About ed.sherratt

ed.sherratt · 09-09-2016

Hi, We have an incoming content filter that is used to quarantine suspicious mails, based on Attachment name, sender, and body content dictionaries, as well as a couple of other items. These have grown over time, particularly with the recent macro ma...

ed.sherratt · 04-10-2015

Good Morning, We are currently seeing a massive increase in malware contained in Word Document macros, these are dropping through the ESA until CASE catches up, and there are no AV signatures for these files at the time of drop.I've analysed these fi...

ed.sherratt · 09-03-2014

Good Morning,We've recently seen malware executables, in archive files, dropping through the ESA, even though there is a policy to quarantine all executables. I suspect it's because the archives are an unusual type - ARJ - and may be specifically des...

ed.sherratt · 08-29-2014

Hi,We have a requirement to block sites with certificate errors, self-signed/out of date/unrecognised authority etc., which makes sense from a security perspective.The business, however, want to whitelist certain third-party sites that we must access...

ed.sherratt · 09-13-2016

Hi Again, Thanks for that, it's not perfect as you said, but a lot better visibility than I had. Regards, Ed

ed.sherratt · 09-12-2016

Thank You Libin, I'll look into this and let you know how it goes. Regards,Ed

ed.sherratt · 12-18-2015

Hi, One other thing to note the feeds are TOR exit nodes IPs not URLs, and not necessarily entry points. I agree with the previous comment - the best option is the security intelligence block. Regards,Ed

ed.sherratt · 12-18-2015

Hi Jon, I've done the following for systems that generate false positives for single rules, but I don't trust completely so still want the rest of the rules to apply. Firstly edit the rule to create a new Local rule that excludes the IP, in this exam...

ed.sherratt · 08-12-2015

Hi Bryan,The basic answer from Cisco was that the ESA can't do that, and suggested using AMP, which while now integrated with the ESA range is a hefty extra cost. To me it looks like further development in the security aspects of the ESA has pretty m...

Member Since	‎04-02-2002 02:24 AM
Date Last Visited	‎08-23-2020 11:19 AM
Posts	14
Total Helpful Votes Received	1

User Statistics

User Activity

finding out what item in a dictionary is firing?

Increased malware in DOC macros

malware in unusual archives

Is it possble to whitelist some sites for Certificate errors on WSA?

Hi Again,

Thank You Libin,

Hi,

Hi Jon,

Hi Bryan,The basic answer