Email Appliance and Puremessage – Best Practice

Hello,

Incorporating both the email appliance and PureMessage for Exchange can present some planning intricacies in a way to ensure that:

1. endusers have a clear place to look at a quarantine
2. certain users can be exempt from any quarantine action

It usually comes down to organization requirements as to how to configure policies.

For the first point, some customers opt to quarantine messages at the appliance end, whereby the policy on the appliance is more strict when it comes to discarding or quarantining email. This leaves PureMessage for Exchange to have a lighter policy without any quarantine actions, but still allowing the Exchange information store scan to work for later virus definitions. Part of the reason for this could be tied to the enduser experience, as the digests that can be sent out contain more information pertaining to what's quarantined and the enduser web portal allows for individuals to manage their own personalized allow/block lists. Other reasons include perimeter protection and minimal redundancy.

Some other customers elect to use the quarantine within PureMessage, so the policy on the appliance handles IP reputation filtering and blocks viruses and other material that don't need to be quarantined; PureMessage can then quarantine email based on its policy. This may come into play if there are internal messages that need to be quarantined and the email administrator would prefer to look in the PureMessage console for all messages, then decide to control allow/blocks at a global level.

There are a few customers that elect to run two quarantines if their security practices rely on redundant or secondary scans, based on late breaking definitions or possible upstream reliability or maintenance.

Otherwise, there are some customers that choose not to do any quarantine action and then look at subject or header tagging, which would append custom text to either give a visual indication to the end user about possible warnings, or allow for another downstream email solution to detect those tags and then handle them accordingly. This may come into play for organizations that need to retain email at an individual level, if other email retention options such as journalling aren't available.

For the second point, if there are recipients within your organization that would not rather deal with quarantines or block lists, you can exempt those users or groups from certain scans. Within the appliance, you can configure policies to continue processing messages based on either AD information (if synchronized) or locally managed lists. Within PureMessage, each policy rule has the ability to add exceptions based on recipient using the double chevron icon beside each rule definition. Message tagging could be used so at least the recipient is aware of a potential concern, but a decision like that comes down to what level of email filtering is considered appropriate.

Hope that helps.

Hello,

Incorporating both the email appliance and PureMessage for Exchange can present some planning intricacies in a way to ensure that:

1. endusers have a clear place to look at a quarantine
2. certain users can be exempt from any quarantine action

It usually comes down to organization requirements as to how to configure policies.

For the first point, some customers opt to quarantine messages at the appliance end, whereby the policy on the appliance is more strict when it comes to discarding or quarantining email. This leaves PureMessage for Exchange to have a lighter policy without any quarantine actions, but still allowing the Exchange information store scan to work for later virus definitions. Part of the reason for this could be tied to the enduser experience, as the digests that can be sent out contain more information pertaining to what's quarantined and the enduser web portal allows for individuals to manage their own personalized allow/block lists. Other reasons include perimeter protection and minimal redundancy.

Some other customers elect to use the quarantine within PureMessage, so the policy on the appliance handles IP reputation filtering and blocks viruses and other material that don't need to be quarantined; PureMessage can then quarantine email based on its policy. This may come into play if there are internal messages that need to be quarantined and the email administrator would prefer to look in the PureMessage console for all messages, then decide to control allow/blocks at a global level.

There are a few customers that elect to run two quarantines if their security practices rely on redundant or secondary scans, based on late breaking definitions or possible upstream reliability or maintenance.

Otherwise, there are some customers that choose not to do any quarantine action and then look at subject or header tagging, which would append custom text to either give a visual indication to the end user about possible warnings, or allow for another downstream email solution to detect those tags and then handle them accordingly. This may come into play for organizations that need to retain email at an individual level, if other email retention options such as journalling aren't available.

For the second point, if there are recipients within your organization that would not rather deal with quarantines or block lists, you can exempt those users or groups from certain scans. Within the appliance, you can configure policies to continue processing messages based on either AD information (if synchronized) or locally managed lists. Within PureMessage, each policy rule has the ability to add exceptions based on recipient using the double chevron icon beside each rule definition. Message tagging could be used so at least the recipient is aware of a potential concern, but a decision like that comes down to what level of email filtering is considered appropriate.

Hope that helps.