Email Attachment Filtering & Sandboxing

Cybercriminals are profit-driven businesses that focus their resources on techniques and tools that deliver the greatest return on investment. Small to medium enterprises are often seen as easier targets because they are generally protected by less sophisticated software or in some cases not protected at all. Unfortunately, attackers have worked this out and realize that targeting a smaller enterprise can actually mean an easier path to reward in the end.

Spambrella takes a unique approach to threat detection and email security by taking advantage of our enterprise-class Targeted Attack Protection analysis techniques and a cloud-based architecture to identify and block suspicious messages. This helps organizations further protect their end-users by adding additional layers of security that cannot be matched by traditional email security solutions and gateways.

Targeted Attack Protection (TAP)

Spambrella leverages the advanced power of Targeted Attack Protection from Proofpoint’s industry-leading email analysis solution in order to provide enterprise-level protection to effectively detect malicious attachments.

Advanced Malware Detection Attachment Defense uses the visibility and intelligence gathered from analyzing the email of many of the largest companies in the world and applies this to smaller enterprises. This gives small to medium-sized organizations an advantage of scale and security utilizing the capabilities of Spambrella, without having to dedicate resources to managing the system manually.

The email attachment filtering capability within Spambrella leverages dynamic sandbox technology that powers the Spambrella Targeted Attack Protection solution. Intelligence gathered by the dynamic malware analysis is used to identify and block malicious attachments that are designed to evade traditional security solutions. These attachments, such as Microsoft Office documents, are often used in spear-phishing attacks, to deliver banking Trojans, ransomware, or other malware. Spambrella ensures all aspects of email attachment filtering meets the security, availability, and resiliency needs of the smaller enterprise.

Email attachment filtering is a security measure implemented by organizations to scan and control the types of attachments that are allowed to pass through their email systems. It involves inspecting email attachments for potential threats such as malware, viruses, ransomware, or other malicious content before they reach the recipient’s inbox. Here’s how email attachment filtering works and its key components:

Content Inspection: Spambrella email attachment filtering solutions analyze the content of attached files to identify potential threats or security risks. This includes scanning attachments for known malware signatures, suspicious file types, and other indicators of malicious intent.

File Type Detection: Our attachment filtering solutions can identify and filter specific file types based on predefined policies or rules set by the organization. Commonly blocked file types include executable files (.exe), script files (.js, .vbs), and certain document formats that may contain macros or embedded scripts.

Malware Detection: Attachment filtering, antivirus, and anti-malware engines run in our core protection layer to detect and quarantine attachments containing malicious code or malware payloads. These engines compare attachment files against signature databases, heuristic analysis, and behavioral detection techniques to identify known and unknown threats.

Sandboxing: As an advanced attachment filtering solution, Spambrella incorporates sandboxing technology to analyze suspicious attachments in a controlled, isolated environment. By executing attachments in a sandbox environment, organizations can observe their behavior and assess potential security risks without exposing their systems to harm.

Content Filtering Policies: Organizations can define content filtering policies to specify which types of attachments are allowed, blocked, or quarantined based on their security requirements and risk tolerance levels. The Spambrella content filtering policies may be configured to block executable files, password-protected archives, or attachments exceeding a certain size limit. Spambrella’s account management team will also work with organizations to determine geographic trade regions and will enforce policies to restrict email from zones out of scope. See here.

Data Loss Prevention (DLP): Spambrella prevents the unauthorized transmission of sensitive or confidential information via email attachments. DLP policies can be used to identify and block attachments containing sensitive data such as financial information, Personally Identifiable Information (PII), or intellectual property. The service is also capable of enforcing strict rules, to notify internal mailboxes, send notifications or encrypt the outbound email on the fly.

Policy Enforcement: Spambrella enforces email security policies defined by the organization, including rules for acceptable attachment types, maximum attachment sizes, and attachment scanning requirements. Policy enforcement ensures consistent application of attachment filtering rules across the organization’s email infrastructure.

Quarantine and Remediation: Detected threats or suspicious attachments are quarantined or blocked by attachment filtering safeguards to prevent them from reaching end users’ inboxes. Security administrators can review the quarantined attachments, investigate security incidents, and take remediation actions such as deleting or releasing quarantined items.

Email attachment filtering is an essential component of email security strategies, helping organizations mitigate the risk of malware infections, data breaches, and other email-based threats by inspecting and controlling the types of attachments allowed in email communications.

Key Benefit

Cloud scale, visibility, and elasticity for malware analysis and sandboxing with global and immediate benefit to all organizations for emerging campaigns, with proprietary technology to defeat malware through counter-evasion techniques.