WEBVTT

1
00:00.000 --> 00:00.940 align:middle line:84%


2
00:00.940 --> 00:03.040 align:middle line:90%
Let's imagine Bob
is sending an email.

3
00:03.040 --> 00:05.620 align:middle line:90%
That email is going
to be sent via SMTP

4
00:05.620 --> 00:08.050 align:middle line:90%
over to the email
server internally, who's

5
00:08.050 --> 00:10.840 align:middle line:90%
going to send it to the email
security appliance, who's then

6
00:10.840 --> 00:13.750 align:middle line:90%
going to forward it or
maybe it won't forward it.

7
00:13.750 --> 00:16.149 align:middle line:90%
Let's take a look at some of
the rules and processes that

8
00:16.149 --> 00:18.066 align:middle line:90%
are going to be followed
by the email security

9
00:18.066 --> 00:19.970 align:middle line:84%
appliance for outbound email.

10
00:19.970 --> 00:22.180 align:middle line:90%
So to start off, let's talk
about the two listeners

11
00:22.180 --> 00:24.000 align:middle line:90%
I have on this email
security appliance.

12
00:24.000 --> 00:26.590 align:middle line:90%
If we go to Network and
we click on Listeners,

13
00:26.590 --> 00:29.770 align:middle line:90%
the incoming mail listener
is the public listener

14
00:29.770 --> 00:32.320 align:middle line:90%
that's communicating with
all the external MTAs,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.770 --> 00:32.320 align:middle line:90%
that's communicating with
all the external MTAs,

15
00:32.320 --> 00:34.850 align:middle line:90%
the external email
servers, and this listener

16
00:34.850 --> 00:37.540 align:middle line:90%
called outgoing email,
which I guess I should

17
00:37.540 --> 00:39.070 align:middle line:84%
go ahead and rename that.

18
00:39.070 --> 00:43.060 align:middle line:90%
And let me rename it to
private, because this

19
00:43.060 --> 00:44.590 align:middle line:90%
is the listener
that's communicating

20
00:44.590 --> 00:46.505 align:middle line:84%
with our internal email server.

21
00:46.505 --> 00:47.630 align:middle line:84%
That's a little bit better.

22
00:47.630 --> 00:49.297 align:middle line:90%
And let me go ahead
and click on Submit.

23
00:49.297 --> 00:51.753 align:middle line:90%
And also with the email
security appliance,

24
00:51.753 --> 00:53.170 align:middle line:90%
once you click on
Submit, you also

25
00:53.170 --> 00:55.870 align:middle line:90%
want to click on Commit Changes
and Commit Changes again

26
00:55.870 --> 00:57.970 align:middle line:90%
to make it all
part of the config.

27
00:57.970 --> 01:00.020 align:middle line:84%
All right, much better.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:57.970 --> 01:00.020 align:middle line:84%
All right, much better.

28
01:00.020 --> 01:02.920 align:middle line:90%
So incoming from the outside
world and our private listener

29
01:02.920 --> 01:06.100 align:middle line:90%
that we're using to communicate
with our internal email server.

30
01:06.100 --> 01:07.840 align:middle line:90%
So for the incoming
email server,

31
01:07.840 --> 01:10.390 align:middle line:90%
we have the HAT, which is all
about the reputation scores,

32
01:10.390 --> 01:12.310 align:middle line:90%
and we also have
the recipient access

33
01:12.310 --> 01:15.020 align:middle line:90%
table, which is specifying
what domains this is for.

34
01:15.020 --> 01:18.680 align:middle line:90%
So traffic coming in
for ogit.com anything,

35
01:18.680 --> 01:21.520 align:middle line:90%
and for these two email
addresses at those domains,

36
01:21.520 --> 01:23.380 align:middle line:90%
those would be allowed,
and everything else

37
01:23.380 --> 01:24.850 align:middle line:84%
will be rejected.

38
01:24.850 --> 01:27.290 align:middle line:90%
Also we can use LDAP, and
we can verify if someone

39
01:27.290 --> 01:29.170 align:middle line:84%
does send an email to ogit.com.

