BitDefender Security for...

BitDefender Security for Exchange Comprehensive Antimalware Protection for Exchange Servers

EVALUATOR’S GUIDE

BitDefender Security for Exchange – Evaluator’s Guide

2The content of this document is confidential and classified as BitDefender Proprietary Information.

Summary

1. Quick Summary 2. Solution Description

3. Main Benefits and Features

4. Services

5. Technology Leadership

6. System Requirements

7. Test Recommendations

7.1 Installation

7.2 Configuration and Important Settings

8 BitDefender Awards and Certifications 9 Contact Info



1. Quick Summary

BitDefender Security for Exchange TAG LINE Comprehensive antimalware protection for Exchange Servers

PLATFORMS Microsoft Exchange 5.5, 2000, 2003, 2007

DESCRIPTION BitDefender Security for Exchange provides antivirus, antispyware, antispam, antiphishing, attachment and content filtering, seamlessly integrated with the MS Exchange Server to create a malware-free messaging environment. It protects the mail traffic on Exchange servers from the latest, most sophisticated malware and against attempts to steal users’ confidential and valuable data.

AVAILABILITY April 4th, 2008 (English version)

LANGUAGES English (April 2008) Other languages to follow

LICENSE The license includes: Free technical support Automatic virus definitions updates Upgrade to any new version of the solution

BitDefender Security for Exchange - Dashboard



2. Solution Description

BitDefender Security for Exchange provides antivirus, antispyware, antispam, antiphishing, attachment and content filtering, seamlessly integrated with the MS Exchange Server to create a malware-free messaging environment. It protects the mail traffic on Exchange servers from the latest, most sophisticated malware and against attempts to steal users’ confidential and valuable data. Key features: - Fast and easy deployment - Intuitive interface - Proactive heuristic protection against zero-day threats - Multiple layers of antispam filtering - Content and attachment filtering - Antispyware and antiphishing protection - Centralized management software compatibility

BitDefender Security for Exchange - Dashboard



3. Main Benefits and Features

E-mail Protection against Malware

Fights e-mail-borne malware by filtering and blocking messages that carry a virus, spyware, trojan, backdoor or other potentially dangerous active codes

Scans e-mail messages at the point they enter/leave the server so that the messaging environment is free from malware at all times

Extends the malware protection span by keeping the external recipients of the filtered e-mail (customers, partners, friends) safe as well

Provides anti-phishing protection by proactively detecting forged messages intended to trick their recipients into disclosing confidential data

Matches each e-mail to a particular IP address so that messages with spoofed headers cannot pass the White List filter anymore

Increased Business Productivity

Reduces mail traffic and saves network resources due to its extensive antimalware protection capabilities

Through its optimized scanning process, increases mail delivery speed and reduces server workload

Improves your company’s productivity and prevents the loss* of confidential information by filtering all mail passing through the Exchange server based on:

content (subject line, sender, recipient) and attachment the criteria defined for the existing user groups

Provides a highly efficient, multi-layered antispam protection system which: Reduces mail traffic by accurately classifying messages as spam, phishing

or legitimate Blocks unsolicited mail based on several filters, among which:

connection filters such as the Allow/Deny IP List and Sender Black List the Bayesian Filter, which you can train to learn the specifics of the spam

received by your server the Real-time Blackhole List (RBL) filter, which identifies spam based on

mail servers’ reputation as spam senders Allows configuring antispam filter sensitivity by setting very demanding or

relaxed thresholds for each user group Automatically redirects spam to your Exchange Junk Folder**

Provides WBL (White List/ Blacklist) support, allowing you to set a list of trusted and untrusted addresses based on which to respectively “always accept” or “always reject” mail



Increased Usability

Allows you to filter mail traffic in a more flexible manner through the use of antivirus, antispam, content and attachment filtering policies for different groups or users

Generates detailed statistics and reports based on a comprehensive database related to the solution’s activity

Allows you to remotely configure server protection by simply installing the management console on one computer inside the network

Instantaneously sends detailed warning messages to the network security and management staff if a virus is detected

