24 Hours of Exchange Server 2007 (Part 13 of 24): Maintaining Anti-Spam Systems Harold Wong [email_address] blogs.technet.com/haroldwong Audio: please try Streaming Internet Audio first If that doesn’t work, use: (800) 618-7506: Pin 5800

What We Will Cover Understanding anti-spam functionality Deploying a defense-in-depth approach Configuring the anti-spam components

Understanding anti-spam functionality

Deploying a defense-in-depth approach

Configuring the anti-spam components

Agenda Review Introduction to Anti-Spam Management Understanding Individual Components

Review

Introduction to Anti-Spam Management

Understanding Individual Components

Deploying the Edge Transport Server Message journaling requirements Malicious software scanning approaches Message storage requirements Message processing throughput Which of the following is not a key consideration when planning for an Edge Transport server?

Message journaling requirements

Malicious software scanning approaches

Message storage requirements

Message processing throughput

Deploying the Edge Transport Server SMTP Port 25 LDAP Port 50636 RDP Port 3389 All of the above When securing the Edge Transport server, what ports should be open on the Internet facing network adapter?

SMTP Port 25

LDAP Port 50636

RDP Port 3389

All of the above

Deploying the Edge Transport Server SMTP Port 25 LDAP Port 50636 RDP Port 3389 All of the above When securing the Edge Transport server, what ports should be open on the Corporate facing network adapter?

SMTP Port 25

LDAP Port 50636

RDP Port 3389

All of the above

Configuring Internet Message Delivery Active Directory Exchange mailbox database Exchange storage group Active Directory Application Mode (ADAM) Where is the recipient and configuration data stored for Exchange Server 2007?

Active Directory

Exchange mailbox database

Exchange storage group

Active Directory Application Mode (ADAM)

Configuring Internet Message Delivery Connection filtering Sender filtering Recipient filtering Content filtering Which of the following examines the remote IP address of an inbound message to filter spam attacks?

Connection filtering

Sender filtering

Recipient filtering

Content filtering

Configuring Internet Message Delivery Connection filtering Sender filtering Content filtering All of the above Which of the following uses Microsoft SmartScreen ® technology with the Intelligent Message Filter?

Connection filtering

Sender filtering

Content filtering

All of the above

Agenda Review Introduction to Anti-Spam Management Understanding Individual Components

Review

Introduction to Anti-Spam Management

Understanding Individual Components

Exchange Server 2007 Anti-Spam Functionality Connection filtering Sender filtering Recipient filtering Sender ID filtering Content filtering Sender reputation filtering Attachment filtering Outlook junk e-mail filtering

Anti-Spam Mail Flow Connection filtering Sender and recipient filtering Sender ID filtering Content filtering Outlook junk e-mail filtering

The Defense-in-Depth Approach Perimeter Firewall Edge Transport Server Interior Firewall Hub Transport Server Mailbox Server Client Access Server Outlook E-mail Filtering

Introduction to Anti-Spam Management Sender reputation filtering Recipient ID filtering Attachment filtering Connection filtering Q1: Which of the following is not a type of Exchange Server 2007 anti-spam filtering?

Sender reputation filtering

Recipient ID filtering

Attachment filtering

Connection filtering

Introduction to Anti-Spam Management Connection filtering Sender ID filtering Content filtering Outlook junk e-mail filtering Q2: Which anti-spam filtering feature includes the spam quarantine?

Connection filtering

Sender ID filtering

Content filtering

Outlook junk e-mail filtering

Introduction to Anti-Spam Management Perimeter firewall Edge Transport server Internal firewall Connection filtering Q3: What is considered the first line of defense against spam attacks?

Perimeter firewall

Edge Transport server

Internal firewall

Connection filtering

Agenda Review Introduction to Anti-Spam Management Understanding Individual Components

Review

Introduction to Anti-Spam Management

Understanding Individual Components

Connection Filtering Yes Yes No Yes Yes IP allow list IP block list Safe provider list RBL No No No

Sender and Recipient Filtering Delete message Reject via SMTP Yes Yes On sender filter list On recipient block list No No

Sender ID Filtering Delete message Filter message No Yes No From blocked domain Allow sender ID failed On blocked sender list Yes No Yes Query SPF on sender’s DNS DNS

Content Filtering Delete message Reject via SMTP Send to spam quarantine mailbox Microsoft update No No Yes Yes SCL exceeds deletion SCL exceeds rejection No Apply content filter Assign SCL rating Yes SCL exceeds quarantine Safelist Aggregation

Configuring Anti-Spam Filters Configure connection filtering Configure sender and recipient filtering Configure sender ID filtering demonstration

Configuring Anti-Spam Filters

Configure connection filtering

Configure sender and recipient filtering

Configure sender ID filtering

Exchange Server Hosted Filtering Illegitimate senders Spam quarantine Directory service Exchange hosted filtering

Other Strategies and Techniques Sender reputation filtering Attachment filtering Spam quarantine Outlook junk e-mail filtering

Enabling Hub Transport Filtering Set the Hub Transport to receive e-mail Set the Hub Transport to manage spam demonstration

Enabling Hub Transport Filtering

Set the Hub Transport to receive e-mail

Set the Hub Transport to manage spam

Understanding Individual Components IP Allow List Safe Provider List Real-time Block List Spam Quarantine List Q1: Which of the following is not a feature of connection filtering?

IP Allow List

Safe Provider List

Real-time Block List

Spam Quarantine List

Understanding Individual Components Connection filtering Sender filtering Sender ID filtering Sender reputation filtering Q2: Which of the following filters do not query outside servers or services?

Connection filtering

Sender filtering

Sender ID filtering

Sender reputation filtering

Understanding Individual Components Sender filtering Sender ID filtering Content filtering Sender reputation filtering Q3: Which of the following component level filtering includes safelist aggregation?

Sender filtering

Sender ID filtering

Content filtering

Sender reputation filtering

Session Summary Understanding anti-spam functionality Fighting spam with defense-in-depth Understanding the eight anti-spam filters

Understanding anti-spam functionality

Fighting spam with defense-in-depth

Understanding the eight anti-spam filters

Questions and Answers Submit text questions using the “Ask” button. Don’t forget to fill out the survey. For upcoming and previously live webcasts: www.microsoft.com/webcasts Got webcast content ideas? Contact us at: http://go.microsoft.com/fwlink/?LinkId=41781 Today's webcast was presented using Microsoft ® Office Live Meeting. Get a free 14-day trial by visiting: www.microsoft.com/presentlive

Submit text questions using the “Ask” button.

Don’t forget to fill out the survey.

For upcoming and previously live webcasts: www.microsoft.com/webcasts

Got webcast content ideas? Contact us at: http://go.microsoft.com/fwlink/?LinkId=41781

Today's webcast was presented using Microsoft ® Office Live Meeting. Get a free 14-day trial by visiting: www.microsoft.com/presentlive