FIPS Certification

Cisco Email Security Appliance will be FIPS certified and has integrated the following FIPS 140-2 approved cryptographic module: Cisco Common Crypto Module (FIPS 140-2 Cert. #1643).

See FIPS Management.

New Data Loss Prevention (DLP) solution

RSA has announced End of Life (EOL) for RSA Data Loss Prevention Suite. For more information, see https://community.rsa.com/docs/DOC-59316.

Cisco now provides an alternative DLP solution that allows seamless migration of all the existing DLP policies created in RSA DLP to the new DLP engine. After the upgrade, you can view or modify the migrated DLP policies in Mail Policies > DLP Policy Manager page in the web interface. For more information, see the “Data Loss Prevention” chapter in the user guide.

Support for Two-Factor Authentication

Cisco Email Security appliance now supports two-factor authentication that ensures secure access when you log into your appliance.

You can configure two-factor authentication for your appliance through any standard RADIUS server that complies with a standard RFC.

You can enable two-factor authentication in one of the following ways:

• System Administration > Users page in the web interface. See Distributing Administrative Tasks.

• userconfig > twofactorauth command in the CLI. See the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances .

If you have enabled two-factor authentication on your appliance, you can join it to a cluster machine using pre-shared keys. Use the clusterconfig > prepjoin command in the CLI to configure this setting.

See Centralized Management Using Clusters.

Handling incoming mail connections and incoming messages from different geographic locations

Cisco Email Security appliance can now handle incoming mail connections and incoming messages from specific geolocations and perform appropriate actions on them, for example:

• Prevent email threats coming from specific geographic regions.

• Allow or disallow emails coming from specific geographic regions.

You can use this feature in the following ways:

• SMTP Connection Level. You can now configure sender groups to handle incoming mail connections from specific geolocations using one of the following ways:

  • Mail Policies > HAT Overview > Add Sender Group > Submit and Add Senders > Geolocation option in the web interface.

  • listenerconfig > hostaccess > country command in the CLI .

  For more information, see "Defining Which Hosts Are Allowed to Connect Using the Host Access Table" or the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.

  You can use the Geo Distribution report to view the details of incoming mail connections from specific geolocations based on the sender's country of origin. For more information, see "Using Email Security Monitor".

• Content or Message Filter Level: You can now create a content or a message filter to handle incoming messages from specific geolocations and perform appropriate actions on such messages. Content and message filters include the following new options:

  • A new content filter condition - Geolocation

  • A new message filter rule - geolocation-rule().

  For more information, see Content Filters or Using Message Filters to Enforce Email Policies.

  You can use the Content Filters and Message Filters reports to view the details of incoming messages from specific geolocations that are detected by the content or message filter. See Using Email Security Monitor.

You can use Message Tracking to search for incoming messages from specific geolocations detected by the content or message filter. Use the Geolocation filter for the Message Event option in the Advanced section of Message Tracking.

The geolocation list of countries is cloud updateable.

Scanning Outgoing Messages using the AMP engine

You can now configure the appliance to scan outgoing messages using the AMP engine.

You can use this feature to:

• Prevent users from sending malicious messages from the organization’s network, which can lead to low IP or domain reputation.

• Track users who are sending outbound messages with malicious attachments and perform appropriate actions on them.

You can configure the outgoing mail policy of your appliance to allow scanning of messages by the AMP engine in one of the following ways:

• Mail Policies > Outgoing Mail Policies page in the web interface. See File Reputation Filtering and File Analysis.

• policyconfig command in the CLI.

The following reports have been enhanced to show details of outgoing messages scanned by the AMP engine:

• Advanced Malware Protection

• AMP File Analysis

• AMP Verdict Updates

• Overview Page

• Outgoing Destinations

• Outgoing Senders

• Internal Users

See Using Email Security Monitor

You can use the Mail Flow Direction filter in the Message Tracking > Message Event > Advanced Malware Protection option to search for incoming and outgoing messages that are scanned by the AMP engine.

Manually Rollback to a Previous Version of the Service Engine

You can now manually roll back to a previous version of the current engine when:

• The engine update is defective.

• The engine is not functioning properly.

Currently, you can perform an engine rollback for the following engines:

• McAfee

• Sophos

• Graymail

You can perform an engine rollback only at the machine level and not at the cluster level.

