Cisco Cisco Email Security Appliance C190 Guía Del Usuario
Chapter 7 Reputation Filtering
7-246
Cisco IronPort AsyncOS 7.1 for Email Configuration Guide
OL-22158-02
Reputation Filtering
The SenderBase Reputation Service provides an accurate, flexible way for users
to reject or throttle suspected spam based on the connecting IP address of the
remote host. The SenderBase Reputation Service returns a score based on the
probability that a message from a given source is spam and exposes objective data
in the Mail Flow Monitor feature to allow mail administrators to get a more
complete picture of who is sending them email (see “Using Email Security
Monitor” in the Cisco IronPort AsyncOS for Email Daily Management Guide).
The SenderBase Reputation Service can be used as a stand-alone anti-spam
solution. It is primarily designed to improve the effectiveness of a content-based
anti-spam system such as IronPort Anti-Spam.
to reject or throttle suspected spam based on the connecting IP address of the
remote host. The SenderBase Reputation Service returns a score based on the
probability that a message from a given source is spam and exposes objective data
in the Mail Flow Monitor feature to allow mail administrators to get a more
complete picture of who is sending them email (see “Using Email Security
Monitor” in the Cisco IronPort AsyncOS for Email Daily Management Guide).
The SenderBase Reputation Service can be used as a stand-alone anti-spam
solution. It is primarily designed to improve the effectiveness of a content-based
anti-spam system such as IronPort Anti-Spam.
Using the SenderBase Reputation Service, you can:
•
Reduce spam
The SenderBase Reputation Service allows enterprises to identify known spam
based on the connecting IP address, allowing organizations to block spam as soon
as it reaches the gateway. This increases the effectiveness of the anti-spam
scanning engine being used or any content-based filter.
based on the connecting IP address, allowing organizations to block spam as soon
as it reaches the gateway. This increases the effectiveness of the anti-spam
scanning engine being used or any content-based filter.
•
Protect against spam floods
Viruses such as SoBig and “hit and run” spam attacks can create sudden and
unexpected spikes in message volume. If a particular sender starts sending at high
volumes, the SenderBase Reputation Service can detect this through its global
affiliate network and assign a more negative score, which the IronPort appliance
can use to immediately begin limiting the number of recipients per hour allowed
from the sender. (See also
unexpected spikes in message volume. If a particular sender starts sending at high
volumes, the SenderBase Reputation Service can detect this through its global
affiliate network and assign a more negative score, which the IronPort appliance
can use to immediately begin limiting the number of recipients per hour allowed
from the sender. (See also
.)
•
Improve throughput
The IronPort appliance can reduce system load and increase message throughput
by immediately rejecting known spam and routing known good messages past
content filters.
by immediately rejecting known spam and routing known good messages past
content filters.
Reputation Filtering: the IronPort SenderBase Reputation Service
The IronPort SenderBase Reputation Service (available at
http://www.senderbase.org
) is a service designed to help email administrators
better manage incoming email streams by providing objective data about the