Targeted Threat Protection: Impersonation Protect

Document created by user.oxriBaJeN4 Employee on Apr 11, 2016Last modified by user.oxriBaJeN4 Employee on Oct 9, 2017
Version 10Show Document
  • View in full screen mode
Targeted Threat Protection - Impersonation Protect is part of our Targeted Threat Protection suite. You must have another product from this suite (e.g. Targeted Threat Protection - Attachment Protect or Targeted Threat Protection - URL Protect) to use the Targeted Threat Protection - Impersonation Protect product.

The increasing number of "whaling" attacks, usually targeting an organization's senior management, means additional protection is required against email threats that do not contain attachments or URLs. Traditional spam filtering systems are unable to detect these as suspicious, due to their minimal content. Targeted Threat Protection - Impersonation Protect solves this, by:

  • Looking for combinations of key identifiers commonly found in these attacks.
  • Tagging a message to make it clear that it is coming from outside your organization.

 

Identifiers

 

In the impersonation protection definition, you can specify the number of identifiers that must be triggered before any action is taken. The available identifiers are:

  • Similar Internal Domain
  • Newly Observed Domain
  • Internal User Name
  • Reply to Address Mismatch
  • Targeted Threat Dictionary

 

Based on whether the required number of identifiers is triggered, you can specify the action to take if an email is identified as suspicious. The action can be:

  • Bounce
  • Hold
  • Tag

 

External Messages

 

Additionally, you can help users identify all messages as coming from an external domain regardless of whether any identifiers are triggered. This takes the form of text that can be added to a message's:

  • Body
  • Subject
  • Header

 

See Also...

 

2 people found this helpful

Attachments

    Outcomes