:04.470 align:middle line:90%
love about the email
security appliance

4
00:04.470 --> 00:08.310 align:middle line:90%
is its integration with TALOS
in the cloud, with its security

5
00:08.310 --> 00:11.340 align:middle line:90%
services and intelligence,
including the IP and Domain

6
00:11.340 --> 00:12.690 align:middle line:84%
Reputation Center.

7
00:12.690 --> 00:13.445 align:middle line:84%
Let me show you.

8
00:13.445 --> 00:15.070 align:middle line:90%
So I just did a Google
search, and went

9
00:15.070 --> 00:16.570 align:middle line:90%
to
TALOSIntelligence.com/repuation

10
00:16.570 --> 00:21.960 align:middle line:90%
center, and this is the brains
behind letting our email

11
00:21.960 --> 00:25.110 align:middle line:90%
security plans know that,
hey, that email that just came

12
00:25.110 --> 00:27.810 align:middle line:90%
in from this MTA,
this email server,

13
00:27.810 --> 00:30.300 align:middle line:90%
here's the reputation for it
based on everything we know.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.810 --> 00:30.300 align:middle line:90%
here's the reputation for it
based on everything we know.

14
00:30.300 --> 00:32.280 align:middle line:90%
And then the email security
appliance can say, yep,

15
00:32.280 --> 00:33.600 align:middle line:90%
I'm going to go ahead
and drop that email.

16
00:33.600 --> 00:35.280 align:middle line:90%
I'm not going to
receive it, because it

17
00:35.280 --> 00:38.475 align:middle line:90%
has a bad reputation, i.e. the
sender has a bad reputation.

18
00:38.475 --> 00:41.100 align:middle line:90%
And that's likely going to kill
most of the traffic that should

19
00:41.100 --> 00:43.050 align:middle line:84%
be dropped right at that spot.

20
00:43.050 --> 00:45.060 align:middle line:90%
However, if we need
to do a manual block

21
00:45.060 --> 00:47.790 align:middle line:90%
or add somebody to
the deny lists we

22
00:47.790 --> 00:50.700 align:middle line:90%
don't allow inbound
emails from that MTA,

23
00:50.700 --> 00:51.658 align:middle line:84%
we can do that as well.

24
00:51.658 --> 00:52.951 align:middle line:84%
Let me show you how to do that.

25
00:52.951 --> 00:55.080 align:middle line:90%
Here in the email security
appliance interface,

26
00:55.080 --> 00:57.610 align:middle line:90%
we go to Mail
Policies right here,

27
00:57.610 --> 01:00.070 align:middle line:90%
and then if we go
down to HAT Overview,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:57.610 --> 01:00.070 align:middle line:90%
and then if we go
down to HAT Overview,

28
01:00.070 --> 01:02.400 align:middle line:90%
we have these predefined
sender groups.

29
01:02.400 --> 01:04.050 align:middle line:90%
And the way these
are identified is

30
01:04.050 --> 01:07.020 align:middle line:90%
based on their sender-based
reputation score.

31
01:07.020 --> 01:08.798 align:middle line:84%
That's the SBRS.

32
01:08.798 --> 01:11.340 align:middle line:90%
So based on the information that
our email security appliance

33
01:11.340 --> 01:15.595 align:middle line:90%
gets from TALOS, if it comes
in at a negative 6 here,

34
01:15.595 --> 01:17.220 align:middle line:90%
that's automatically
going to be placed

35
01:17.220 --> 01:20.250 align:middle line:90%
on this list, which by the
way, is going to be dropped.

36
01:20.250 --> 01:23.380 align:middle line:90%
Or if TALOS indicates it's
a value of, let's say,

37
01:23.380 --> 01:26.110 align:middle line:90%
negative 1, right here,
it would go on this list.

38
01:26.110 --> 01:29.407 align:middle line:90%
And so this HAT, the
host access list, most

39
01:29.407 --> 01:31.740 align:middle line:90%
of the email servers that
we're going to be dealing with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.407 --> 01:31.740 align:middle line:90%
of the email servers that
we're going to be dealing with

40
01:31.740 --> 01:34.440 align:middle line:90%
are going to have reputation
scores that are dynamic

41
01:34.440 --> 01:36.830 align:middle line:84%
that we've learned via TALOS.

42
01:36.830 --> 01:38.580 align:middle line:90%
And that removes the
need for us to create

43
01:38.580 --> 01:41.700 align:middle line:90%
a long list of servers that
are trusted or not trusted.

44
01:41.700 --> 01:43.800 align:middle line:90%
We can base on the
reputation, and then

45
01:43.800 --> 01:46.410 align:middle line:90%
the HAT, the host
access table, will

46
01:46.410 --> 01:49.170 align:middle line:90%
be dynamically populated
with the appropriate center

47
01:49.170 --> 01:51.678 align:middle line:90%
group based on their
reputation. and if we

48
01:51.678 --> 01:53.220 align:middle line:90%
did want to add a
device permanently,

49
01:53.220 --> 01:55.415 align:middle line:90%
we could just go to our
center group, click on it,

50
01:55.415 --> 01:57.040 align:middle line:90%
and here it is showing
us the settings.

51
01:57.040 --> 01:58.530 align:middle line:90%
So it's negative
10 to negative 3,

52
01:58.530 --> 02:00.430 align:middle line:90%
we could edit the
settings if you wanted to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.530 --> 02:00.430 align:middle line:90%
we could edit the
settings if you wanted to.

53
02:00.430 --> 02:03.120 align:middle line:90%
And if we wanted to add an
additional sender to that list,

54
02:03.120 --> 02:04.770 align:middle line:84%
we just click on Add Sender.

