Email Security with Cisco Secure Email Threat Defense

What it is

Email is the most common way into an organisation, and Cisco Secure Email Threat Defense is a cloud service that finds and removes malicious mail.

Traditional gateways inspect mail before it reaches the mailbox. Some threats still get through, or turn bad later. Secure Email Threat Defense looks at mail in the mailbox, scores it, and can remove it afterwards.

How it works

Combine sender authentication, filtering at the edge and detection and response in the mailbox.

Sender authentication

Three DNS based standards help receivers detect forged mail.

They are published as DNS text records. The examples show the shape of an SPF and a DMARC record.

example.com.         TXT  "v=spf1 ip4:203.0.113.0/24 -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine"

The SPF record lists the permitted sending addresses, and -all says to reject any others. The DMARC policy p=quarantine asks receivers to treat failures as suspicious, and p=reject asks them to refuse the mail. Start with p=none to monitor before you enforce.

Gateway filtering

A secure email gateway sits in the mail path and applies layers of control.

• Reputation filtering: blocks or limits mail from senders with a bad reputation.
• Anti-spam and anti-phishing: scores content, links and headers.
• Anti-malware and file analysis: scans attachments and can use a sandbox.
• URL protection: rewrites or checks links, and rechecks them when the user clicks.
• Data loss prevention and encryption: controls outbound sensitive content.

What the Threat Defense service adds

Secure Email Threat Defense is cloud native. In its API based deployment, it connects to a cloud mail platform such as Microsoft 365 through the platform programming interface, and it reads the messages in the mailbox. That model does not change the mail flow, so it adds no delay and needs no mail routing change.

It can work alongside a gateway, or on its own with a cloud mailbox service. The mail platform stays as it is, and the service adds a second opinion.

Detection methods

The service combines several kinds of analysis.

• Threat intelligence: reputation and data from Cisco Talos.
• Machine learning and language analysis: reads the text for signs of fraud or urgency.
• Sender and relationship analysis: looks at whether this sender normally contacts this recipient, which helps to find business email compromise.
• Link and attachment analysis: checks the destinations and files.

Business email compromise (BEC) is a fraud with no malware. An attacker pretends to be an executive or supplier and asks for a payment. Language and sender analysis are the main defence, because there is nothing to scan.

Verdicts and remediation

Each message gets a verdict, such as malicious, spam, graymail or neutral. Graymail is legitimate bulk mail that some users do not want, such as newsletters.

A key feature is remediation after delivery. If a message turns out to be bad, the service can move it out of the mailbox, for example to the junk folder or to quarantine. It can act on one message or on every copy of it that was delivered to many users.

Remediation can be automatic, according to the verdicts you choose, or manual, after an analyst reviews the message. Start with a conservative setting, review the results and then widen automation.

Visibility and investigation

The console shows message details, the verdict, the reasons for it and the actions taken. You can search by sender, subject, link or file. A search helps when a user reports a phishing mail, because you can find all copies of it, and remove them in one step.

Operating tips

Keep users in the loop with a report button, and feed reported mail into analysis. Review false positives quickly. Combine this with MFA and training, because email is only one part of the phishing defence.