Email Spam Filtering

Proofpoint is the next-generation email filtering system Central Piedmont uses to improve our protection from spam, viruses, malware, phishing scams, and other unwanted messages.

Security researchers at SANS institute indicate that malicious email attachments and hyperlinks continue to be the most common target for cyber criminals in 2018. Malicious emails have become an increasingly pervasive security problem, and Central Piedmont is attacked on a regular basis. Central Piedmont receives many phishing emails daily that try to steal Central Piedmont employee passwords or install malicious software on our computers which pose a great security threat. Proofpoint protects users by blocking links to known malicious websites and removing email attachments containing malware by scanning all incoming mail, deleting identifiable malware and viruses, and quarantining potential junk email before delivering messages to Central Piedmont faculty and staff. Proofpoint also includes improvements that will help decrease the junk and malicious email received by the college.

Advantages of Proofpoint include:

new web console to manage quarantine with more control over what reaches your mailbox and the ability to maintain personal blocked and safe senders lists
new End User Digest sent to your Central Piedmont inbox at 3 p.m. daily of emails that have been quarantined with the ability to release them to your inbox
enhanced detection for malicious attachments and phishing and prevention of infections to Central Piedmont resources

Proofpoint User Guide

You can access your Proofpoint personal quarantine and settings at any time by visiting spam.cpcc.edu, logging in with your Central Piedmont username and password, or by clicking the "Manage my Account" link in your End User Digest email.

Modify Spam Detection Level Settings
There are two different spam detection level settings that are available (relaxed and strict). The default setting is relaxed for quarantined spam email to deliver to your Spam - Quarantined folder in the spam.cpcc.edu web console, and for all low priority mail to be delivered to your Central Piedmont inbox.

Low Priority Mail (also known as bulk mail) comes from entities that you normally deal with, but are not necessarily directed towards you personally. Examples are marketing advertising emails, survey emails, emails from vendors that got your address from another vendor, etc. These are messages that you might want to see, but don't need to see them in your Central Piedmont inbox as soon as they arrive. Low priority mail messages are put into your quarantined folders labeled "Low Priority Mail - Delivered" or "Low Priority Mail - Quarantined" depending on what setting you choose. Low priority mail messages are visible both from the Proofpoint web console (spam.cpcc.edu) as well as your End User Digest daily email.

To change your Proofpoint spam detection level:
1. Click Profile in the lower left corner and select which level you want:
  1. Inbound Relaxed (Low Priority Mail - Delivered): All Low Priority Mail will be delivered to your Central Piedmont inbox. Quarantined spam will be delivered to the Spam - Quarantined folder.
    
    If you notice messages in the Low Priority Mail - Delivered folder that you do not want to be delivered to your Central Piedmont inbox in the future, you can block sender.
  2. Inbound Strict (Low Priority Mail - Quarantined): All Low Priority Mail will be held in your Low Priority - Quarantined folder. Quarantined spam will be delivered to the Spam - Quarantined folder.
    
    If you notice messages in the Low Priority Mail - Quarantine folder, you must release the message in order for it to be delivered to your Central Piedmont inbox. If you want messages from this sender to be delivered to your Inbox in the future, you can also allow sender.
Managing and Previewing Your Quarantined Email
All email suspected of being spam is placed in your Spam - Quarantine folder and kept for review for 30 days before being discarded by the system. The 30 day retention of emails in Proofpoint goes for all folders.
- In the lower left corner, click Quarantine, then select the folder you wish to view.
- Click Find in the Menu bar to search for a message in your quarantine by subject and date range:
- You can select a message to preview the contents.
To preview quarantined messages:

If you are unsure whether a message is spam by the subject or sender, you can safely preview the content directly from your message list.
1. Select the message and wait for it to load in the preview pane at the bottom of the screen.
2. Preview the message content at the bottom of the window to determine if the message is spam.
Options for quarantined messages:

