Content Security
Concepts to know
Content security covers email and web traffic. For email, know Cisco Secure Email: listeners, Host Access Table (HAT), recipient access tables, mail policies, content filters, message tracking, SPF/DKIM/DMARC authentication, outbreak filters, AMP, and encryption. For web, know Cisco Secure Web Appliance: explicit versus transparent proxy, PAC files, URL categorization, application visibility and control, anti-malware, SSL decryption, and authentication. Cloud equivalents exist, but the policy logic is similar.
Traps
- SPF checks the envelope sender/return-path; DKIM signs selected headers and body; DMARC aligns SPF or DKIM with the From domain and sets policy (none, quarantine, reject).
- HAT is evaluated before mail policies; a sender blocked there never reaches content filters.
- Explicit proxy requires client configuration; transparent proxy uses WCCP or PBR and can break without proper redirection.
- SSL inspection requires a trusted certificate on clients; otherwise users see errors.
- URL filtering categories differ from reputation scores; do not conflate them.
Worked example
Inbound mail flows through the listener, then the HAT decides the sender group, recipient access applies, and finally mail/content policies and outbreak or AMP scanning run. If a spoofed message passes, check SPF, DKIM, and DMARC alignment before tuning content filters. Rule of thumb: authenticate the sender domain first, then filter content.