WIXLIB

DATA SHEET FIREEYE EMAIL SECURITY SERVER EDITION1data sheetFireEye Email SecurityServer EditionAdaptive, intelligent, scalable defense against email borne threatsHIGHLIGHTS Offers comprehensive emailsecurity against spear phishingand other advanced, multistage and zero-day attacks Bursting provides addeddetection analysis capacityduring peak messagethroughput periods Supports analysis againstMicrosoft Windows and AppleMac OS X operating systemimages Analyzes email for threatshidden in files includingpassword-protected andencrypted attachments andmalicious URLs Automatically detects andreduces or entirely preventscredential phishing Provides contextual insightsfor alerts to prioritize andcontain threats Integrates with a variety ofFireEye technologies Deploys on-premises withintegrated or distributed MVXservice and in active-protectionor monitor-only mode Provides visibility, trackingand management of messagesand alertsFigure 1. Integrated Email Security appliances include EX 3500, EX 5500 and EX 8500.OverviewEmail is the most vulnerable vector for cyber attacks because it’s the highestvolume data ingress point. Organizations face an ever-increasing number of securitychallenges from email-based spam and viruses to advanced and targeted threats.The majority of threats arrive by email in the form of weaponized file attachments,malicious links and credential phishing. While anti-spam filters and antivirus softwareare good at catching traditional mass email phishing attacks with known maliciousattachments, links and content, they cannot catch sophisticated and targetedspear-phishing attacks designed to bypass these legacy solutions. Email remains theprimary method used to initiate an advanced attack or deliver ransomware becauseit can be highly targeted and customized to increase the odds of exploitation.FireEye Email Security helps organizations minimize the risk of costly breaches.Email Security, available in a variety of deployment options, accurately detects andcan immediately stop advanced and targeted attacks, including spear phishing andransomware before they enter your environment. Email Security uses a true bigdata, scalable platform to detect malicious and benign URLs based on a confluenceof intelligence-led context and detection plug-ins. The signatureless Multi-VectorVirtual Execution (MVX) engine analyzes email attachments and URLs against acomprehensive cross-matrix of operating systems, applications and web browsers.Threats are identified with minimal noise, and false positives are nearly nonexistent.

DATA SHEET FIREEYE EMAIL SECURITY SERVER EDITIONFireEye collects extensive threat intelligence on adversaries,firsthand breach investigations and through millions ofsensors. Email Security draws on this real evidence andcontextual intelligence about attacks and attackers toprioritize alerts and block threats in real time.Email Security integrates with FireEye Network Securityand Endpoint Security for broader visibility to coordinatereal-time protection against multi-vector, blended attacks.Effective threat detection2 Files downloaded through URLs – and even FTP links Obfuscated, spoofed, shortened and dynamicallyredirected URLs Credential-phishing and typosquatting URLs Unknown Microsoft Windows and Apple Mac OS Xoperating system images, browser and applicationvulnerabilities Malicious code embedded in spear-phishing emailsEmail Security is an effective cyber threat protection solutionthat helps organizations minimize the risk of costly breachesby accurately detecting and immediately stopping advanced,targeted and other evasive attacks hiding in email traffic.While ransomware attacks start with an email, a call back to acommand-and-control server is typically required to encryptthe data. Email Security identifies and stops these hard-todetect multi-stage malware campaigns.At the core of Email Security is the URL detection platformand MVX engine which inspect suspicious email traffic toidentify attacks that evade traditional signature- and policybased defenses. FireEye Email Security uses recent advancesin technologies such as machine learning and analytics. Animage classification engine uses deep learning to comparea screenshot of a web page referenced in a phishing URL tothat of the targeted brand. FireEye Email Security also hasfeatures that apply domain and page content analytics toaugment machine learning. The combination of analytics andmachine learning provides added coverage, or a defense-indepth approach to credential-phishing detection. The MVXengine detects zero-day, multi-flow and other evasive attacksby using dynamic, signatureless analysis in a safe, virtualenvironment. It stops the infection and compromise phasesof the cyber attack kill chain by identifying never-before-seenexploits and malware.Efficient response to alertsBursting to a FireEye MVX Smart Grid provides addedcapacity for detecting and analyzing email-borne threatsduring peak message throughput periods.Defense against email borne threatsWith all the personal information available online, a cybercriminal can socially engineer almost any user into clicking aURL or opening an attachment.Email Security provides real-time detection and preventionof spear-phishing, malware and ransomware attacks thatevade traditional defenses. It reduces credential phishing withdetection of “like but not equal” domains (typosquatting).If an attack is confirmed, Email Security quarantines themalicious email for further analysis or deletion. It conductsanalyses for malware hidden in: Attachment types including, but not limited to: EXE,DLL, PDF, SWF, DOC/ DOCX, XLS/XLSX, PPT/PPTX,JPG, PNG, MP3, MP4 and ZIP/RAR/TNEF archives Password-protected and encrypted attachments URLs embedded in emails, MS Office documents, PDFand archive files (ZIP, ALZip, JAR), and other file types(Uuencoded, HTML)Email Security analyzes every attachment and URL toaccurately identify today’s advanced attacks. Real-timeupdates from the entire FireEye security ecosystemcombined with attribution of alerts to known threat actorsprovide context for prioritizing and acting on critical alertsand blocking spear-phishing emails. Known, unknown andnon-malware based threats are identified with minimalnoise and false positives so that resources are focusedon real attacks to reduce operational expenses. Riskwarecategorization separates genuine breach attempts fromundesirable, but less malicious activity (such as adware andspyware) to prioritize alert response.Rapid adaptation to the evolving threat landscapeEmail Security helps your organization continually adaptyour proactive defense against email-borne threats by usingdeep intelligence about threats and attackers. It combinesadversarial, machine and victim intelligence to: Deliver timely and broader visibility to threats Identify specific capabilities and features of detectedmalware and malicious attachments Provide contextual insights to prioritize andaccelerate response Determine the probable identity and motivesof an attacker and track their activities withinyour organization Retroactively identify spear-phishing attacks andprevent access to phishing sites by highlightingmalicious URLsActive-protection or monitor-only modeEmail Security can analyze emails and quarantine threatsfor active protection. It uses the signatureless detonationchamber, the MVX engine, to analyze every attachment andURL for threats and stop advanced attacks in real time.For monitor-only deployments organizations set up atransparent BCC rule to send copies of emails to EmailSecurity for analysis by the MVX engine.