40
01:29.170 --> 01:31.755 align:middle line:90%
But it's an email address
that doesn't exist in LDAP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.170 --> 01:31.755 align:middle line:90%
But it's an email address
that doesn't exist in LDAP,

41
01:31.755 --> 01:33.130 align:middle line:90%
we can go ahead
and drop it right

42
01:33.130 --> 01:35.505 align:middle line:90%
here at the email security
appliance as well and not even

43
01:35.505 --> 01:37.278 align:middle line:84%
bother the real email server.

44
01:37.278 --> 01:38.320 align:middle line:84%
All right, but I digress.

45
01:38.320 --> 01:40.278 align:middle line:90%
Let me go back to the
network and to listeners,

46
01:40.278 --> 01:43.248 align:middle line:90%
and I want to focus on
the private listener.

47
01:43.248 --> 01:45.790 align:middle line:90%
So for the private listener, we
could be sending those emails

48
01:45.790 --> 01:47.452 align:middle line:90%
to like anybody in
the whole world,

49
01:47.452 --> 01:48.910 align:middle line:90%
so we don't have
a recipient access

50
01:48.910 --> 01:51.520 align:middle line:90%
table on the
private side, but we

51
01:51.520 --> 01:54.610 align:middle line:90%
do have a HAT, the host
access table, that's

52
01:54.610 --> 01:57.730 align:middle line:90%
just identifying who we're
willing to basically receive

53
01:57.730 --> 01:59.060 align:middle line:84%
messages from.

54
01:59.060 --> 02:01.420 align:middle line:90%
And if we click on the HAT
for the private listener,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.060 --> 02:01.420 align:middle line:90%
And if we click on the HAT
for the private listener,

55
02:01.420 --> 02:04.660 align:middle line:90%
and the default policy here is
the sender group is relay list

56
02:04.660 --> 02:07.250 align:middle line:90%
and the mail flow policy
is relayed, meaning

57
02:07.250 --> 02:08.500 align:middle line:84%
it's just going to forward it.

58
02:08.500 --> 02:10.875 align:middle line:90%
And this basically means that
if email messages are being

59
02:10.875 --> 02:13.737 align:middle line:90%
sent from our internal server to
this email security appliance,

60
02:13.737 --> 02:15.320 align:middle line:90%
it's going to go
ahead and forward it.

61
02:15.320 --> 02:17.740 align:middle line:90%
And if we click on the sender
group called Relay List,

62
02:17.740 --> 02:20.500 align:middle line:90%
and we scroll down,
during the setup

63
02:20.500 --> 02:23.560 align:middle line:90%
wizard it asked me what
my real email server was.

64
02:23.560 --> 02:27.830 align:middle line:90%
So this 192.168.1.100 is
my internal email server,

65
02:27.830 --> 02:30.550 align:middle line:90%
and so basically it's saying
if I get email messages
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:27.830 --> 02:30.550 align:middle line:90%
and so basically it's saying
if I get email messages

66
02:30.550 --> 02:33.160 align:middle line:90%
from this MTA, that
email server, effectively

67
02:33.160 --> 02:35.440 align:middle line:90%
the sender here, is
going to be trusted

68
02:35.440 --> 02:37.060 align:middle line:84%
because the internal server.

69
02:37.060 --> 02:38.200 align:middle line:84%
So a big difference here.

70
02:38.200 --> 02:40.960 align:middle line:90%
If we're receiving from email
servers on the outside world,

71
02:40.960 --> 02:43.390 align:middle line:90%
we have that whole
reputation score and checking

72
02:43.390 --> 02:44.390 align:middle line:84%
and all the rest.

73
02:44.390 --> 02:46.570 align:middle line:90%
And if we're receiving
from our internal server,

74
02:46.570 --> 02:49.100 align:middle line:90%
we're basically saying, I
know who you are, I trust you.

75
02:49.100 --> 02:51.017 align:middle line:90%
I'm going to go ahead
and allow that email in.