You may choose one of the below options from the Menu bar after selecting one or more messages in your list. Available options differ depending on which folder you are in.
- Find: Search for specific messages by sender, subject, and/or age of message.
- Not Spam: Releases the message to your inbox, and in the future, messages like this one will not be classified as spam.
- Release: Deliver the message to your inbox and automatically report that the message was not spam.
- Block Sender: Add the sender of the message to your blocked senders list.
- Delete: Delete selected message(s).
- Allow Sender: Deliver the message to your inbox, add the sender to your safe senders list, and automatically report that the message was not spam.
- Options: Request update digest to your Inbox, refresh the Quarantine Folder for new messages, or delete all messages.
Safe and Blocked Senders Lists
- Safe Senders List: Messages from senders or domains on this list will bypass spam filtering and be delivered directly to your inbox after being screened for viruses and other security threats.
- Blocked Senders List: Messages from addresses or domains in this list will not reach your inbox.
Adding entries to your lists:
1. After selecting the appropriate list, click the New button on the Menu bar.
2. Type the email address or domain you want to add to your list and click Save. Continue creating entries, clicking Save after each addition. When you finish, click Close.
  1. Example: Adding spammer.com (no "@") will block userA@spammer.com and userA@malicious.spammer.com
  2. Example: Adding @spammer.com will block userA@spammer.com
Editing entries in your lists:
1. After selecting the appropriate list, select the checkbox beside the entry with your mouse and click Edit. After making your changes, click Update.
2. To delete entries, select each entry you wish to delete and click Delete.
Understanding Your Proofpoint End User Digest
The Proofpoint email filtering system places messages that are suspected to be spam or other unwanted email into your personal quarantine, where they are held for 30 days to give you time to review them. After 30 days, the messages will be purged from the system and we have no way to retrieve them. Each week day after 3 p.m., you will receive an email update from Proofpoint with a quick overview of what has been caught by the spam filter and placed into your quarantine since the last digest was sent. You have several options available from this email, such as quickly adding an "allow sender" or "block sender," releasing an item from quarantine to your inbox, or marking a message as "Not Spam."

System commands:
- Request New End User Digest: If you'd like a new digest before the scheduled 3 p.m. delivery, click the request new end user digest link from any previous digest and you'll receive full listing of all messages currently in your quarantine.
- Request Safe/Blocked Senders List: Click the request safe/blocked senders list to have a full listing of all your safe and blocked senders emailed to you.
- the Manage My Account link will direct you to the Proofpoint Web Console, where you can access your quarantine, manage your settings, or update your safe and blocked senders lists.
Message commands:
- Release: Delivers the message to your inbox and automatically reports that the message was not spam.
- Release and Allow Sender: Releases the message from the quarantine and sends the message to your inbox. Also adds the sender to your safe senders list.
- Block Sender: Adds the sender to your blocked senders list to ensure these messages are blocked regardless of content in the future.
- Not Spam: Delivers the message to your Inbox, adds the sender to your safe senders list, and automatically reports that the message was not spam.
Proofpoint URL Protection

Proofpoint's URL Defense protects you and Central Piedmont's network resources by blocking access to malicious websites. Links in all email messages are evaluated using a variety of sophisticated techniques to determine the likelihood that they lead back to phishing or malware websites. As part of the process for enhanced scanning/detection for attachments and phishing, Proofpoint rewrites hyperlinks in emails so websites can be checked for malicious activity before users access them.

If you hover over a rewritten link, you will see "https://urldefense.proofpoint.com/v2/url?=" added to the beginning of the original link followed by a string of letters and numbers.

If the link in your message is all text, it will appear as the following:

If a URL containing phishing or malware is clicked, you will see a message that the web page was malicious and blocked. Legitimate sites should load with no delay.

If you believe a website has been blocked unnecessarily (false positive) or believe a fraudulent site has not been blocked (false negative), please contact the Service Desk.
Not Spam?

While Proofpoint filtering is incredibly accurate, no automated system is perfect. We receive an astounding amount of email, and there will be times when a legitimate email message is quarantined as spam. We recommend that you review your quarantined messages periodically, either in your End User Digests or by logging on to your Web Console.

Messages stopped as spam that aren't are called "false-positives" and Proofpoint takes these very seriously. Every time you release a message from your quarantine, this is reported directly to Proofpoint so their engineers can analyze what went wrong and use that information to continually improve detection accuracy.