About the Kaspersky Secure Mail Gateway

The Kaspersky Secure Mail Gateway solution (hereinafter also referred to as "KSMG") lets you deploy a mail gateway as a cluster system, which can scale with the volume of processed traffic, and integrate it into the existing mail infrastructure of your organization. KSMG protects incoming and outgoing email against malicious objects, spam and phishing content, and performs Content Filtering of email messages.

The solution is provided as two distribution types:

ISO image of a virtual machine with a pre-installed operating system, mail server, and Kaspersky Anti-Virus application. Detailed information about this distribution type is provided in this document.
RPM or DEB installation package. Detailed information is provided in the KSMG Help for this distribution type.

How to find out which distribution type is installed in your organization

You can choose between the following KSMG virtual machine ISO images:

Based on Rocky Linux 9.4. Rocky Linux 9.4 is included in the KSMG image.
Based on the RED OS 7.3 operating system from the certified redos-MUROM-7.3-*-Everything-x86_64-DVD1.iso image, where "*" is version 20240923.0 or later. We recommend installing the operating system from an image of version 20241221.0.
The RED OS operating system is not included in the KSMG distribution kit and must be purchased separately.

KSMG allows you to:

Perform Anti-Virus scanning of messages:
- Check messages for viruses, malware, and macros (for example, Microsoft® Office files containing macros), encrypted objects, archives (including recognizing types of files inside archives and compound objects).
- Use the information from Kaspersky Security Network to ensure a faster response to new threats.
  An infrastructure of cloud services that provides access to the Kaspersky online Knowledge Base, which contains information about the reputation of files, web resources, and software. The use of data from Kaspersky Security Network ensures that Kaspersky applications respond faster to threats, improves the performance of some protection components, and reduces the likelihood of false alarms.
- Configure integration with the Kaspersky Private Security Network (KPSN) for organizations where Internet access is restricted by internal rules and policies.
  A solution that allows users of Kaspersky anti-virus applications to access Kaspersky Security Network data without sending their own information to Kaspersky Security Network servers.
- Configure integration with the Kaspersky Anti Targeted Attack Platform (KATA) for detection of threats such as zero-day attacks, targeted attacks, and complex targeted attacks known as advanced persistent threats (APT).
  Solution designed for the protection of a corporate IT infrastructure and timely detection of threats such as zero-day attacks, targeted attacks, and complex targeted attacks known as advanced persistent threats (hereinafter also referred to as "APT").
Perform Anti-Spam scanning of messages:
- Check messages for spam, probable spam, mass mail (including spoofed domain recognition and IP address reputation checking).
- Detect messages that contain Unicode spoofing. If Unicode spoofing is detected, the message is considered to be spam. The application adds the unicode_spoof tag to the X-KSMG-AntiSpam-Method message header.
  A type of attack based on the falsification (spoofing) of transmitted data. Spoofing may be aimed at obtaining elevated privileges, primarily through bypassing the verification mechanism by generating a request similar to an authentic request. One variant of spoofing is to forge an HTTP header to gain access to hidden content.
  
  The goal of spoofing may also be to deceive a user. A classic example of such an attack is the falsification of the sender's address in emails.
- Add the X-MS-Exchange-Organization-SCL X-headers to messages, based on the scan results. The headers contain the SCL rating.
  Spam Confidence Level is a special tag used by Microsoft Exchange mail servers to measure the probability that a message contains spam. The SCL rating can range from 0 (minimum probability of spam) to 9 (the message is most likely spam). Kaspersky Secure Mail Gateway can change the SCL rating of a message depending on the message scan results.
- Place messages into Anti-Spam Quarantine and manage the Anti-Spam Quarantine via the web interface.
Perform Anti-Phishing scanning of messages.
Scan messages for malicious or advertising links, as well as links related to legitimate software.
Check whether links from QR codes in images are used for phishing, malware, advertising, or if they are related to legitimate software.
Perform content filtering of messages:
- By message size
- By message MIME part size
- By attachment name
- By attachment type
  KSMG allows you to determine the true format and type of an attachment, regardless of its extension, including inside archives and compound objects.
- By message subject
- By message body
- By sender
- By recipient
- By message copy recipient
- By top-level headers of the MIME structure of the message
Configure actions to be performed on message headers when a message processing rule or a Content Filtering expression is triggered, or a Content Filtering error occurs.
Configure a BCC message to be sent to a specific address when a processing rule is triggered.
Perform Mail Sender Authentication using SPF, DKIM, DMARC, and sender domain alignment technologies.
Checking whether the message sender domains specified in the SMTP session (the value of the MAIL FROM command) and in the message (the value of the From MIME header) match.

Verification that determines the policy and actions taken on messages based on the results of SPF and DKIM Mail Sender Authentication.

Verification of the digital signature of messages.

Comparison of IP addresses of mail senders with the list of possible message sources that has been created by the mail server administrator.
Configure integration with Active Directory® to obtain information about domain users.
Obtain information about application events:
- Logging mail traffic processing events and application events that occur during the operation of the application. The log can be filtered to search for events conveniently.
- Export events in the CSV format.
Publish application events to a SIEM system used in your organization using the syslog protocol. Information about each application event is relayed as a separate syslog message in CEF format.
SIEM system (Security Information and Event Management) is a solution for managing information and events in an organization's security system.
Log the values of changed application settings and view the changes in the audit event log in the web interface.
Change records can also be saved as syslog messages in standard format or in CEF format.
Configure and manage the application using a web interface.
- Monitor the status of email traffic and system resources, view the lists of the latest detected threats in the web interface of the application.
- Create user accounts and delimit user access to application functions using a role-based system.
- Configure authentication using single sign-on (SSO) technology.
- Create a cluster to scale the solution (horizontally or vertically) with centralized management of all servers in the cluster using the application's web interface.
- Manage Backup:
  - Save original messages that were scanned and processed by the application in Backup.
  - Save messages from Backup to a file.
  - Forward messages to recipients.
  - Receive information about users from different domains and grant users access to personal Backup.
  - Grant users access to the Backup of group mailboxes.
  - Configure the personal Backup digest delivery.
- Create allowlists and denylists, which let you fine-tune the way the mail system reacts to messages from certain addresses.
- Update application databases from Kaspersky update servers and custom sources via a schedule or on demand.
  The update functionality (including anti-virus signature updates and code base updates), as well as the KSN functionality may not be available in the application in the territory of the USA.
- Configure email notifications:
  - Send notifications about events generated by application modules while scanning messages.
  - Send notifications about application events to users.
- Add email disclaimers to outgoing and incoming messages and add warnings about insecure message
- Generate and view reports about the results of message processing and application events.
- Process email messages in accordance with rules configured for groups of senders and recipients.
- Add, modify, or delete information about domains (including local domains of the organization) and email addresses, edit Kaspersky Secure Mail Gateway settings for such domains and email addresses, and configure email routing.
- Configure MTA.
  Mail Transfer Agent is an agent that handles message sending between mail servers.
- Add, modify, and delete DKIM and TLS encryption keys.
- Receive application operation statistics via the SNMP protocol, and enable or disable forwarding of SNMP traps.
  An application event notification sent by the SNMP agent.

KSMG is distributed as an ISO image of a virtual machine for deployment on a VMware ESXi™, Microsoft Hyper-V®, Microsoft Windows Server with the Hyper-V role, RED Virtualization, or "Brest" 3.3.1 virtualization software.

Deploying the image creates a virtual machine with a pre-installed operating system, a mail server, and the KSMG application. After deploying the virtual machine, you can configure it using the Initial Configuration Wizard.