SMS SMTP policy override for encrypted attachments
Problem: The first triggered policy takes effect and skips any others. Therefore, the policy heirarchy of SMS SMTP causes workflow problems.
We receive many encrypted attachments that are legit, but also an increasing number that are viruses. And we can't block all encrypted attachments because we need to receive the important ones. The problem is that we can't come up with a way to differentiate between good and bad because encrypted attachment policy is higher in the heirarchy than both spam and compliance filters. So we can't keyword filter to differentiate. And the obvious spam ones are not seen as spam because the encrypted attachment policy acts first.
How do we resolve this with the limited control SMS SMTP provides? Is there a way to override the encrypted attachment policy with a custom policy (i.e. don't act on this at all if it looks like X)? Or to put exceptions into the encypted attachment policy? (Even whitelists are lower heirarchy so are overriden.)
Comments
Basically the reason that this is happening is because SMS SMTP 5 is a "single verdict engine" and when it reaches a verdict will stop scanning of the message. There isn't really a way around this unfortunately.
I have seen situations where a redirect of messages with encrypted attachments back through the system to scan again will alleviate the issue with spam getting through. But this doesn't address the other issues you are seeing.
The best you can do is create groups with differing actions and choose which users you want to receive the attachments and who you don't.
Other than that, the newer versions of the mail security appliance and virtual appliance all run on a multi-verdict engine which can still scan for spam and other actions if you want. So this solution would work better for you in your situation.
This isn't the end all be all as there may be some other way around it that I am unaware of, but for the most part this should be about all that can be done. You might try calling into support to see if there is a better solution.
Thanks for the reply. Unfortunately, that confirms my understanding. Support had no better workarounds. I don't understand why SMS SMTP is the poor stepchild of the appliances and of SMSME, and why they don't have a uniform development cycle. Why is SMS SMTP not the same thing as SMS 8300, just not self-contained? Heck, the virtual machine is even priced the same! Looks like I'll have to contact my vendor and see if we can crossgrade to an 8300 virtual machine. Not sure why Symantec support didn't suggest this to begin with... Thanks again!
The virtual side of things is fairly new and may have not been as prolific at the time you purchased the product. Since I wasn't involved it's hard to say. But this is definitely the way things seem to be going. I do believe you are on the right track at this point. Sorry for the hiccups on the way. :smileywink:
The big reason that SMS SMTP is not the same as the Hardware or virtual appliance is for exactly the reason you stated, it's not self contained. The software has to be ported to multiple platforms and this is where the time consuming part comes in. With the hardware or virtual appliance it is contained within one OS that has a lot of history with SMS. So it's much easier on the development cycles.
I hope this at least clears things up a little.
Thanks!
Well, I don't really buy that as an excuse re inherent and significant structural and functional differences. As you explained, they are functionally completely different products, but falsely marketed as different implementation options of the same product. We never would have bought this had we known this absurdly huge limitation, which was not apparent during our test cycle. Since we renewed more than 45 days ago, Symantec will not offer us a "refund" for cost-free crossgrade, but we're awaiting a price quote. Based on that quote, we'll decide whether to continue with Symantec or go back to the open market for competitive RFQs. No competitive advantage to Symantec if we'll have to buy the whole thing again. Anyhow, thanks much for the followup!
Completely understand. I apologize if anything I said sounded like I was grabbing for an excuse. The products have diverged quite a bit since version 5 of both the Appliance and SMS. At that point, they were exactly the same aside from the OS limitations of course. Multi-verdict was only added to the Hardware Appliance in version 7.5 and the Virtual wasn't even out until the 7.6 version.
If you ever need a more technical assessment of your product needs, remember you can always ask for presales technical support and we should be able to help out.
I hope you get things worked out to your satisfaction at this point.
Happy ending? Apparently we ARE already licensed for 8300 VE, but they only added it to fileconnect for 11.0.2 serial numbers and we had an 11.0 serial number. So, we got a new serial number from support and are downloading it now. Hopefully this will solve our problem. Thanks for the advice!
Good to hear! I hope all goes well!
Would you like to reply?
Login or Register to post your comment.