Trend Micro InterScan Gateway Security Appliance M-Series ...

Trend Micro InterScan Gateway Security Appliance M-Series Administrator’s Guide
3-18
The predefined list of file types that the appliance can block includes:
• Audio/Video
• Compressed
• Executable
• Java
• Microsoft documents
Note: See “Appendix C: File Blocking - File Formats” for a complete listing of files that
can be blocked by InterScan Gateway Security Appliance.
When InterScan Gateway Security Appliance blocks a file, a notification message
will appear on the user's browser informing them that InterScan Gateway Security
Appliance has blocked the file. InterScan Gateway Security Appliance will send a
notification to the administrator, if enabled, whenever it blocks a file.
When InterScan Gateway Security Appliance blocks a file, it will write the incident
to the File blocking log. You can export the File blocking log for inclusion in reports.
True File Type and IntelliScan
Virus originators can easily rename a file to disguise its actual type. Programs such as
Microsoft Word are “extension independent”; that is, they recognize and open “their”
documents regardless of the file name. This security hole poses a danger, for example,
if a Word document containing a macro virus has a name such as
benefits_form.pdf. Word opens the file, but InterScan Gateway Security
Appliance may not have scanned it if the appliance is not checking the true file type.
Rather than relying on the file name alone to decide if it should scan a file, InterScan
Gateway Security Appliance uses IntelliScan to identify a file's true type.
True file-type detection—IntelliScan first examines the header of the file using true
file-type identification and checks if the file is an executable, compressed, or other
type of file that may be a threat. IntelliScan examines all files to be sure that the file
has not been renamed—the extension must conform to the file's internally registered
data type.