55
02:04.770 --> 02:07.980 align:middle line:90%
And then we could do it based
on IP address or geolocation.

56
02:07.980 --> 02:11.275 align:middle line:90%
We'd put in that
information, and let

57
02:11.275 --> 02:13.680 align:middle line:90%
me pick on somebody that's
not to get mad at me.

58
02:13.680 --> 02:15.450 align:middle line:90%
Let's go ahead
and pick on Aruba.

59
02:15.450 --> 02:16.470 align:middle line:84%
Sounds beautiful.

60
02:16.470 --> 02:17.820 align:middle line:84%
And we'll click on Submit.

61
02:17.820 --> 02:19.133 align:middle line:84%
And then we'll click on Commit.

62
02:19.133 --> 02:20.550 align:middle line:90%
And then it give
us an opportunity

63
02:20.550 --> 02:23.190 align:middle line:90%
to add comments for our commit,
and they'll take us back

64
02:23.190 --> 02:24.560 align:middle line:84%
to the HAT overview.

65
02:24.560 --> 02:28.890 align:middle line:90%
So now, based on how we just
modified that sender group,

66
02:28.890 --> 02:32.460 align:middle line:90%
any MTAs that are
sourced from Aruba
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.890 --> 02:32.460 align:middle line:90%
any MTAs that are
sourced from Aruba

67
02:32.460 --> 02:35.920 align:middle line:90%
are going to have this mail
flow policy applied to it.

68
02:35.920 --> 02:39.480 align:middle line:90%
So the mail flow policies are
blocked, which means drop it.

69
02:39.480 --> 02:42.480 align:middle line:90%
Throttled, we're controlling
how many emails and so forth,

70
02:42.480 --> 02:43.330 align:middle line:84%
or Accepted.

71
02:43.330 --> 02:45.780 align:middle line:90%
So if we want to modify
a mail flow policy,

72
02:45.780 --> 02:47.670 align:middle line:90%
we could do it here
by clicking on it,

73
02:47.670 --> 02:49.800 align:middle line:90%
or we could just go
to Mail Policies,

74
02:49.800 --> 02:51.600 align:middle line:90%
and just go to
Mail Flow Policies,

75
02:51.600 --> 02:54.010 align:middle line:90%
and take a look at
those details as well.

76
02:54.010 --> 02:55.750 align:middle line:90%
So for blocked, if
we click on that,

77
02:55.750 --> 02:59.350 align:middle line:90%
it basically says the action
is to go ahead and reject it.

78
02:59.350 --> 03:01.630 align:middle line:90%
So again, to get to that,
we went to Mail Policies,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:59.350 --> 03:01.630 align:middle line:90%
So again, to get to that,
we went to Mail Policies,

79
03:01.630 --> 03:03.600 align:middle line:90%
and then we went
to HAT Overview.

80
03:03.600 --> 03:06.030 align:middle line:90%
And another place to get
to the same information

81
03:06.030 --> 03:08.280 align:middle line:90%
would be under
Network and Listeners.

82
03:08.280 --> 03:10.530 align:middle line:90%
Here I have a listener name
called Incoming Mail, that

83
03:10.530 --> 03:12.930 align:middle line:90%
would be our public
listener, and it also

84
03:12.930 --> 03:16.090 align:middle line:90%
has a link here for HAT as
well, the host access table.

85
03:16.090 --> 03:17.640 align:middle line:90%
So we click on that,
it takes us back

86
03:17.640 --> 03:19.740 align:middle line:90%
to that same table where
we can click on the links

87
03:19.740 --> 03:21.690 align:middle line:90%
and modify those
details once again.

88
03:21.690 --> 03:23.800 align:middle line:90%
In this video, we
identified two basic things.

89
03:23.800 --> 03:27.900 align:middle line:90%
Number one, the HAT is
primarily reputation scores that

90
03:27.900 --> 03:30.840 align:middle line:90%
is being fed to us from
TALOS, but we can also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:27.900 --> 03:30.840 align:middle line:90%
is being fed to us from
TALOS, but we can also

91
03:30.840 --> 03:32.460 align:middle line:90%
manipulate a
senders group and we

92
03:32.460 --> 03:35.640 align:middle line:90%
can add by geolocation
or IP address or domain,

93
03:35.640 --> 03:37.800 align:middle line:90%
we can manually add
to the senders group

94
03:37.800 --> 03:39.600 align:middle line:90%
and make that a
permanent part of those

95
03:39.600 --> 03:41.100 align:middle line:90%
sender groups instead
of just having

96
03:41.100 --> 03:42.225 align:middle line:84%
it all dynamically learned.

97
03:42.225 --> 03:43.890 align:middle line:90%
And anything we
configure manually

98
03:43.890 --> 03:47.760 align:middle line:90%
is going to override whatever
we received from TALOS.

99
03:47.760 --> 03:50.550 align:middle line:90%
So up to this point, our primary
focus with email security

100
03:50.550 --> 03:51.960 align:middle line:90%
appliance has been
inbound email,

101
03:51.960 --> 03:53.460 align:middle line:90%
and then in the
next video, I'd like

102
03:53.460 --> 03:55.710 align:middle line:90%
to chat with you
about outbound email

103
03:55.710 --> 03:57.900 align:middle line:90%
and some precautions the
email security appliance

104
03:57.900 --> 03:59.200 align:middle line:84%
can take there as well.

105
03:59.200 --> 04:01.660 align:middle line:90%
So I'll see you in the next
video in just a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:59.200 --> 04:01.660 align:middle line:90%
So I'll see you in the next
video in just a moment.

106
04:01.660 --> 04:03.870 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

107
04:03.870 --> 04:07.190 align:middle line:90%
and I'd like to thank
you for viewing.