What type of email service do you use? *

Your email service is what hosts your mail.

Internal Exchange Server

Microsoft 365 (Office 365)

GSuite

Other-Internal

Other-Hosted

Do you want your outbound email filtered through ClosedPort: Email? *

Outbound mail filtering is important for protecting your outbound email from security risks. This also provides you the ability to implement encryption on outbound emails that might contain sensitive information.

Yes (Recommended)

No

Do you want email quarantine enabled? *

Email quarantine provides an added layer of protection, in that suspicious emails do not immediately get sent to your user’s inbox. Instead, they receive daily alerts if emails have been quarantined, and they have the option to either delete them or release them. This also gives users the ability to create their own safelists and blacklists.

Yes (Recommended)

No

These Days

Sun

Mon

Tue

Wed

Thu

Fri

Sat

Do you have a pre-existing list of email addresses or domains you would like whitelisted for all users? *

These email addresses or domains will be allowed to bypass any spam filtering. They will still be scanned for threats. If you answer Yes, we will contact you for the list of information to include.

Yes

No

Do you have a pre-existing list of email addresses or domains you would like blacklisted for all users? *

These email addresses or domains will be denied outright. If you answer Yes, we will contact you for the list of information to include.

Yes

No

What action do you want to take for IP Reputation? *

An IP address is a sender’s name, or how they are recognized, on the internet. A reputation is built on past behavior of that sender. The more spam or malicious emails a sender has sent, the worse their reputation. IP Reputation will take a desired action on any sender whose past has affirmed they consistently send out spam or malicious emails. Example: 80% of the emails coming from John Smith are either spam or malicious in nature. How would you like emails handled sent to your organization that are from John Smith.

Discard (Recommended)

Reject

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for URI Filters? *

A URI (uniform resource identifier) is the standardization on how different resources are structured on the internet. For example, websites will be https://www.sample.com, email links will be mailto:someone@sample.com, and so on. What URI filtering does is builds associations between these URI’s and categories of classifications such as Abortion, Guns, Drugs, Adult Content, etc. You can then take action on emails that fit into what ever groups you choose. Example: If you set a block on the category “Job Search”, then any email coming in with links to sites such as indeed.com, monster.com, etc. will be blocked. Or if you wanted to block on the category “Tobacco” and someone receives an email which includes the telephone number for Phillip Morris in their signature it would be able to key in on that URI and block it, even if there is no link to Phillip Morris’ website.

Discard (Recommended)

Reject

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Greylisting? *

Greylisting attempts to thwart spam before it is ever processed. It takes messages from unknown servers and temporarily rejects them. Spammers typically do not re-send a rejected message, however legitimate mail servers will. When this happens, the mail server becomes a known source as long as emails are received regularly.

Discard

Reject

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action (Recommended)

What action do you want to take for SPF Checks? *

Description: SPF records are DNS based records a company will publish to state who should be allowed to send email as their domain. This record is essentially a list of allowed IP addresses they permit to send email on their behalf. There really are no checks and balances on the internet stating who can send email as which domain, it is up to the receiving mail server to verify the sender. One way of doing this is by checking for a SPF record and verifying the sender against that record. Example: John Smith sends out an email from example.com. He sends it from the IP address 74.75.76.77. Example.com has a SPF record published that states only 101.102.103.104 can send email from their domain. John Smith’s email therefore does not pass a SPF check. This is the action we will take on such emails.

Discard (Recommended)

Reject

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Behavior Analysis? *

Behavior Analysis compares emails that aren’t classified as spam by any other metrics to those that are classified as spam. This function will assess whether the unclassified emails are actually spam or not. Example: If you’ve gotten 5 emails from malicious IP addresses all saying “Send money to my bit coin wallet,” All of these messages are blocked by AntiSpam because of the malicious IP. Then a 6th email comes in from a non-malicious IP but the same exact message of sending money. Because the first 5 emails were already classified as Spam, Behavior Analysis will classify this new email as spam even though it didn’t necessarily come from a malicious source. This is because it behaved exactly like the other emails that were classified as Spam.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Header Analysis? *