DATA SHEET FIREEYE EMAIL SECURITY SERVER EDITIONSecurity operations controlEmail Security works seamlessly with FireEye Helix andFireEye Central Management. As a component of the security operations platform— FireEye Helix — it provides visibility across theentire infrastructure. FireEye Helix augments email andthird-party alerts with intelligence, correlation to theendpoint, automation, and investigative tips. With thesecapabilities, FireEye Helix surfaces unseen threats andempowers expert decisions. Central Management correlates alerts from both EmailSecurity and Network Security for a broader view of anattack and to set blocking rules to prevent the attackfrom spreading. Central Management supports role-based tagging toknow who is being targeted. Central Management supports alert response andremediation based on role-based criteria.YARA-based rules enable customizationEmail Security – Server Edition supports custom YARArules to enable security analysts to specify and test rules foranalyzing email attachments containing threats targetingtheir organization.Message queue, alert and quarantine managementEmail Security provides a high degree of control over the emailmessages it scans. For active protection-mode deploy-ments,messages can be tracked and managed as they move throughthe MTA queue. Email attributes can be used to search andverify that messages were received, analyzed and delivered to3the next hop and trends over time can be monitored throughan intuitive dashboard. Explicit allow and block lists providecustom control over email processing. Common alert attributescan be searched and selected. And bulk operations can beperformed on alerts and quarantined messages.Flexible Deployment OptionsFireEye Email Security offers various deployment options tomatch an organization’s needs and budget: Integrated Email Security: standalone, all-in-onehardware appliance with integrated MVX service tosecure an email ingress point at a single site. FireEyeEmail Security is an easy-to-manage platform thatdeploys in under 60 minutes. It doesn’t require rules,policies or tuning. Distributed Email Security: extensible appliances withcentrally shared MVX service to secure email ingresspoints within organizations Email Smart Node: virtual sensors analyze emailtraffic to detect and block malicious traffic and submitsuspicious activity over an encrypted connection to theMVX service for definitive verdict analysis MVX Smart Grid: on-premise, centrally located, elasticMVX service that offers transparent scalability, built-inN 1 fault tolerance and automated load balancing. FireEye Cloud MVX: MVX service subscription thatensures privacy by analyzing traffic on the EmailSmart Node. Only suspicious objects are sent over anencrypted connection to the MVX service, where objectsrevealed as benign are discarded.Integrated Email SecurityPhysical ApplianceCentral SiteMVX Smart GridRemote siteEmail Smart NodeVirtual ApplianceFigure 2. Distributed and bursting deployment models for Email Security.FireEyeCloud MVX