Can isolate dangerous or restricted mail going through the antivirus, antispam, content and attachment filtering modules in a quarantine zone where you can deal with it at will

BitDefender Security for Exchange Features Benefits Antivirus &

Antispyware Antispam Content

Filtering Reports and

statistics Group

Management

Protects e-mail traffic from malware and fraud X Reduces e-mail traffic and saves network and server resources

X X X

Increases business productivity X X X Increases usability X X

Centralized Management Support

BitDefender Management Server allows centrally managing most of the BitDefender business solutions installed on network computers, including BitDefender Security for Exchange (only Exchange 2007 is supported for centralized management). This type of integration allows you to use the Management Server console to get centralized access to: Configuration settings for BitDefender Security for Exchange Critical event information such as update-related events, configuration warnings,

license expiration Easy-to-interpret statistics and reports based on the information received from

BitDefender Security for Exchange

* Only applies to the Exchange 2007 environment

** Only applies to the Exchange 2003/2007 environments



4. Services Advanced Update System

For permanent mail protection, BitDefender Security for Exchange receives the latest updates and patches based on four configurable technologies: on-demand, scheduled, automatic and pushed.

Upgrades

Registered users benefit from free upgrades to any new version of the solution during the license period. Special pricing is always provided to our customers when they renew their license, making BitDefender a long-term, cost effective solution.

Free 24/7 Professional Technical Support Certified representatives provide BitDefender business customers with free

permanent support on-line, by telephone or e-mail. This is supplemented by an on-line database with answers to Frequently Asked Questions and fixes for common issues.

5. System Requirements

Software: Internet Explorer 6;

MS Exchange 2007

MS Exchange 2003, 2000+SP1;

MS Exchange 5.5 SP3 + Windows NT 4.0 SP6 + MMC v1.2 / Windows 2000 SP4.

Hardware: For Exchange 2007: any 64-bit Windows machine (Intel or AMD)

For other Exchange versions: PII 300MHz, HDD 200MB, RAM 256MB.



6. Technology Leadership

B-HAVE

All BitDefender business solutions include B-HAVE, a patent pending technology which analyzes the behavior of potentially malicious codes inside a virtual computer, eliminating false positives and significantly increasing detection rates for new and unknown malware.

Proactivity is a measure of how well an antivirus copes with new and previously-unknown threats. The chart below represents the percentage of threats detected exclusively based on their behavior (rather than on the traditional, virus signature method)

The test was performed by Anti-Malware Test Lab in January 2008

(http://www.anti-malware-test.com/?q=node/39)

NEUNET The new antispam filter available in BitDefender Total Security 2008 uses a Neural

Network (a concept borrowed from the field of Artificial Intelligence) to deal with the new spam messages sent every day. Its main advantage is that it can recognize new spam by perceiving similarities (oftentimes very subtle) between the new messages received and the ones it was trained on.

Image Spam Filter BitDefender offers a more accurate image filter which, instead of analyzing the text

within image spam messages, learns the common characteristics of those images in point of colour content and proportions. The result: less false positives and lower spam traffic.

http://www.anti-malware-test.com/?q=node/39



7. Test Recommendations

7.1. Installation 7.1.1. Install BitDefender Security for Exchange 2003/2000/5.5

Locate the setup file (BitDefender_Security_for_Windows_Servers_32bit.exe) and double-click it. This will launch a wizard which will guide you through the setup process. The setup file can install the following 32-bit Windows Server products:

BitDefender Security for File Servers BitDefender Security for Exchange (2003/2000/5.5) BitDefender Security for Mail Servers (Windows SMTP) BitDefender Security for ISA Servers (ISA 2006/2004/2000 Standard and

ISA 2006/2004 Enterprise) BitDefender Security for SharePoint (2003)

Before launching the setup wizard, BitDefender will check for newer versions of the installation package. If a newer version is available, you will be prompted to download it. Click Yes to download the newer version or No to continue installing the version then available in the setup file.

BitDefender will also check if BitDefender Security for Exchange is already installed on the local computer. If the same version as the one in the setup file is installed, you will have to modify the existing configuration. If an older version is installed, the installation process will continue as it should, with the only difference that the already installed products will be re-installed (upgraded) by default.