76
02:51.017 --> 02:53.590 align:middle line:90%
But just because it got
through that first pass,

77
02:53.590 --> 02:55.510 align:middle line:90%
and the email security
appliance, says, yep,

78
02:55.510 --> 02:58.630 align:middle line:90%
I'm willing to take in emails
from you, Mr. Internal Email

79
02:58.630 --> 03:00.280 align:middle line:90%
Server, that doesn't
mean I'm just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.630 --> 03:00.280 align:middle line:90%
Server, that doesn't
mean I'm just

80
03:00.280 --> 03:01.550 align:middle line:84%
going to forward everything.

81
03:01.550 --> 03:04.420 align:middle line:90%
So in addition to trusting, OK,
I trust you Mr. Email Server

82
03:04.420 --> 03:07.030 align:middle line:90%
Internal, I'm going to receive
these email messages from you,

83
03:07.030 --> 03:08.890 align:middle line:90%
there's a whole bunch
of policy options

84
03:08.890 --> 03:11.590 align:middle line:90%
we have regarding outbound
mail that we can still

85
03:11.590 --> 03:14.293 align:middle line:90%
put through its paces
before the emails are sent.

86
03:14.293 --> 03:15.710 align:middle line:90%
And those can be
found right here.

87
03:15.710 --> 03:17.530 align:middle line:90%
If we go to Email
Policies, and we

88
03:17.530 --> 03:20.080 align:middle line:84%
go to Outbound Mail Policies.

89
03:20.080 --> 03:23.260 align:middle line:90%
So regarding outbound mail
policies, check this out.

90
03:23.260 --> 03:25.090 align:middle line:84%
We can do antispam checking.

91
03:25.090 --> 03:27.310 align:middle line:90%
We don't want our internal
user spamming the world

92
03:27.310 --> 03:30.590 align:middle line:90%
from our email servers, so we
want to catch that and stop it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:27.310 --> 03:30.590 align:middle line:90%
from our email servers, so we
want to catch that and stop it.

93
03:30.590 --> 03:33.190 align:middle line:90%
We also don't want to be
sending viruses or malware

94
03:33.190 --> 03:35.600 align:middle line:90%
from our internal
clients going out.

95
03:35.600 --> 03:37.720 align:middle line:90%
There's options for
advanced malware protection,

96
03:37.720 --> 03:39.640 align:middle line:90%
for graymail, and
many of these are

97
03:39.640 --> 03:42.550 align:middle line:90%
dependent on which features
or licenses you have enabled.

98
03:42.550 --> 03:45.130 align:middle line:90%
We can apply content
filters, including

99
03:45.130 --> 03:47.500 align:middle line:90%
specifying that we want
to encrypt certain email

100
03:47.500 --> 03:49.120 align:middle line:90%
messages based on
the characteristics

101
03:49.120 --> 03:49.945 align:middle line:84%
of those emails.

102
03:49.945 --> 03:52.570 align:middle line:90%
There's outbreak filters, which
are really important for a zero

103
03:52.570 --> 03:53.110 align:middle line:84%
day attacks.

104
03:53.110 --> 03:54.520 align:middle line:90%
If something brand
new is happening,

105
03:54.520 --> 03:56.895 align:middle line:90%
we want to be able to be aware
of that, see it happening,

106
03:56.895 --> 03:58.640 align:middle line:90%
and then shut it down
as fast as possible

107
03:58.640 --> 04:00.015 align:middle line:90%
so we're not part
of the problem.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:58.640 --> 04:00.015 align:middle line:90%
so we're not part
of the problem.

108
04:00.015 --> 04:02.140 align:middle line:90%
And for outbound,
this is new, which

109
04:02.140 --> 04:03.790 align:middle line:90%
was not on the inbound
policy, and that

110
04:03.790 --> 04:06.140 align:middle line:84%
is data loss prevention.

111
04:06.140 --> 04:08.685 align:middle line:90%
So we can specify which
elements we want for data loss

112
04:08.685 --> 04:10.060 align:middle line:90%
prevention, and
then it can start

113
04:10.060 --> 04:11.930 align:middle line:84%
looking for that in the emails.

