- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- Help me understand the use case and sell Threat Ex...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Help me understand the use case and sell Threat Extraction
Hi!
Having read a few articles and skimmed thru the Threat Prevention admin manual I seem to be missing the point of using Threat Extraction.
In my limited experience with dealing with spam(managing filters, quarantine), I haven't encountered a case where an email was both infected and containing actual useful information for the recipient.
In some cases, someone might have hijacked an account and added a malicious attachment or url to the original email. But if this is just a copy of already consumed information, it would not serve any purpose to the recipient (after Threat Extraction did its job), except to confuse them.
So I'm probably missing something but I don't know what.
- Labels:
-
Threat Extraction
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TX takes the email attachment (usually Excel / Word files) and converts them to PDF without active content. This is then sent to the client instead of the original attachment.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TE - emulation takes time for any document you send to the user but TEX is on the fly, instant and the user gets information whatever it is. Doesn't matter what content it is, important is that it's safe and instant.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Personally, I would think that in this instance, it would be worth thinking about using actual dedicated TE appliance, specifically for this purpose.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Whatever security controls you have in place, there is always the possibility of a false negative (i.e. something detected as "clean" that actually isn't).
If the email has an attachment and it's opened on the end user device, it can be game over.
Whether the attachment itself is actually useful or not is irrelevant.
Threat Extraction rewrites all document attachments in a manner that eliminates potentially malicious content.
It's very quick and ensures end users always receive safe content without waiting for Threat Emulation to render a verdict.
If it turns out the original document is needed, if Threat Emulation says the file is clean, end users can request it via a self-service portal.