Follow the intuitive steps to install BitDefender Security for Exchange.

7.1.2. Install BitDefender Security for Exchange 2007

Locate the setup file (BitDefender_Security_for_Windows_Servers_64bit.exe) and double-click it. This will launch a wizard which will guide you through the setup process. The setup file can install the following 64-bit Windows Server products:

BitDefender Security for Exchange (2007) Before launching the setup wizard, BitDefender will check for newer versions

of the installation package. If a newer version is available, you will be prompted to download it. Click Yes to download the newer version or No to continue installing the version then available in the setup file.

BitDefender will also check if BitDefender Security for Exchange is already installed on the local computer. If the same version as the one in the setup file is installed, you will have to modify the existing configuration. If an older version is installed, the installation process will continue as it should, with the


10

The content of this document is confidential and classified as BitDefender Proprietary Information.

only difference that the already installed products will be re-installed (upgraded) by default.

The installer will automatically detect the Exchange 2007 server roles (edge, hub, mailbox) and it will install the corresponding files to protect those roles.

Follow the intuitive steps to install BitDefender Security for Exchange. 7.1.3. Install Management Server support

To allow the deployment and management of the BitDefender for Windows Servers products from BitDefender Management Server you have to add the support files for the BitDefender for Windows Server products in the BitDefender Management Server. On the BitDefender Management Server machine, locate the BitDefender for Windows Servers Server Add-on setup file and double click it. This will launch a wizard which will guide you through the setup process.

If BitDefender Management Server is installed on a 32-bit machine, locate BitDefender_for_Windows_Servers_Server_Addon(for_32_bit_Management_Servers)_en.exe file.

If BitDefender Management Server is installed on a 64-bit machine, locate BitDefender_for_Windows_Servers_Server_Addon(for_64_bit_Management_Servers)_en.exe file.

You only need to install the server add-on once, then you can deploy the BitDefender Windows Server products

7.2. Configuration and Important Settings

7.2.1. Getting Started

BitDefender Security for Exchange can be configured and managed through a

centralized, MMC-based management console. The management console provides access to all features and settings of BitDefender Security for Exchange.

To access the management console, use the Windows Start menu, by following the path Start → Programs → BitDefender Security for Exchange → BitDefender Security for Exchange.


1

Management Console

On the left side of the management console you can see the tree menu: Monitoring - displays the dashboard. The dashboard provides you with useful

information on the status of BitDefender Security for Exchange and helps you easily solve the issues that require your attention. The dashboard is only available for Exchange 2007. A status module will be displayed for Exchange 2003/2000.

Statistics & Reports - offers complete information on the solution’s activity. You can analyze detailed statistics and create customized reports on the solution’s activity.

Alerts & Logs - allows configuring file logging and sending alerts concerning certain events, such as an update error or an infected file detected.

Quarantine - stores detected files, grouped into four categories (Antivirus, Antispam, Content Filtering, Attachment Filtering).

Groups SMTP Groups provides user group management for the modules that scan

traffic at SMTP level: Antispam, Content and Attachment Filtering. In addition to that, Exchange 2007 servers that have an Edge Transport or a Hub Transport role also allow group management for the Antivirus module.

Exchange Groups provides user group management at mailbox level, for VSAPI Exchange 2003/2000 antivirus scanning



12


Antivirus - this is where you can configure the Antivirus module. Antispam - this is where you can configure the Antispam module. Content Filtering - this is where you can configure the Content Filtering module. Attachment Filtering - this is where you can configure the Attachment Filtering

module. Update - this is where you can configure the Update module.

Product Update - this is where you can check if upgrades are available and install them.

Information - provides access to the following sections: Report Incidents - allows configuring BitDefender to automatically report

operation malfunctions to the BitDefender Lab. Virus Report - allows configuring BitDefender to automatically report found

viruses to the BitDefender Lab. If you want to open the help file, click Help -> About BitDefender Security for

Exchange. Contextual help is available for each window. Click ? to open it.