The header of an email is the section that includes things like your To: and From: field, as well as time stamps, source IP addresses, any mail servers the email flowed through prior to reaching its destination, and more. All email headers are checked at a basic level, looking at the To, From, IP, and Subject. With Header Analysis enabled, it instructs the system to review the entire header for any Spam characteristics. This could be something like a known Spam IP address somewhere in the chain of mail servers the message went through. Example: John Smith sends an email from example.com, IP address 74.75.76.77. This IP is not known to be malicious but the email routes through another mail server at 108.107.106.105 that is malicious. Header analysis will be more inclined to locate this and take action on it as that requires review of the entire header.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Impersonation Analysis? *

Impersonation analysis allows you to set up a list of high value targets such as the CEO or finance and HR personnel. The system will then protect your inbound email from outside actors pretending to be one of those targets. This is one of the most common means of Phishing that accounts for a majority of breached financial transactions. Example: John C. Smith is the CEO of Example, co (jsmith@example.com). Impersonation protection has been set up for John*Smith and the email address jsmith@example.com. A bad actor tries to email an accounting staff member as John C. Smith but from the address jsmith@gmail.com. Impersonation Analysis will not allow this message through as the CEO is being protected by Impersonation Analysis.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Heuristic controls? *

Heuristic controls utilize a lot of minor characteristics of an email message and grades each one, then totals up that grade. If the grade is over a certain threshold then the message will be regarded as Spam and appropriate action will be taken. This is the more traditional approach to Spam controls and spammers are constantly trying to bypass. Some things heuristic controls could look at are things like the presence of a large number of images but little text, as this is a common spam characteristic. It could also look for the presence of unsubscribe links, mass mailers without unsubscribe links, or key words within the email. The system will rate each finding and if the sum total of all findings is greater than the set spam threshold then the email is regarded as spam. Example: Jill Doe just opened a cosmetic shop at beauty.com. Jill purchased a list of emails to send grand opening flyers to. Because these people have not opted into Jills emailer this is regarded as spam and is illegal. Jill sends the email, which contains a large image of her flyer, no unsubscribe link, and a link to her website from a legitimate email address. With Heuristic controls, it would rank these such as the single large image would have a rating of 1.0, the no unsubscribe would have a rating of 1.5, the newly registered domain would have a rating of 1.0. Collectively this email has a rating of 3.5 which is above the standard spam threshold of 3.4, so this mail is still regarded as spam even though no individual characteristic set it off.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

Do you want to implement a banned word list? *

Banned word list is simply a list of words that, if found within the email, the system will take action on the email. Example: The CEO of a company does not want any email through that has the name of a competing organization “BadCorp”. Furthermore, he hates kangaroos so does not wish for any email to come through that mentions kangaroo. These 2 words would be added to the banned word list, and any email that contains either of the words will be blocked from coming through.

Yes

No

Do you want to implement a safe word list? *

A safe word list is a list of words that, if contained within an email, will bypass all other Spam checks and allow the email through, assuming it has no virus or disallowed attachments. Example: A company regularly sends out emails from their CRM software Salesforce, which their client base responds to. Because these responses can come from anywhere, the company may want to add Salesforce as a safe word so that these responses have less likelihood getting caught in a spam filter.

Yes

No

What action do you want to take for Image Spam? *

Description: Image spam parses the actual images contained within an email message and determines if it is a spam image or not. Images contain more than just the visual representation. They contain attributes known as metadata that can be read and assessed. These attributes can assist in the assessment of the image to key off on any spam characteristics. Example: A malicious user has hundreds of compromised email accounts. They send messages that include only an image of a malicious site they are trying to get people to. All emails share this same image. Because the characteristics of this image are known to be spam now, any email received that utilizes this same image will also be regarded as spam, no matter the sender, because the image analysis lines up.

Discard (Recommended)

Reject

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

Do you want to implement Bayesian scanning? *

Description: Bayesian scanning uses learned behavior from actions taken on previous emails to help further classify whether new email is more likely to be spam or not. ClosedPort learns what users classify as spam or not through the actions they take on email. It will then take similar characteristics of future email and classify them as spam based on this user training, even if the email would not have classified as spam otherwise.

Yes (Recommended)

No

If so, what action would you like to take?

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Suspect Newsletter?

