How an I prevent phishing email using IronPort

[muthukalyx]

HI,

We are using Cisco C170 Ironport appliance and we are getting mails with phishing urls.  Normal user are opened the mail and their machines got impacted. How can i stop this email?

[Robert Sherwin]

Virus Outbreak Filters feature may be of help for you.  This will go through and add a next level of defense against mails that are missed from IronPort Anti-Spam.  Have you submitted missed phishing emails in for review and additional block?

Do you have any examples to share from those received?  

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117822-qanda-esa-00.html

-Robert

[Notes Administrator]

URL Filtering with Outbreak Filtering

[Paul Cardelli]

Keep in mind, phishing e-mails are an on-going threat no matter what appliance you use. I would take a look at what phishing e-mails are looking like, and utilize and enable much of the tools built in to minimize their appearance in your users' inbox.

The next step is a little more painful at first but will increase phishing security by at least 90%. You need to offer information security training to all your users. If you check some of my past posts I also recommend sending "Phishing Simulation" emails to your users to give some hands on training. Usually these are masked to look just like real phishing e-mails, but instead link them to your phishing training. Once your users start reporting phishing e-mails to You and Cisco you will start seeing these drop drastically. There are a few ways to implement this but it depends on your target audience, budget, and how you sell the solution to your management.

[Paul Cardelli]

Here is a previous thread that gets into some of the ways to combat some forms of phishing. 

how-i-prevent-spoofed-email-using-ironport-c160