Configuration Guide For Surfcontrol E-Mail Filter and Blackberry Enterprise Server

Configuration Guide
For
SurfControl E-mail Filter
And
BlackBerry Enterprise Server
1
SurfControl plc. All rights reserved. SurfControl is a registered trademark of SurfControl plc. SurfControl E-mail Filter, SurfControl Web Filter, SurfControl Instant Message Filter, Virtual Control Agent, Anti-Spam Agent, Anti-Virus, Agent, Virtual Learning
Agent, Virtual Image Agent, and LexiMatch are trademarks of SurfControl plc. All other trademarks are the property of their respective owners.
Table of Contents
TABLE OF CONTENTS ......................................................................................................2
INTRODUCTION .................................................................................................................3
WHAT IS SURFCONTROL E-MAIL FILTER? ....................................................................3
WHAT IS BLACKBERRY ENTERPRISE SERVER?..........................................................4
SETTING UP SURFCONTROL E-MAIL FILTER AND BLACKBERRY ENTERPRISE

SERVER..............................................................................................................................4
Typical Joint Configuration ........................................................................................................................................... 4
How does E-mail flow?.............................................................................................................................................. 5
INSTALLING SURFCONTROL E-MAIL FILTER ................................................................5

Monitoring E-mail Activity............................................................................................................................................ 6
Rules Service.............................................................................................................................................................. 7
Pre-Configured Rules................................................................................................................................................. 7
Setting Up Rules, in General...................................................................................................................................... 8
Adding SurfControl E-mail Filter to your BlackBerry Enterprise Server Environment ................................................ 9
SYSTEM REQUIREMENTS FOR SURFCONTROL E-MAIL FILTER ................................9
INSTALLING BLACKBERRY ENTERPRISE SERVER....................................................10

Pre-Installation Steps ................................................................................................................................................... 10
Defining Service Accounts and Permissions............................................................................................................ 10
Installing and registering CDO.dll ........................................................................................................................... 10
Creating MAPI Profile ............................................................................................................................................. 10
Installing Database Software.................................................................................................................................... 11
Post-installation procedures ......................................................................................................................................... 11
SYSTEM REQUIREMENTS FOR BLACKBERRY ENTERPRISE SERVER ....................11

BlackBerry Enterprise Server 3.6 for Microsoft Exchange.......................................................................................... 11
BlackBerry Enterprise Server 2.2.1 for Lotus Domino ................................................................................................ 11
USER EXPECTATIONS AND TIPS ..................................................................................13

Additional E-mail Accounts on the Handheld.............................................................................................................. 13
BlackBerry IT Policies................................................................................................................................................. 13
Defining SurfControl Rules ......................................................................................................................................... 13
Additional Layers of Protection ............................................................................................................................... 14
REVIEW ............................................................................................................................15
2
Introduction
SurfControl E-mail Filter is a solution that adds value to the BlackBerry Enterprise Server.
BlackBerry Enterprise Server software tightly integrates with Microsoft Exchange or
Lotus Domino and works with existing enterprise systems, enabling push-based,
secure access to wireless e-mail and other corporate data. The addition of the SurfControl
E-mail Filter improves the security and productivity of the network and BlackBerry Users.
This guide outlines the configuration of SurfControl E-mail Filter in conjunction with
BlackBerry Enterprise Server, for effective e-mail management, to prevent unwanted
content being delivered to the BlackBerry Handheld device.
What is SurfControl E-mail Filter?

SurfControl E-mail Filter manages employee use of corporate e-mail and implements and
enforces a company-specific, e-mail Acceptable Usage Policy (AUP). Four product add-
ons to SurfControl E-mail Filter offer further e-mail protection against e-mails and other
security threats:
Anti-Spam Agent contains digital signatures of known Spam e-mails. It can detect
non-text based Spam. It is updated daily.
Anti-Virus Agent provides an extra layer of protection against potentially damaging

viruses.
Virtual Learning Agent helps protect intellectual property and confidential information
leakage.
Virtual Image Agent identifies inappropriate images within e-mails.

