Symantec Mail Security, Administration Manual

Page: 94 / 258

94 Configuring email filtering
Managing Email Firewall policies
lists maintained by Symantec. Sender authentication provides a way to block
forged email.
Configuring attack recognition
Symantec Mail Security for SMTP can detect the following types of attacks
originating from a single SMTP server (IP address).
Enable, disable, and configure attack recognition
Set up attack recognition as described in the following sections. All attack
recognition types are disabled by default, and must be enabled to be activated.
To enable or disable attack recognition
1 In the Control Center, click Policie s > Attacks .
2 Check the box next to each attack type that you want to enable or disable, or
check the box next to Attacks to select all attack types.
3 Click Enable to enable the checked attack types, or click Disable to disable
the checked attack types.
To configure directory harvest, spam, and virus attack recognition
1 In the Control Center, click Policie s > Attacks .
2 Click Directory Harvest Attack , Spam Attack , or Virus Attack .
Directory harvest
attacks Spammers employ directory harvest attacks to find valid
email addresses at the target site. A directory harvest
attack works by sending a large quantity of possible email
addresses to a site. An unprotected mail server will simply
reject messages sent to invalid addresses, so spammers can
tell which email addresses are valid by checking the
rejected messages against the original list. By default,
connections received from violating senders are deferred.
Spam attack A specified quantity of spam messages has been received
from a particular IP address. By default, connections
received from violating senders are deferred.
Virus attack A specified quantity of infected messages has been received
from a particular IP address. By default, connections
received from violating senders are deferred.