cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1134
Views
0
Helpful
1
Replies

Extensions to Block or Not

Mustapha Arakji
Level 1
Level 1

If we agree on a list of probable safe extensions to allow, and block any other type of extension. Would it be easier to specify rather than list the list of probable unsafe extension?

Any thoughts?

1 Accepted Solution

Accepted Solutions

Mathew Huynh
Cisco Employee
Cisco Employee

Hey Mustapha,


That would be easier to implement if you have a specific list of attachment filenames/types you wish to allow but block all the rest.

However with  very large stream of attachment filenames and types available, this can be considered a very strict setup that may cause some false positive matches.

It may be better to run a filter to check for 'executable' filetypes (mime types) as well as an additional condition to block some common filenames which you do not wish to allow.

Regards,

Matthew

View solution in original post

1 Reply 1

Mathew Huynh
Cisco Employee
Cisco Employee

Hey Mustapha,


That would be easier to implement if you have a specific list of attachment filenames/types you wish to allow but block all the rest.

However with  very large stream of attachment filenames and types available, this can be considered a very strict setup that may cause some false positive matches.

It may be better to run a filter to check for 'executable' filetypes (mime types) as well as an additional condition to block some common filenames which you do not wish to allow.

Regards,

Matthew