SurfControls Adaptive Reasoning Technology, which utilizes neural network and artificial
intelligence technologies, is a useful tool to understand e-mail information flow and obtain
comprehensive content filtering for a given organization.
SurfControl E-mail Filter offers secure, remote management capabilities that puts e-mail
content review into the hands of designated, appropriate managers. It, thereby, provides
flexible filtering access anywhere at anytime.
SurfControl E-mail Filter offers a secure way for a company to protect its critical
information, network and resources from internal and external threats. Using SurfControl
E-mail Filters extensive management options, such as powerful file detection, enhanced
content scanning and customizable reports, organizations can add the necessary layer of
protection to close the loopholes against virus outbreaks and confidential data loss.
3
What is BlackBerry Enterprise Server?
BlackBerry Enterprise Server software tightly integrates with Microsoft Exchange or
Lotus Domino and works with existing enterprise systems, enabling push-based,
secure access to wireless e-mail and other corporate data. BlackBerry Enterprise Server is
designed so that mobile professionals stay in touch with seamless and effortless access to
information and communications and at the same time, the IT departments are provided
with a secure, manageable solution that leverages their information systems infrastructure
and investment.
Setting up SurfControl E-mail Filter and BlackBerry Enterprise Server
Typical Joint Configuration

SurfControl E-mail Filter for SMTP is server-based software that should be placed
between the Internet gateway and the organizations SMTP mail server. SurfControl E-
mail Filter can run on the same machine as the Mail Transfer Agent (MTA) only if the MTA
is on a Windows 2000 Server. However, many security experts agree that there are
advantages to installing your mail filter on a separate server.
The BlackBerry Enterprise Server runs as a Windows NT/2000 service that can monitor
many users at once using a single administrative connection to the Microsoft Exchange
Server. The BlackBerry Enterprise Server maintains a direct TCP/IP connection (Server
Relay Protocol or SRP) to the wireless network. This mode of connection requires that the
administrator configures the corporate firewall to enable the BlackBerry Enterprise Server
to have an outbound connection on port 3101.
4
How does E-mail flow?
The path which e-mail travels through the system is very simple. Mail is first passed
through SurfControl E-mail filter and and continues to the Exchange server. Blackberry
Enterprise Server retrieves a copy of the message, compresses and encrypts it and sends
it via the Internet to the wireless network. The outgoing message is in an unreadable
format, which can only be decrypted at the handheld device.
The path from the handheld to BlackBerry Enterprise Server follows the same steps, only
in reverse. When a message is composed on the handheld, it is compressed, encrypted
and delivered back to BlackBerry Enterprise server over the Internet from the wireless
network. The Blackberry Enterprise Server decrypts and decompresses the message and
passes it to the Exchange server. E-mail messages are then routed to SurfControl E-mail
Filter for scanning. There is no difference between an E-mail sent from the handheld and
the E-mail that is sent from Outlook. They both originate from the users Corporate E-mail
address and a copy is placed in the users Sent Items folder at the Exchange server.
Installing SurfControl E-mail Filter
SurfControl E-mail filter can be installed as a stand-alone gateway, which can be used
with any Mail Transfer Agent (MTA) including MS Exchange 2000, Lotus Domino and send
mail. A specific integrated version is available for MS Exchange 5.5 and 2000.
A user must install SurfControl E-mail Filter with System Administrator privileges to the
corporate mail server. SurfControl E-mail Filter installs from a CD and uses the industry
standard InstallShield program. Two install options are available: the first is a complete
install for the server (this includes client components) and the second is a client-only
install. At least one complete install must happen for the service to function.
Installation follows the normal Windows practice of offering default options for location of
install, program groups, etc., which can be changed by the user. While the install is very
simple, there are a limited number of dialogs to which the installer needs to respond to
configure connection to the e-mail server, domain name, route, etc.
The difference between the evaluation software and the complete registered product is the
Anti-Spam Agent and the Anti-Virus Agent in the product. Evaluation software uses a
copy of the database that was frozen at the time the software itself was released.
Registered users of the software get regularly and automatically scheduled updates of the
Anti-Spam Agent through their subscription updates.
After installing SurfControl E-mail Filter and restarting the machine, the SurfControl E-mail
services will immediately start and begin relaying outgoing and incoming SMTP mail
traffic. All default rules are deactivated at installation.
5
Monitoring E-mail Activity
SurfControl recommends that companies monitor e-mail traffic before implementing an
Acceptable Usage Policy using SurfControl E-mail Filter. Using the information gained
from the Real Time Monitor and Reports, the Administrator can develop policy rules that
reflect the activity that is actually occurring on the network.