You can use the Security Services > Services Overview page in the web interface to perform:

• Rollback to a previous version of the service engine.

• Manually update the service engines to the required version.

For more information, see System Administration

Enable or Disable Automatic Updates

You can now enable or disable automatic updates in the Global Settings page of the following service engines:

• McAfee

• Sophos

• Graymail

You can now receive periodic alerts when automatic updates are disabled for a specific service engine. You can change the existing alert interval in one of the following ways:

• Security Services > Service Updates > Alert Interval for Disabled Automatic Engine Updates option in the web interface. See System Administration.

• updateconfig command in the CLI.

Performing additional actions on attachments detected by Advanced Malware Protection in Mail Policy

You can perform the following additional actions, if an attachment is considered ‘malicious’, ‘unscannable’, or ‘sent for file analysis’ in the Advanced Malware Protection section for Incoming or Outgoing Mail Policies:

• Modifying the message recipient.

• Sending the message to an alternate destination host.

For more information see, File Reputation Filtering and File Analysis.

Improved AMP Engine Logs

Information about the following scenarios are now logged in the AMP engine logs:

• File that is not uploaded to the File Analysis server.

• File that is skipped for file analysis because the appliance exceeded the daily file upload limit to the File Analysis server.

• File that is marked as unscannable.

Supported Archive File Formats for Content Scanning

The Content Scanner in your appliance can perform content scanning on the following archive file formats:

• ACE Archive

• ALZ Archive

• Apple Disk Image

• ARJ Archive

• bzip2 Archive

• EGG Archive

• GNU Zip

• ISO Disk Image

• Java Archive

• LZH

• Microsoft Cabinet Archive

• RAR Multi-Part File

• RedHat Package Manager Archive

• Roshal Archive (RAR)

• Unix AR Archive

• UNIX Compress Archive

• UNIX cpio

• UNIX Tar

• XZ Archive

• Zip Archive

• 7-Zip

Macro Detection Enhancement

You can now detect macros in the following files:

• Javascript macros in Adobe Acrobat Portable Document Format (PDF) files.

• Visual Basic for Applications (VBA) macros in Microsoft Office Files (Open XML) and OLE files.

For more information, see Content Filters or Using Message Filters to Enforce Email Policies.

CRL check for web interface login

You can configure CRL check for web interface login using one of the following ways:

• Network > CRL Sources > Edit Settings > CRL check for WebUI option in the web interface.

  See Authenticating SMTP Sessions Using Client Certificates

• certconfig > crl command in the CLI.

If you enable this option and the certificate is revoked:

• You will receive an alert indicating that the certificate is revoked.

• You will not be able to access the web interface of your appliance. However, you can still log in to your appliance using the CLI.

You must import and configure a valid certificate through the CLI to be able to access the web interface of your appliance. See CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.

Configuring cache expiry period for File Reputation disposition values.

You can configure the cache expiry period for File Reputation disposition values in one of the following ways:

• Security Services > File Reputation and Analysis > Cache Settings page in the web interface.

• ampconfig > cachesettings > modifytimeout command in the CLI.

See File Reputation Filtering and File Analysis.

New datacenter added in European region for File Reputation and File Analysis services

Cisco has added a new datacenter in the European region for the File Reputation and File Analysis services:

• EUROPE (cloud-sa.eu.amp.cisco.com) for File Reputation server

• EUROPE (https://panacea.threatgrid.eu) for File Analysis server

You can configure your Email Security appliance to use the new File Reputation and File Analysis services. For more information, see File Reputation Filtering and File Analysis.

Minimum Scores for Entity-based Rules of Custom Classifiers for Custom DLP Policies

You can now use the recommended minimum scores or choose to override the minimum score for entity-based rules, when you create custom classifiers for custom DLP policies.

You can use the minimum score for an entity-based rule instead of the configured weight of the rule. The minimum score differentiates the partial and the full matches, and calculates the score accordingly. This helps in reducing the number of false positives and false negatives.

To configure the minimum score:

1. Go to Mail Policies > DLP Policy Customizations > Custom Classifiers Settings section and select the Use recommended minimum scores for entity-based rules check box.

2. Go to Mail Policies > DLP Policy Customizations > Add Custom Classifier (or review an existing custom classifier) and enter the minimum score.

For more information, see the "Data Loss Prevention" chapter in the user guide.