A list of company executives is routinely being spoofed, which puts the company at risk of malicious email attacks An administrator must ensure that…

To protect a specific list of executives from email spoofing on a Cisco Email Security Appliance (ESA), the most direct and effective method is using the Forged Email Detection (FED) feature. This implementation requires two key steps. First, a content dictionary must be created containing the names and email addresses of the executives to be protected (the high-value targets). Second, an incoming content filter must be configured with the "Forged Email Detection" condition. This filter uses the dictionary to identify spoofing attempts and applies a configured action, such as quarantining or dropping the malicious message, thus ensuring messages are legitimate.

A. Create an incoming content filter with SPF detection.

SPF is a general, domain-level control. It is less precise than Forged Email Detection, which is designed specifically to protect individual display names from impersonation.

B. Enable the Forged Email Detection feature under Security Settings.

While enabling the feature is a necessary prerequisite, it does not implement any protective action on its own. The content filter is the component that actually enforces the policy.

C. Enable DMARC feature under Mail Policies.

DMARC is a broad, domain-level policy for authentication. It is not designed to protect a specific list of individuals from display name or look-alike domain spoofing attacks.

1. Cisco Email Security Appliance Configuration Guide

Release 14.0

Chapter: Protecting Against Malicious or Unwanted Email.

Section: Forged Email Detection

"How Forged Email Detection Works" and "Configuring Forged Email Detection."

Content: The documentation explicitly states the process: "1. Create a content dictionary with the names of the employees that you want to protect from being spoofed... 2. Enable Forged Email Detection... 3. Create an incoming content filter with the Forged Email Detection condition and add the required actions." This directly supports that creating the dictionary (E) and the content filter (D) are the essential implementation steps.

2. Cisco Email Security Appliance Best Practices

Tips

and Tricks.

Section: Forged Email Detection (FED)

Content: This guide details the best practice for preventing CEO/Executive fraud. It outlines creating a dictionary of "VIPs" (executives) and then creating a content filter that uses the forged-email-detection() rule to match on messages spoofing those VIPs. This confirms that the dictionary (E) and the filter (D) are the core components of the solution.