Once installed, SurfControl E-mail Filter can relay SMTP mail traffic. The SMTP database
will start recording users activity as they send and receive e-mails.
6
Rules Service
When a new e-mail arrives at the SurfControl E-mail Filters Receive Service, the Rules
Service processes it. Rules, which can be edited and enabled within the Rules
Administrator, will determine how the Rules Service processes the e-mail. There are
numerous combinations of rules that can be configured, where all rules are defined by the
use and interrelation of the Rules Objects. Five categories of Rules Objects are available:
1. Who Object: enables to apply a rule to specific users or group of users. Unless the
Who Objects is used, a rule will apply to message destinations inbound and
outbound.
2. What Object: helps to specify the feature of the message that the rule inspects, e.g.,
the size of the message, or the number of recipients.
3. Operations Object: changes the message content, either a message or part (s) of a
message, such as the message header or attachments.
4. Notify Object: provides the feature to send a message to a particular party, when a
rule is triggered.
5. Actions Objects: determine the action that takes place, when a rule is triggered.
Actions are relay, isolate, delete, or continue to process.
Pre-Configured Rules
Pre-configured rules can be activated on an as-needed basis. Enable/Disable Rules is
also used to temporarily deactivate a rule without having to delete it. This functionality
allows setting a content scanning rule for a specified content type that may need to be
suspended for a temporary period. Rules are disabled or enabled by activating and
deactivating the check box next to the rule name and description.
SurfControl E-mail Filter is shipped with pre-defined rules listed in the Rules pane at the
top of the screen. These rules can be further customized to meet each organizations
Acceptable Usage Policy and an unlimited number of additional rules can be created to
meet the unique needs of each company. These rules, which are representative of the
type of rules that an organization might wish to define, are disabled and grayed out.
7
Setting Up Rules, in General
On the screen shot below, some of the key areas of the Rules Administrator are explained.
Who specifies
the users/groups
to which the rule
applies
Operations
specifies additional
message
operations;
message archive,
header
modifications, strip
attachments and
more Actions enable you
to create a rule that
carries out a
specific action
Notify option
when a rule is
provides the
triggered
flexibility to notify
unlimited
individuals when a
rule is invoked.
Rules are applied top down. Given that, it is important to organize the order of your rules
carefully to avoid conflict with one another. Careful consideration should also be given to
instances in which rules are set for both groups of users and individuals users. If an
individual user is in a group and the group rule comes first, the individual rule may never
be activated.
8
Adding SurfControl E-mail Filter to your BlackBerry Enterprise Server
Environment
A dedicated Server is recommended for SurfControl E-mail Filter. After reading this guide,
simply follow the instructions in the SurfControl E-mail Filter Installation Guide, provided
with SurfControl software.
System Requirements for SurfControl E-mail Filter
SurfControl E-mail Filter for SMTP with Microsoft Windows 2000 and Windows 2003
Operating System: Microsoft Windows 2000 Server with Service Pack 3 or higher
Microsoft Windows 2000 Advanced Server with Service Pack 3
or higher
Microsoft Windows 2003 Server
Applications: Existing Microsoft SQL Server 2000 or MSDE 2000 provided
Processor: Pentium III Processor 600MHz or higher
Memory: 512 MB RAM; 1024 MB RAM recommended
Disk Space: 1 GB
Other: Microsoft Data Access Components (MDAC) 2.5 with
Service Pack
TCP/IP installed and configured
Dedicated Internet Connection
Internal and External DNS configured
E-mail system with SMTP gateway or MTA installed
Web Administration: Microsoft Internet Explorer 5.0 or higher or
Netscape Communicator 4.75 or higher
9
Installing BlackBerry Enterprise Server
BlackBerry Enterprise Server is available for Microsoft Exchange or Lotus Domino.
For the purpose of this document we will refer to the Exchange version. It is
recommended that BlackBerry Enterprise Server be installed on a dedicated Server. For
complete installation steps, follow the BlackBerry Enterprise Server Installation and
Getting Started Guide. The installation consists of several components, BlackBerry
Enterprise Server, BlackBerry Enterprise Server Management and BlackBerry User
Administration.
To Administer BlackBerry Enterprise Server(s) you must install BlackBerry Enterprise
Server Management Software. The Management software functions as a snap-in to the
Microsoft Management Console. From this console one can administer users at the
server level and the mailbox level.
Pre-Installation Steps
There are several pre-installation procedures required before you can begin installing
BlackBerry Enterprise Server software.
Defining Service Accounts and Permissions
Prior to installation a user service account and mailbox must be defined for each of the
BlackBerry Enterprise Server Software components installed. The same service account
can be used by two or more of the above components if they are installed on the same
computer. The same mailbox should be used by all BlackBerry software components.
The Service Account should be a member of the Domain Users group. Following this,
permissions must be set for the account(s) just created.
Installing and registering CDO.dll