7.2.2. Remote connection You can connect to the management console of a BitDefender Security for

Exchange product installed on a remote server. Right-click BitDefender Security for Exchange to open the contextual menu. Connect to another computer - opens a window where you can specify the name or

the IP of the server to which you want to remotely connect and the administrative password of the product that you want to manage.

Change administrative password - opens a window where you can specify the administrative password to BitDefender Security for Exchange. This password will be used when connecting to this interface remotely.

7.2.3. Import/export settings You can export the management console settings to restore them at a future time or

replicate them on a different server. Right-click BitDefender Security for Exchange to open the contextual menu.

Import console settings - imports previously saved console settings. Export console settings - exports the console settings to a txt file.

7.2.4. Dashboard

The monitoring section is a summary page referred to as the dashboard. The dashboard provides you with useful information on the status of BitDefender Security for Exchange and it helps you easily solve the issues that require your


13


attention. You should check the dashboard frequently in order to quickly identify and solve the issues affecting the security of the Exchange server.

The status buttons can be displayed in green, grey or red, depending on the existing issues that affect the security of the Exchange server:

Green indicates that no issue requires your attention. Grey indicates the existence of issues that pose medium security risks.

These issues do not require your immediate attention, but you should check them as soon as possible.

Red indicates the existence of critical security issues, which require your immediate attention.

The Details area of the issues section contains three tables, one for each status button. Each table displays the monitored items and their current status. When there is an issue concerning one of the monitored items, a red Fix link is displayed, allowing you to quickly solve the respective issues.

7.2.5. Antivirus

The Antivirus module offers protection against viruses and spyware. It detects infected or suspect messages and it attempts to disinfect them or isolates the infection, according to the specified actions.

The module contains three sections: Real-time Antivirus Protection - allows you to enable real-time antivirus

protection and to configure the advanced settings of the Antivirus module. Policies - allows you to configure the scanning options of all mail traffic and

to specify different scanning policies based on the groups the sender and the recipients belong to. Under Exchange 2007 this option is only available if the respective servers have an Edge / Hub Transport role.

Scan - allows you to configure and initiate the on-demand scanning of the Exchange databases (mailboxes and public folders).

7.2.6. Antispam

The Antispam module offers protection against spam, phishing and other attacks. It uses a combination of various filters and engines to determine whether messages are spam or not and to check them for patterns of spam. Antispam Filtering is only available for Exchange 2007 servers that have an Edge Transport or Hub Transport role.

Based on the groups the sender and the recipients belong to, you can specify various actions to be taken on spam.

This module contains two sections: Antispam Filtering - allows you to enable antispam filtering and to configure

the global antispam filters.


14


Policies - allows you to configure the filtering options for all mail traffic and to specify different filtering policies based on the groups the sender and the recipients belong to.

7.2.7. Content Filtering

The Content Filtering module filters the content of messages based on certain expressions found in the mail headers (subject, from, to, cc). Content Filtering is only available for Exchange 2007 servers that have an Edge Transport or a Hub Transport role.

Based on the groups the sender and the recipients belong to, you can specify various filtering options and actions to be taken on the detected messages.

The module contains two sections: Content Filtering - allows you to enable the content filtering. Policies - allows you to configure the filtering options for all mail traffic and to

specify different filtering policies based on the groups the sender and the recipients belong to.

7.2.8. Attachment Filtering

The Attachment Filtering module provides filtering features for mail attachments. It

can detect attachments with certain name patterns, of a certain type or exceeding a certain size limit. Attachment Filtering is only available for Exchange 2007 servers that have an Edge Transport or a Hub Transport role.

Based on the groups the sender and the recipients belong to, you can specify various filtering options and actions to be taken on the detected attachments.

The module contains two sections: Attachment Filtering - allows you to enable attachment filtering. Policies - allows you to configure the filtering options for all of the mail traffic

and to specify different filtering policies based on the groups the sender and the recipients belong to.

7.2.9. Update

New viruses and spyware are found and identified every day. This is why it is very

important to keep BitDefender up to date with the latest signatures. By default, BitDefender automatically checks for updates every hour.

