Email Filtering Policies
Email Protection Administrator Guide
6
Proprietary: Not for use or disclosure outside McAfee without written permission.
November 2012
Attachment Filtering
Email Protection provides you the ability to control the types and sizes of allowed
attachments entering your email network. You can control attachment filtering using any
of the following:
Attachment Filter
Type
Description
Attachment Filtering
by File Type
You can enable or disable filtering of attachments by file type. File
type is determined using the file extension, MIME content type,
and binary composition.
Attachment Filtering
by Size
You can designate a maximum allowed size for each enabled
attachment type.
Custom Attachment
Rules by Filename
You can configure custom rules using filenames that override the
global
settings for an attachment file type. You can designate that
the rule use the entire filename or any part of the filename.
Filtering for Files
Contained within a Zip
File Attachment
You can configure custom rules to cause Email Protection to
analyze the files within a zip file attachment, if possible, to
determine if a file in the zip file violates attachment policies. If the
zip file cannot be analyzed, you can designate the email action to
be applied.
Encrypted or “High
Risk” Zip File
Attachment Rules
You can configure custom rules for emails with encrypted zip files
and/or zip files that are considered
high risk
(too large, too many
nested levels, etc.).
Stripping of Spam
Beacons or Web bugs
Spam beacons
and
web bugs
are typically transparent, 1x1 pixel
graphics embedded in HTML content that send information about
your system to the source (usually a URL) of the spam beacon or
web bug. Typically, web bugs are used on Web sites to monitor
surfing behavior, but now spammers are hiding them in their mass
mailings as spam beacons. If the graphic is not removed before an
email is opened, the spam beacon sends a signal back to the
spammer’s URL that lets the spammer know whether the email
was opened and if the recipient’s email address is valid. If the
spammer gets this signal, the recipient is marked as a
valid
address and is guaranteed to receive more spam in the future.
You can enable or disable the automatic stripping of spam beacons
or Web bugs within HTML emails.
Disabling hyperlinks
within email with
ClickProtect
SM
ClickProtect
allows you to monitor and disable or enable whether
Web hyperlinks received in emails can be clicked and followed by
the user. With multiple levels of ClickProtect policy control,
Administrators can customize the desired level of protection. This
feature supports blocking phishing sites and accidental downloads
of viruses and worms.
Content Filter Type
Description