- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Infinity preventing known and unknown Gen V at...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Infinity preventing known and unknown Gen V attacks using email as attack vector
This whitepaper outlines outlines some key elements for the defense against known and unknown GenV attacks
available in the release R80.30. This version is focused on email as an attack vector and describes the configuration of the MTA functionality.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey Peter!
Around June of 2022 I was on a webinar presumably about Harmony Email protection and it of course was all cloud.
I asked a question and you graciously sent me this link, thank you so much!
I wonder if you may have updated that paper at any point, or if you think that it applies for the R81.10 environment as well?
One other thing we need to address in my environment is enabling TLS inspection and how to deal with the certificates.
We have this setup:
Internet --> CheckPoint 5200 GW --> Specific external IP Static Nat --> Network Rule SMTP HTTP HTTPS --> Exchange Server.
Currently all certificates are installed on the Exchange server and are based on the FQDN of the static NAT external IP address DNS hostname, plus the internal hostname and autodiscover etc.
I would like to enable the MTA and have it inspect SMTP TLS traffic. Searching the PDF for TLS only had a couple of hits, but I have not read the whole thing through yet. I am getting started on it now, and will search Check Mates and support KB for information about how to set that all up.
I have some stuff configured on our exchange server that FORCES TLS for certain connections which I also would need to be able to reproduce for compliance reasons with certain partner organizations.
Not really asking this info of you, just wanted to say thanks and put it into a post that I can come back to later.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @Chris_Butler ,
thanks for the feedback. I have not updated the paper as I observed a strong move of customers towards Microsoft 365 and Microsoft Exchange Online. There have been many security challenges in the context of on-premises hosted email over the past years and I observe Microsoft encouraging customers moving to cloud hosted solutions here.
I observe a Better Security for email provided by the Harmony Email & Collaboration solution. The on-premises solutions for email using the Security Gateway MTA capabilities haven't changed since I created the paper. The MTA Advanced Technical Reference Guide sk109699 includes instructions how to configured SMTPS. Other MTA settings and capabilities are documented here in the admin guide.
You may even want to explore another idea: using the Threat Prevention API. You can have attachments send by an API client to the Threat Prevention Cloud service for sanitization and get unknown attacks prevented. An API based solution may integrate well in the workflow and business process of your needs.
best regards
pelmer