Updates can be classified as follows: Antivirus updates - as new threats appear, the files containing virus and

spyware signatures, as well as the antivirus engine, are updated to ensure permanent up-to-date protection against them.

Antispam updates - new rules are added to the NeuNet (heuristic) and Pre-trained Bayesian filters, new links are added to the URL filter database and


15


new images are added to the Image filter. This helps increase the effectiveness of the Antispam engine.

Product updates - when a new product version is released, new features and scan techniques are introduced to the effect of improving the solution’s performance.

7.2.10. Configuration Steps

In order to ensure a virus-free e-mail traffic, follow these steps:

1. Register the solution. If you are using an Exchange 2003/2000/5.5 server, access the Information module, Register section. Type the license key in the key edit control and click OK. If you are using an Exchange 2007 server, access the Monitoring Module and click the Register link to start the registration wizard.

2. Activate your BitDefender account. In order to benefit from free technical support and other free BitDefender services, access the Monitoring section and then click the My account link.

3. Apply available Product Updates. Access the Update module, Product Update section, and install the product updates, if any.

4. Configure the update. Access the Update module, Update and Settings sections. Set the update interval and the update location and click Apply. Click Update now to make sure you have the latest virus signatures.

Note: If you do not want the update process to interfere with the server activity you have the possibility to schedule the update process. Access the Scheduled Tasks module, right-click this section and select New task. Complete the wizard that appears, configuring the appropriate settings, in order to create a scheduled update task.

5. Configure the real-time protection. Access the Antivirus module and configure real-time scanning. Choose the actions to be taken on infected and suspect files.

6. Configure the antispam scanner. Access the Antispam module and configure the antispam scanning. Choose the actions to be taken on the e-mail found to be spam. You can also configure the global filters so that they will stop spam before it enters the mail server.

7. Test your BitDefender. Use the EICAR test to check whether BitDefender antivirus is working. The test consists of creating a file using a text editor, provided the file is saved in standard MS-DOS ASCII format and that it is 68 bytes long. It can also be 70 bytes if the editor adds a CR/LF at the end. This file must contain the following single line:


16


X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*. Save the file under any name and .COM extension, for example EICAR.COM. BitDefender must treat this file as an infected one. You can visit the EICAR website at http://eicar.com, read the documentation and download the file from one of the locations on the following web page: http://eicar.com/anti_virus_test_file.htm. Use the GTUBE test to check whether BitDefender antispam is working. The test consists of entering the following 68-byte string, as one line, in the body of the e-mail: XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X When scanning the e-mail, BitDefender must tag it as spam. You can visit the GTUBE website at http://gtube.net/, read the documentation and download the sample RFC-822 format e-mail from the locations on the web page.

8. Perform a manual scan of the Exchange server. Access the Antivirus module and configure the On-demand Scanner. Click the Scan now button from the configuration window to start the manual scan.

9. Configure BitDefender alerts. If a virus is detected or an unexpected situation appears, it is possible for alarm messages to be sent by e-mail or to be entered in the BitDefender log file or System Log. Access the Alerts module and configure BitDefender to send these notifications.

10. Check the product dashboard. Go to the Monitoring section to check if all alerts are green. If not, you should fix the existing issues by using the Fix all button.


1

8. BitDefender Awards and Certifications

BitDefender solutions consistently earn top marks from independent testing organizations and are recognized by top industry publications.

9. Contact Info

Main site: www.bitdefender.com Sales department: [email protected] On-line Store www.bitdefender.com/site/Buy/products/ Find a distributor: www.bitdefender.com/site/Partnership/list/ Technical support: [email protected] http://kb.bitdefender.com

BITDEFENDER LLC: 6301 NW 5th Way Suite 3500 Fort Lauderdale, FL 33309 phone: 954.776.6262, 800.388.8062 fax: 954.776.6462, 800.388.8064


http://www.bitdefender.com/

mailto:[email protected]

http://www.bitdefender.com/site/Buy/products/

http://www.bitdefender.com/site/Partnership/list/

mailto:[email protected]%20m

http://kb.bitdefender.com/

BitDefender Security for...

Documents

Transcript of BitDefender Security for...