Using Brightmail to block confidential data to leave the company.
Created: 16 Aug 2011 | 5 comments
First at all: Yes, we know Symantec DLP. :)
A customer want to prevent leaks of sensitive data. At the moment, they have not budget to deploy DLP but they want to use Brightmail (as a first approach) to reduce the capacity of user to send confidential data through email.
So, the customer wants to know if he can configure content rules to block messages that trigger such content rules. Specifically, the question is: Can I configure rules that consider parameter like words proximity in the body or any attachment in the message?
Thanks a lot!
Discussion Filed Under:
Group Ownership:
Comments
Absolutely, that is one of
Absolutely, that is one of the main uses for the Brightmail Gateway.
That's the way it works. SMG
That's the way it works. SMG is a very quick and easy product to have DLP for the email channel.
With SMG you can add rules for email content etc. very fast and easy. I'm acctually on it to configure that for our partners.
You can use the dictionaries for the function you mentioned.
It work's really fine, and later on you can integrate that rule with DLP.
You can configure the the
You can configure the the content filtering policy of your SMG. you can also add dictionaries or patterns and create a policy. Add a condition that whenever that certain words or patterns was seen in the body or attachement of the message, you can block, delete or hold to quarantine folder (you can set what action you want.) then assign to the specific policy group you want.
words proximity
The OP mentions:
I am not aware that Brightmail can test for "able" within 5 words of "beta". You are pretty much limited to "X or more words from a dictionary"
How would you implment word proximity?
You could implement this with
You could implement this with regular expressions (regex) to a certain level, though I probably wouldn't suggest it. Regex is tricky at best. Complex matching for custom rules is not something that the Messaging Gateway was designed for (though it has come a looong way from where it started); as mentioned by OP, DLP is the proper solution.
In a pinch, though, you can accomplish quite a bit with dictionaries and patterns using regex.
If you find a useful post, please use the "thumbs up" feature to mark the post as helpful. If your question has been answered, please select the "Mark as solution" for the post that best answered your question. Thank you.
Would you like to reply?
Login or Register to post your comment.