The CDO.dll provided with Microsoft Outlook does not enable wireless calendar
synchronization feature. There is an option to register CDO.dll at the end of BlackBerry
Enterprise Server installation. Without this hot fix installed, wireless calendar
synchronization will not work.
Creating MAPI Profile

MAPI is the protocol which BlackBerry Enterprise Server uses to communicate with the
Microsoft Exchange Server. A MAPI profile must be created to be used by each of the
Service Accounts. Separate MAPI Profiles can be created for each BlackBerry Server
Components, or one MAPI profile can be used for all components. The MAPI Profiles can
point to the same BlackBerry Enterprise administration mailbox.
10
Installing Database Software
A Database tool must be installed on the BlackBerry Enterprise Server if it is hosting the
Management Database. This could be MSDE, SQL 7.0, or SQL 2000. There is a copy of
MSDE provided on the BlackBerry Enterprise Server Software CD.
Post-installation procedures
These procedures will verify MAPI profiles were created properly. They also walk you
through a step-by-step configuration of BlackBerry Enterprise Server. After completed
install, the BlackBerry users can be added through the Management Console.
System Requirements for BlackBerry Enterprise Server
BlackBerry Enterprise Server 3.6 for Microsoft Exchange
Hardware Requirements
Processor: Pentium III Processor 500MHz or higher

Memory: 256-MB RAM (plus 300-MB RAM for Attachment Service)
Disk Space: 1 GB
Other: 10 Mbps LAN connection
Software Requirements
Operating System: Microsoft Windows 2000 Server with Service Pack 1 or later
Applications: Microsoft Exchange 2000 with Service Pack 1 or later
Microsoft Exchange 2000 System Manager (on same computer
as BES Service
For BlackBerry Enterprise Server Management
Windows NT 4.0 with Service Pack 5 or later or
Windows 2000 Server or
Windows XP
A database engine (MSDE, SQL 7.0, or SQL 2000) must be
installed before, during or after BlackBerry Enterprise Server
installation. MSDE is provided on the BlackBerry Enterprise
Server Software CD.
BlackBerry Enterprise Server 2.2.1 for Lotus Domino

Hardware Requirements
11
See minimum hardware requirements for Lotus Domino Software version which you are
installing, and Windows operating system that it runs.
Software Requirements
Operating System: Microsoft Windows 2000 or later (Server or Advanced Server)

Applications: Lotus Domino Server 5.03 or later
NotesSQL 3.0.2 driver or later
Required BlackBerry Software components

BlackBerry Desktop Software version 3.6 or later
BlackBerry handhelds for DataTAC or Mobitex networks
version 2.6 or later
BlackBerry handhelds for CDMA2000 1X, GSM/GPRS or
Nextel networks, version 3.6 or later
Windows XP
Firewall Configuration
The BlackBerry Enterprise Server maintains a direct TCP/IP connection (Server Routing
Protocol or SRP) to the wireless network. This mode of connection requires the corporate
firewall to be configured to allow BlackBerry Enterprise Server to connect through port
3101. This is not a hole in the firewall; only an outbound, bi-directional connection is
required.
12
User Expectations and Tips
Once SurfControl E-mail Filter and BlackBerry Enterprise Server are set up and
configured, the IT Administrator can begin to set policies and rules to enhance security as
well as the users Handheld experience.
Additional E-mail Accounts on the Handheld

Handhelds working in conjunction with the BlackBerry Enterprise Server receive their
corporate Exchange e-mail, and can also receive E-mail from other accounts. The
BlackBerry Web Client, includes a Web Client e-mail account and also the ability to add
accounts to this such as POP mail. BlackBerry Web Client e-mail does not pass through
the corporate Exchange environment, and therefore is not filtered by SurfControl E-mail
Filter. Chances are the user will receive unwanted content on the handheld through the
Web Client e-mail accounts. To help prevent this the BlackBerry Administrator can set up
an IT Policy to disable other e-mail services.
BlackBerry IT Policies
From a security perspective the IT Administrator may want to enforce that only corporate
e-mail be exchanged on the Handheld device. This can be done through the BlackBerry
Enterprise Server Management console and implemented by an IT Policy named
AllowOtherEmailServices. Use this policy item to allow or disallow the use of other email
services on the handheld. Click TRUE to allow other email service books on the handheld,
or click FALSE to configure the handheld to reject all email service books other than the
Desktop service book. Clicking FALSE forces all outbound email through your
organization's BlackBerry Enterprise Server.
Defining SurfControl Rules

