Infinity preventing known and unknown Gen V attacks using email as attack vector

[Peter_Elmer]

This whitepaper outlines outlines some key elements for the defense against known and unknown GenV attacks
available in the release R80.30. This version is focused on email as an attack vector and describes the configuration of the MTA functionality. 

[PhoneBoy]

Nice work!

[Chris_Butler]

Hey Peter!

Around June of 2022 I was on a webinar presumably about Harmony Email protection and it of course was all cloud.

I asked a question and you graciously sent me this link, thank you so much!

I wonder if you may have updated that paper at any point, or if you think that it applies for the R81.10 environment as well?

One other thing we need to address in my environment is enabling TLS inspection and how to deal with the certificates.

We have this setup:
Internet --> CheckPoint 5200 GW --> Specific external IP Static Nat --> Network Rule SMTP HTTP HTTPS --> Exchange Server.

Currently all certificates are installed on the Exchange server and are based on the FQDN of the static NAT external IP address DNS hostname, plus the internal hostname and autodiscover etc.  

I would like to enable the MTA and have it inspect SMTP TLS traffic. Searching the PDF for TLS only had a couple of hits, but I have not read the whole thing through yet. I am getting started on it now, and will search Check Mates and support KB for information about how to set that all up.  
I have some stuff configured on our exchange server that FORCES TLS for certain connections which I also would need to be able to reproduce for compliance reasons with certain partner organizations. 

Not really asking this info of you, just wanted to say thanks and put it into a post that I can come back to later. 

[Peter_Elmer]

Hello @Chris_Butler ,

thanks for the feedback. I have not updated the paper as I observed a strong move of customers towards Microsoft 365 and Microsoft Exchange Online. There have been many security challenges in the context of on-premises hosted email over the past years and I observe Microsoft encouraging customers moving to cloud hosted solutions here.

I observe a Better Security for email provided by the Harmony Email & Collaboration solution. The on-premises solutions for email using the Security Gateway MTA capabilities haven't changed since I created the paper. The MTA Advanced Technical Reference Guide sk109699 includes instructions how to configured SMTPS. Other MTA settings and capabilities are documented here in the admin guide.

You may even want to explore another idea: using the Threat Prevention API. You can have attachments send by an API client to the Threat Prevention Cloud service for sanitization and get unknown attacks prevented. An API based solution may integrate well in the workflow and business process of your needs.

best regards

pelmer