Symantec Mail Security, Administration Manual

Page: 71 / 258

71 Configuring email filtering
About email filtering
About precedence
Determining the precedence of different types of filtering for a particular
message rests on many factors. For more information on the various lists
discussed below, see
“Configuring sender groups” on page 95.
If more than one verdict matches a message, the following applies:
■
Any matching verdict that calls for an action of defer or reject takes
precedence over verdicts that call for other actions.
■
If multiple matching verdicts call for defer or reject, the one of those
verdicts that appears first in the precedence list (see below) takes
precedence.
■
If no matching verdict calls for an action of defer or reject, then the
matching verdict that appears first in the precedence list takes precedence.
■
Although a verdict can call for multiple actions, only one verdict determines
the actions that are taken on a message. Actions called for by lower
precedence verdicts are not applied.
Order of precedence:
■
Virus attack
■
Worm
■
Virus
■
Spyware or adware
■
Suspicious attachment (suspected virus)
■
Unscannable
■
Encrypted attachment
■
End user-defined Allowed Senders List
■
End user-defined Blocked Senders List
■
Administrator-defined, IP-based Allowed Senders List
Remote access
programs Programs that let a remote user gain access to a computer over the
Internet to gain information, attack, or alter the host computer.
Spyware Stand-alone programs that can secretly monitor system activity and
detect passwords and other confidential information and then relay the
information back to a remote computer.
Table 4-4 Security risk categories included in spyware or adware verdict
Category Description