A phishing email bypassed the Check Point security controls

[Nishanthan]

We are experiencing an issue with Harmony Email security and would like your assistance.

• On 8th September, a phishing email was successfully blocked by Harmony Email.

• On 19th September, a similar phishing email from a different sender was delivered to the customer’s mailbox.

• The phishing email on 19th September was not blocked by Harmony Email and we were unable to find any related logs for this event.

• Email tracing shows that the message hit the Microsoft external email header policy, but it did not trigger any Check Point policy enforcement.

• Despite this, the email still reached the customer mailbox.

Concerns / Questions:

1. Why did Harmony Email fail to block the phishing email on 19th September?

2. Why are there no Harmony Email logs for this email?

3. Why was the message processed only under Microsoft’s external header policy and not evaluated by Check Point’s security controls?

[G_W_Albrecht · Accepted solution]

Do you have a SR# wuth CP TAC open already to get these questions answered?

[Nishanthan]

We raised a service request, and their response was that “this user is not a protected user.” That part is correct, since the object in question is not an individual user but a Microsoft group. However, inside this group there are multiple protected users. The concern is why the email was still delivered to those protected users and not blocked. Additionally, we need to understand why the message was not automatically deleted from the inboxes of those protected users.

[the_rock]

Definitely should have been deleted, agree.

Andy

[the_rock]

Hey mate,

Any news about this? What did TAC say?

Best,

Andy

[the_rock · Accepted solution]

For something like this, I would definitely open TAC case. In the meantime, are there any relevant logs you can send us?

Andy

[PhoneBoy · Accepted solution]

Specific instances of false positives/false negatives should be addressed via TAC.