114
04:11.930 --> 04:14.110 align:middle line:90%
For example, is there
credit card information

115
04:14.110 --> 04:16.930 align:middle line:90%
or social security numbers or
other sensitive information

116
04:16.930 --> 04:18.550 align:middle line:90%
based on the policy
we have, and it

117
04:18.550 --> 04:20.620 align:middle line:90%
can stop those
emails from going out

118
04:20.620 --> 04:22.130 align:middle line:84%
before they're actually sent.

119
04:22.130 --> 04:24.940 align:middle line:90%
So here's the major takeaway
regarding inbound email

120
04:24.940 --> 04:26.260 align:middle line:84%
and outbound email.

121
04:26.260 --> 04:29.440 align:middle line:90%
For email that is coming in,
it's all about reputation

122
04:29.440 --> 04:32.530 align:middle line:90%
and HAT, the host access table,
which is driven primarily
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:29.440 --> 04:32.530 align:middle line:90%
and HAT, the host access table,
which is driven primarily

123
04:32.530 --> 04:35.560 align:middle line:90%
by reputation, and that's going
to cause the email security

124
04:35.560 --> 04:37.810 align:middle line:90%
appliance to drop
just a ton of emails

125
04:37.810 --> 04:40.030 align:middle line:90%
if the reputation of the
sender is just too low.

126
04:40.030 --> 04:42.520 align:middle line:90%
Now, contrast that
against email being

127
04:42.520 --> 04:44.680 align:middle line:90%
sent from our internal
server going out.

128
04:44.680 --> 04:46.510 align:middle line:90%
We don't have all
that reputation stuff

129
04:46.510 --> 04:48.980 align:middle line:90%
for our internal server
because we know what it is.

130
04:48.980 --> 04:51.610 align:middle line:90%
So we configured it, we
pointed to its IP address,

131
04:51.610 --> 04:53.740 align:middle line:90%
and email from the
internal server going out

132
04:53.740 --> 04:56.260 align:middle line:90%
isn't going through that
whole reputation game.

133
04:56.260 --> 04:59.950 align:middle line:90%
Now in either case, even if we
pass the reputation coming in,

134
04:59.950 --> 05:02.280 align:middle line:90%
and we know who that server
is on the inside going out,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
04:59.950 --> 05:02.280 align:middle line:90%
and we know who that server
is on the inside going out,

135
05:02.280 --> 05:05.762 align:middle line:90%
we still have all the policy and
rules that have to be followed.

136
05:05.762 --> 05:08.220 align:middle line:90%
And the biggest difference with
all those individual rules,

137
05:08.220 --> 05:09.637 align:middle line:90%
which we'll take
a closer look at,

138
05:09.637 --> 05:11.910 align:middle line:90%
is the data loss
prevention, which

139
05:11.910 --> 05:13.800 align:middle line:84%
applies only to the outbound.

140
05:13.800 --> 05:17.055 align:middle line:90%
So we're looking for credit card
information or social security

141
05:17.055 --> 05:18.750 align:middle line:90%
number information
or other details that

142
05:18.750 --> 05:19.895 align:middle line:84%
shouldn't be sent out.

143
05:19.895 --> 05:21.270 align:middle line:90%
That's an additional
rule that we

144
05:21.270 --> 05:24.115 align:middle line:90%
can have as a check for
outbound email traffic.

145
05:24.115 --> 05:25.740 align:middle line:90%
So thanks for joining
me in this video.

146
05:25.740 --> 05:28.323 align:middle line:90%
In the next video, I'd like to
chat with you about everybody's

147
05:28.323 --> 05:31.770 align:middle line:90%
favorite topic, spam, and doing
some additional spam filtering
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:28.323 --> 05:31.770 align:middle line:90%
favorite topic, spam, and doing
some additional spam filtering

148
05:31.770 --> 05:33.483 align:middle line:84%
on the email security appliance.

149
05:33.483 --> 05:35.650 align:middle line:90%
So I'll see you in that
next video in just a moment.

150
05:35.650 --> 05:38.010 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

151
05:38.010 --> 05:41.390 align:middle line:90%
and I'd like to thank
you for viewing.