Quote:
Originally Posted by manya
verify and alert or log if any attachments are being sent
|
Snort Community rules and Emerging Threats rules have signatures for signaling email attachments using "content:"Content-Disposition". Grep rules, reverse flow (prolly), test rules. Wrt DLP you know data can leave the premises in more than one way
*. If not entertaining at least it should be a cue to think about it as
software does not solve all problems.
