Using Content Filters for Security

In many environments, custom-written rules form an important part of email security. I’m not going to strongly recommend against doing so, but I put a warning here that using content filters to do the jobs that anti-spam and antivirus do is administratively intense and can affect the performance of the ESA.

That being said, there are a couple of filters you should consider if you want to be preemptive about security. The first to start with are attachment filters. Virtually every organization restricts attachments to email in some way, because the reality is that many attachment types have no legitimate use in email, and their presence almost always indicates a threat.

Attachment Conditions and Actions

There are a few ways that the ESA can identify attachments, and you’ll likely want to use more than one approach combined: