Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說(shuō)明書(shū)
In a stage 812 (step 14), if the message is determined to be a non-malicious message, the interdiction module can return access to the messages to the users to whom it was denied during analysis in a stage 814. If, however, the message is determined to be malicious or a phishing attack, the messages can be permanently removed in a stage 816. The database and identifiers for known phishing and malicious messages is also updated. The system can provide a replacement message stating the message has been removed for an appropriate reason, such as it is a phishing message, it contained malicious code, or the message did not conform to workplace appropriate content. Additionally, the reputation score of the reporting user is also updated accordingly depending on the outcome of the message analysis.
The steps above can be performed by the inbound mail server or by a separate computing device in communication with the inbound mail server. The message interdiction module can be located on a client's premises or remotely. The interdiction module can also provide notification to the module responsible for maintaining the reporter reputation scores for individuals of any actions that have been taken by the individuals for the messages that are removed by it. Examples would be notifying the reporting module that the message had been opened, or moved to trash, or not opened. This information can be used by the reputation scoring module to adjust the reputation scores for the individuals according to any actions the individuals have taken.
