Loading...
Loading...

HOWTO: How to increase the security of TLS in MailMarshal

Expand / Collapse



This article applies to:

  • Trustwave MailMarshal (SEG) 6.9.6 and above
  • See additional version-specific changes in notes

Question:

  • How do I increase the security of my TLS connections with SEG/MailMarshal?
  • How do I increase the encryption level of my TLS connections?

Response:

SEG allows you to select a preferred level of encryption for TLS connections. 
You can set the minimum cipher strength to LOW, MEDIUM or HIGH as per their business requirements.
  • High strength includes cipher suites with greater than 128 bit encryption
  • Medium strength includes cipher suites with 128 bit encryption
  • Insecure Compatibility strength (known as Low strength in versions below 8.0) includes cipher suites with 56 or 64 bit encryption  
Note that this is a minimum setting (the stronger ciphers will always be available and attempted first).

To set this option, see the TLS properties:
  • Outbound Security (TLS), in SEG Properties (Trustwave SEG Properties, Sender Properties section)
  • Inbound Security (TLS), in the properties of each processing node (Mail Servers > [select a server] > Server Properties

SEG also allows you to specify the protocol (SSL or TLS version) required for the connection. Refer to:

  • Article Q11675: Specify the protocol to use with TLS in versions 7.2.3 and below
  • Article Q19541: Specify the protocol to use with TLS in versions 7.3 and above

Recommendations:

Trustwave recommends you evaluate these options based on organizational requirements.

However a minimum of Medium strength combined with high version level protocol would be recommended to ensure security. Lower strength ciphers are no longer considered to be secure.

  • The "low" option has been renamed "Insecure Compatibility" to reflect that these ciphers should not be used, unless absolutely required.

Notes:

  • Trustwave SEG 8.0 and above renames the "low" option to Insecure Compatibility. This setting should not be used, unless absolutely required.
  • Trustwave SEG 7.5.7 implements a new version of OpenSSL that uses new Diffie-Hellman cipher suites. Some older email software is not compatible with these suites and fails to negotiate. If you encounter issues sending email over TLS with version 7.5.7 or above, upgrade to 8.0, or see article Q20741 for a suggested resolution.
  • Trustwave SEG 7.3.5 disables use of ciphers with Anonymous Authentication, as well as MD5, RC4, and IDEA ciphers. Disabling these ciphers meets current best practices. Note that SSLv2 is effectively disabled by this change as no ciphers will be available for use with this protocol version.
  • MailMarshal SEG 7.0 introduces rule based certificate testing. This ability can also enhance security. For more information see the documentation for the rule condition "Where the negotiated TLS parameters match criteria" (available for both Connection and Content Analysis rules).

To contact Trustwave about this article or to request support:


Rate this Article:
     

Related Articles



Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.