Messaging Gateway

Hi,

I have one doubt in symantec bright mail gatway.

on compliance policies  in have to options

1, Executable File Violations
2, True Type Executable File Violations

What is Difference between the both

Regards,
Bala Krishna G

Executable file violations is looking at the file name and extension. So if a file ends with .bat, .exe or .vbs.

The true type detection actually looks at the header of the file to see if this is an executable file or not. That way if someone renames a .exe to .jpg we will be able to see that and take an action on it. Also, if a harmless file is renamed to .bin or .exe we will not think it is executable and take action on it.

Overall, true type is the way to go for better security.

Hi Bala,

1) "Delete Executable Files Violations" and 2) "Delete True Type Executable Files Violations" are two similar but different Compliance rules that are available for you to use.  The difference between them is that of the Attachment Lists that these 2 rules use.  1) uses the "Executable Files" attachment list and 2) uses the "True Type Executable Files" attachment list.  "Executable Files" attachment list has a list of executable file extensions in addtion to the Executable true types, whereas "True Type Executable Files" attachment list has only the list of Executable true types.  This means that 1) has the potential to incorrectly detect a non-executable file because of the file extension.  Whereas 2) is more accurate in terms of detection regardless of the file extension.  So as JDavis pointed out the best approach is to rely on the "True Type" detection.

Regards,

Adnan

Hi Bala,

If your question has been answered by any of the responses above, can you please close this thread by marking that response as the Solution?

Thanks

Adnan

Hi Bala,

Please take a few moments to mark the reponse that you think best answered your question as the Solution.

Thanks

Adnan