Mitigation Technologies for E-mail-Based and Web-Based Threats

Efficient e-mail-based and web-based security requires a robust solution that is expanded beyond the traditional perimeter, as new threats are emerging on a daily basis. The Cisco E-mail Security Appliances (ESA) and the Cisco Web Security Appliance (WSA) provide a great solution designed to protect corporate users against these threats. Cisco has added advanced malware protection (AMP) to the ESA and WSA to allow security administrators to detect and block malware and perform continuous analysis and retrospective alerting. Both the ESA and WSA use cloud-based security intelligence to allow protection before, during, and after an attack. This chapter covers these technologies and solutions in detail. You will learn mitigation technologies such as spam and antimalware filtering, data loss prevention (DLP), blacklisting, e-mail encryption, and web application filtering.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz helps you determine your level of knowledge of this chapter’s topics before you begin. Table 18-1 details the major topics discussed in this chapter and their corresponding quiz questions.

Table 18-1 “Do I Know This Already?” Section-to-Question Mapping

1. Which of the following features does the Cisco ESA provide? (Choose all that apply.)

   1. Network antivirus capabilities
   2. E-mail encryption
   3. Threat outbreak prevention
   4. Support for remote access SSL VPN connections

2. Which of the following Cisco ESA models are designed for mid-sized organizations? (Choose all that apply.)

   1. Cisco C380
   2. Cisco C670
   3. Cisco C680
   4. Cisco X1070

3. What is a spear phishing attack?

   1. Unsolicited e-mails sent to an attacker.
   2. A denial-of-service (DoS) attack against an e-mail server.
   3. E-mails that are directed to specific individuals or organizations. An attacker may obtain information about the targeted individual or organization from social media sites and other sources.
   4. Spam e-mails sent to numerous victims with the purpose of making money.

4. Which of the following e-mail authentication mechanisms are supported by the Cisco ESA? (Choose all that apply.)

   1. Sender Policy Framework (SPF)
   2. Sender ID Framework (SIDF)
   3. DomainKeys Identified Mail (DKIM)
   4. DomainKeys Mail Protection (DMP)

5. Which of the following is the operating system used by the Cisco WSA ?

   1. Cisco AsyncOS operating system
   2. Cisco IOS-XR Software
   3. Cisco IOS-XE Software
   4. Cisco IOS Software
   5. Cisco ASA Software

6. Which of the following connectors are supported by the Cisco CWS service? (Choose all that apply.)

   1. Cisco Security Manager (CSM)
   2. Cisco ASA
   3. Cisco ISR G2 routers
   4. Cisco AnyConnect Secure Mobility Client
   5. Cisco WSA

7. Which of the following features are supported by the Cisco WSA? (Choose all that apply.)

   1. File reputation
   2. File sandboxing
   3. Layer 4 traffic monitor
   4. Real-time e-mail scanning
   5. Third-party DLP integration

8. Cisco WSA can be deployed using the Web Cache Communication Protocol (WCCP) configured in which of the following modes? (Choose all that apply.)

   1. Multiple context mode
   2. Explicit proxy mode
   3. Transparent proxy mode
   4. Virtualized mode