Restricted vs Suspicious Attachments

Hi,

The main difference between a suspicious attachment and a restricted one is that a suspicious file is one considered to be more prone to being infected, such as Javascript or HTML files. Restricted attachments would be file that would are "controlled" either by an HR or IT policy; archives or multimedia files could be considered files that should be blocked based on their size or content.

The help documentation that comes bundled with the email appliance distinguishes between the two accordingly:

- Suspect Attachments: Messages with attachment types that are likely to contain viruses. By default, for all users, messages with suspect attachments are quarantined, the attachments are removed, and the messages are delivered. A banner is added advising users that potentially dangerous attachments were identified and removed. [...]

- Restricted Attachments: Allows administrators to create a customized policy for blocking messages with specific kinds of attachments. By default, for all users, messages with restricted attachments are quarantined, the attachments are removed, and the messages are delivered. A banner is added advising users that potentially dangerous attachments were identified and removed. [...]

Regardless which Sophos gateway product you use, you can define what is suspicious and what is restricted yourself. The built-in lists can be modified accordingly to meet your organization's needs, along with the action that needs to be taken.

Hi,

The main difference between a suspicious attachment and a restricted one is that a suspicious file is one considered to be more prone to being infected, such as Javascript or HTML files. Restricted attachments would be file that would are "controlled" either by an HR or IT policy; archives or multimedia files could be considered files that should be blocked based on their size or content.

The help documentation that comes bundled with the email appliance distinguishes between the two accordingly:

- Suspect Attachments: Messages with attachment types that are likely to contain viruses. By default, for all users, messages with suspect attachments are quarantined, the attachments are removed, and the messages are delivered. A banner is added advising users that potentially dangerous attachments were identified and removed. [...]

- Restricted Attachments: Allows administrators to create a customized policy for blocking messages with specific kinds of attachments. By default, for all users, messages with restricted attachments are quarantined, the attachments are removed, and the messages are delivered. A banner is added advising users that potentially dangerous attachments were identified and removed. [...]

Regardless which Sophos gateway product you use, you can define what is suspicious and what is restricted yourself. The built-in lists can be modified accordingly to meet your organization's needs, along with the action that needs to be taken.