Server side SMTP blocking

Well this is a really old post but I'd like to bring it to the forefront since this is exactly the question I have.  I am a new Sophos customer and replacing McAfee AV with the Sophos solution.  I see that Sophos still does not block any SMTP outgoing attempts so I would be looking for a solution to this as well.

Thoughts anyone?

Hi,

I suspect that if a malicious process was going to try and spam out something, depending on the characteristics of the file and runtime it would probably be picked up by HIPS as an IPConnect rule.

http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-001/detailed-analysis.aspx

http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-002/detailed-analysis.aspx

http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-003/detailed-analysis.aspx

http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-004/detailed-analysis.aspx

and that's if it wasn't picked up as something else.

What about just using the Windows firewall or even TCP/IP filtering: http://support.microsoft.com/kb/816792 to block outgoing 25, even if it doesn't have application level inspection that would be something for the servers where you can't run SCF.

Regards,

Jak

I would agree that HIPS would catch the threat but in a new installation it is not recommended to turn on blocking but rather detect and report only.  The reason for this is to build your authorization list without impacting the end users.  I'll look at the Windows Firewall suggestion, but at the end of the day, I still think it is better to block attempts at the source rather than at the endpoint of a threat.