managing_outbreaks
Outbreaks happen when viruses/malware, Trojans, worms, or other spyware/grayware suddenly attack many Exchange servers or personal computers on your network. There are many reasons why an attack might occur such as out-of-date components, poor configuration of anti-virus software, or a new malware arising for which there is not yet a pattern file. Outbreaks are a critical time when administrators must endure a chaotic, time-consuming process of communication, often to global and decentralized groups within their organizations.
The actions that administrators take when outbreaks happen can be broken down into four general stages:
Confirming that the security incident is a legitimate problem and not a false alarm
Responding to the security incident
Analyzing the security incident
Recovering the Exchange servers and mailboxes
ScanMail has some very useful features that can assist administrators in every stage of an outbreak. Consider the following features when an outbreak threatens:
To confirm that the security incident is truly a malware outbreak:
Check the Trend Micro website for virus/malware alerts and the latest security advisory information.
http://www.trendmicro.com/vinfo/
Check ScanMail notifications. ScanMail can be configured to automatically send alerts when outbreak conditions exist. In addition, ScanMail can be configured to notify administrators or other designated individuals when ScanMail takes actions against detected threats.
For a quick analysis of the security incident, view the ScanMail Summary screen or create a one-time report. For more detailed information about the security incident, query ScanMail logs.
Responding
Manually update components to immediately download the latest ScanMail components.
Follow-up the update with a manual scan of the entire information store. Use the Trend Micro recommended defaults such as IntelliScan and ActiveAction or set even more aggressive scanning filters. If you know exactly what you are scanning for, select Specified files from the Security Risk Scan screen and type the name of the file for ScanMail to detect.
Analyzing
Perform a Log Query to discover information about the attack. The log contains such useful information as the time and date, sender and receiver, and infected attachment names.
If you need assistance to help analyze the security problem, send your virus/malware case to the Trend Micro Virus Response Service.
https://premium.trendmicro.com/virusresponse/en/us/VRS/logon/logon.asp
If you need more assistance, contact Trend Micro support.
Recovering
When you have restored your Exchange environment, consider changing your configurations and security policies. Consider the following points:
Set ScanMail to back up files before taking action and then set very aggressive configurations. This allows ScanMail to detect and eliminate many threats without taking irreversible actions.
Monitor the results using the real-time monitor or by generating logs and reports.
Use the Server Management tool to quickly and easily replicate configurations from one secure and tested ScanMail server to another.
See also: