Can I block malicious files sent via email ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Can I block malicious files sent via email ?

L2 Linker

If my organization users send or receive emails (internal or external) with malicious file attachments , will I be able to block such emails using PAN firewall file blocking features  ? I think Microsoft O365 already creates an encrypted channel so the email attachments or contents  are protected until the files are manually downloaded by user.

Will SSL decryption helps in this scenario ? 

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

@Psrivastava,

Look at the WildFire verdict actions, specifically on SMTP. If you are using webmail then no, but if you see the actual SMTP traffic then maybe. 

The one thing to keep in mind here is that the attachments are usually randomized and therefore get sent to WildFire to recieve a verdict, and in that time it will be delievered so in most cases you won't have a chance to stop the message until it's already been delivered. You also have to ask yourself if you really want to risk false positives getting blocked by WildFire and your firewall, as there is no way to recover the message at that point, where on a mail filtering device you would have the abiliity to manually deliver said message. 

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

@Psrivastava,

Look at the WildFire verdict actions, specifically on SMTP. If you are using webmail then no, but if you see the actual SMTP traffic then maybe. 

The one thing to keep in mind here is that the attachments are usually randomized and therefore get sent to WildFire to recieve a verdict, and in that time it will be delievered so in most cases you won't have a chance to stop the message until it's already been delivered. You also have to ask yourself if you really want to risk false positives getting blocked by WildFire and your firewall, as there is no way to recover the message at that point, where on a mail filtering device you would have the abiliity to manually deliver said message. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!