Rules set up with in the SurfControl Rules Administrator will apply to the users Desktop as
well as the BlackBerry handheld.
Enabling Anti-Spam Agent Rule

In a standard SurfControl environment, customers will enable the Anti-Spam Agent rule,
preventing SPAM from being delivered to either the Desktop or the Handheld device.
On the screen shot below, click the Pre-defined Anti-Spam Agent rule to enable it. Then
apply the rule by clicking on the upper left icon as shown below.
13
Click here to
commit changes
made in the Rules
Administrator
When email arrives in the Users Inbox, it has already been filtered by SurfControl E-mail
Filter. BlackBerry Enterprise Server compresses and encrypts the message and then
delivers it to the handheld over the wireless network. The e-mails received and sent via
the handheld are therefore in a text format. Since 95% of all SPAM is HTML based, the
Anti-Spam Agent contains SPAM Signatures in both HTML and text formats. However,
due to BlackBerry Enterprise Server stripping the e-mail of potential SPAM Signatures, it
may help to enable the SPAM Dictionary.
Additional Layers of Protection

In addition to the Anti-Spam Agent, SurfControl E-mail Filter provides additional features to
protect against viruses in e-mail attachments, productivity and bandwidth losses from
SPAM, leakage of confidential information, and lawsuits in response to offensive content.
The E-mail Filter provides 16 pre-populated Dictionaries which can be User-customizable.
A custom dictionary could be created containing project code names of future product
releases. This could prevent a Desktop or Handheld user from sending sensitive
information to an unintended recipient.
14
Review
The joint solution of SurfControl E-mail Filter and Blackberry Enterprise Server provides:
Improved Handheld Efficiency

Enhanced Network Security
Protection against unwanted or dangerous content
SurfControl E-mail Filter SMTP can be configured for MS Exchange or for a stand-alone
gateway used in combination with any Mail Transfer Agent including Lotus Domino
running and MS Windows 2000 platform.
For more information on how SurfControl helps companies stop unwanted content, please
visit: http://www.surfcontrol.com
15

Configuration Guide For Surfcontrol E-Mail Filter and Blackberry Enterprise Server

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Configuration Guide For Surfcontrol E-Mail Filter and Blackberry Enterprise Server

Încărcat de

Drepturi de autor:

Formate disponibile

Configuration Guide

SurfControl E-mail Filter

BlackBerry Enterprise Server

TABLE OF CONTENTS ......................................................................................................2

WHAT IS SURFCONTROL E-MAIL FILTER? ....................................................................3

WHAT IS BLACKBERRY ENTERPRISE SERVER?..........................................................4

SETTING UP SURFCONTROL E-MAIL FILTER AND BLACKBERRY ENTERPRISE

INSTALLING SURFCONTROL E-MAIL FILTER ................................................................5

SYSTEM REQUIREMENTS FOR SURFCONTROL E-MAIL FILTER ................................9

INSTALLING BLACKBERRY ENTERPRISE SERVER....................................................10

SYSTEM REQUIREMENTS FOR BLACKBERRY ENTERPRISE SERVER ....................11

USER EXPECTATIONS AND TIPS ..................................................................................13

What is SurfControl E-mail Filter?

Anti-Virus Agent provides an extra layer of protection against potentially damaging

Virtual Image Agent identifies inappropriate images within e-mails.

Setting up SurfControl E-mail Filter and BlackBerry Enterprise Server

Typical Joint Configuration

Installing SurfControl E-mail Filter

System Requirements for SurfControl E-mail Filter

Defining Service Accounts and Permissions

Installing and registering CDO.dll

Creating MAPI Profile

System Requirements for BlackBerry Enterprise Server

BlackBerry Enterprise Server 3.6 for Microsoft Exchange

Processor: Pentium III Processor 500MHz or higher

BlackBerry Enterprise Server 2.2.1 for Lotus Domino

Operating System: Microsoft Windows 2000 or later (Server or Advanced Server)

Required BlackBerry Software components

Additional E-mail Accounts on the Handheld

Defining SurfControl Rules

Enabling Anti-Spam Agent Rule

Additional Layers of Protection

Improved Handheld Efficiency

S-ar putea să vă placă și