Description: A newsletter is an informative email that is delivered to users who are subscribed to keep them connected and engaged. Suspect newsletters are emails structured like a newsletter in that they appear to have unsubscribe links and appear from a reputable business, but are in reality spam. They could be from bogus websites, have fake unsubscribe links, or a number of indicators used to fool spam filters. Example: Bad Actor A sends out a pretend newsletter from legit Company A claiming a big sale. On the surface the email looks normal, however, the link to Company A’s sale actually takes users to Company B’s ecommerce site. Bad Actor is using a newsletter from Company A as a ruse to coax people to their site for Company B.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Newsletters? *

A newsletter is an informative email that is delivered to users who are subscribed to keep them connected and engaged. By law a legitimate newsletter has to be subscribed to and have a means of unsubscribing. Unfortunately, many website registrations and checkout processes now automatically subscribe users to multiple newsletters. Though these emails are technically not spam as they are completely legitimate and legal, many people regard them as spam because they did not intentionally sign up for them. Example: A user wants to purchase something from Company A. During the account creation the user missed the checkboxes that alerted them that they would be put on the mailer for Company A and its affiliates. Now the user receives 5 emails a week from newsletters they unknowingly subscribed to.

Discard

Reject

Personal Quarantine (Recommended)

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Malware/Virus Outbreak? *

Malware and Virus Outbreak protection uses data analytics to flag potential malware and viruses. The system monitors known malicious IP addresses, looking for unusual behavior. For example, if a known malicious IP sees a sudden surge of sending out a certain .xlsx file, the Outbreak detection would regard that .xlsx file as malicious because there was a monitored influx of a malicious IP sending the file. Example: Across the internet, multiple known malicious IP addresses have started sending out a file “HappyDays.pdf”. Despite this file not showing as positive on any virus scan, Outbreak protection will block it based on the analytics of who is sending it and quantity of items sent. Even if the file were to come from a non-malicious IP, it has been flagged in Outbreak protection and will get caught.

Remove Attachment

Customized Email

Replacement

Discard

Reject (Recommended)

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Heuristic protection? *

Heuristic scanning uses real time analysis of the attachment to assess whether the system believes it is malware or a virus. In doing so, the system executes the file internally in a secure manner, monitoring the actions and commands the file performs in order to determine the likelihood of it being malicious. That determination is based on multiple rule sets and weighing metrics based on the actions the file takes when executed or opened. Example: A PDF when opened attempts to execute an Active X control that calls to a known malicious IP address. Furthermore, the PDF is attempting to communicate with the PDF reader in a way that mimic’s a known exploit with the PDF reader. These types of actions would lead the heuristic scan to regard the PDF as being malicious.

Remove Attachment

Customized Email

Replacement

Discard

Reject (Recommended)

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for File Signature checks? *

Every file has a unique identifier similar to a fingerprint. This identifier is called a file signature. This is true for all files, including malicious ones. The file signature check compares the signature of the attachment to a database of known malicious files.

Remove Attachment

Customized Email

Replacement

Discard

Reject (Recommended)

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take for Grayware? *

Grayware files are files that are not necessarily classified as a virus or malware, but still perform unwanted actions. These can include thing such as causing a large number of popups, which would impact the computer’s performance.

Remove Attachment

Customized Email

Replacement

Discard

Reject (Recommended)

Personal Quarantine

System Quarantine

Rewrite Recipient Email Address

No Action

What action do you want to take with executable files sent over email? *

System Quarantine (Recommended)

Personal Quarantine

Discard

Reject

Replace

What action do you want to take with quarantine or archive files sent over email? *

System Quarantine (Recommended)

Personal Quarantine

Discard

Reject

Replace

Are there any other types of files you would like the ClosedPort system to take action on when sent to your users? *

Yes

No

If Yes, what file types: What Action to take on these files?

System Quarantine

Personal Quarantine

Discard

Reject

Replace

What action do you want to take if ClosedPort finds key words identified as being malicious? *

From time-to-time we will respond to active threats and will implement protection against key words. These include malicious emails such as the I LOVE YOU bug or I RECORDED YOU exploitation emails.

System Quarantine (Recommended)

Personal Quarantine

Discard

Reject

Replace

Do you want to customize the encryption control settings? *

Yes

No

Do you wish to receive a notification in the event of a rate control being triggered? *

Yes

No

Email Configuration *

Do you need assistance setting up your inbound and outbound email settings?

Yes

No

Would you be willing to provide JSCM Group administrative access into your email system to assist with setup or troubleshooting? *

Yes

No

Do you need assistance setting up your SPF and DKIM records? *

Yes

No