Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 343 / 861

342 Preventing attacks
Protecting your network resources from virus infections
■
For FTP and HTTP downloads that use optimizers, when a broken connection is detected, the
optimizer resumes the download from the point in which the disconnection occurred. This results
in downloading the remainder of the file and possibly reconstructing an infected file.
■
The user receives no notification that the trickled data file is incomplete or infected.
Blocking mail attachments that are known threats
You can filter mail by attachment file name or attachment file size during a virus outbreak. This lets
you protect your network immediately, before virus definitions for the new virus have been posted. In
the case of a new email-borne virus, if you know the file name or the exact file size of the infected
attachment, you can use this information to block the infected email.
You can block files that you know to be threats by doing the following:
■
Filtering mail by attachment name
■
Filtering mail by binary file size
Filtering mail by attachment name
You can filter mail based on the attachment names by specifying one or more file names that are
known threats and selecting whether these file names should be rejected or delivered with the
attachment removed. Any attachments that do not match the listed file names are not removed and are
delivered with the message.
For each full file name that you want to filter, you type a separate text string. If the text string that you
type matches the file name of any attachment, the message is handled accordingly.
Prerequisites
None.
To filter mail by attachment name
1 In the SGMI, in the left pane, under Policy, click Antivirus .
2 In the right pane, on the Mail Attachment Restrictions tab, to the right of the Files list box, click
Add .
3 In the Restricted Mail Attachment Filename dialog box, in the Mail attachment filename text box,
type the name of the attachment or a search string for the file that you want to block.
4 Click OK .
5
Under the Files list, select one of the following responses:
6
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
7
To apply these settings, create a rule and enable the appropriate actions on the Antivirus tab.
Block email message The security gateway rejects any message that contains an attachment with a specified
file name. Only SMTP email is blocked. POP3 mail is always delivered.
Remove attachment The security gateway removes any attachments with a specified file name and delivers
the remainder of the message, including attachments with names that do not match a
specified file name. The mail message is not updated to indicate that an attachment has
been deleted due to a mail policy violation unless you activate the mail message update
feature.