Authentication, Encryption, and Data Loss Prevention
This domain tests trust and confidentiality controls: authenticating senders, validating recipients, encrypting mail in transit or end-to-end, and stopping sensitive data from leaving. Expect questions that distinguish authentication from authorization, TLS from message encryption, and DLP from antivirus.
Authentication and transport security
- SMTP AUTH authenticates submitting users, typically against LDAP or AD, RADIUS, or local accounts. Use it on submission ports for roaming users.
- Authentication profiles are referenced by policies; directory services also support recipient verification.
- TLS profiles control opportunistic or required TLS, certificates, and cipher settings. TLS protects the SMTP hop, not the message at rest or after the gateway.
- Certificate validation matters: an expired or mismatched certificate causes TLS failures that look like delivery problems.
Message encryption
- IBE, Identity-Based Encryption, lets FortiMail encrypt to a recipient identity; the recipient retrieves mail through a secure portal and enrollment process.
- S/MIME uses recipient certificates, often published in LDAP. End-to-end S/MIME can remain encrypted through FortiMail, so content and DLP inspection may not see the body.
- Encryption policies can trigger on keywords, recipients, or content profiles.
DLP
- DLP profiles contain sensors and patterns: predefined patterns for credit cards or identifiers, custom regex, document fingerprints, and watermarks.
- DLP actions include allow, quarantine, block, and encrypt. DLP is usually applied to outbound mail in the recipient policy.
- Scanning encrypted attachments or S/MIME bodies is limited; do not assume DLP sees inside end-to-end encrypted content.
Worked example
Finance must send to a partner over TLS and must not leak card numbers. Create a TLS profile requiring TLS for the partner domain and an outbound recipient policy for Finance that applies a DLP profile with a card-number sensor. Set the DLP action to block or quarantine. Reason: TLS satisfies the transport requirement but does not inspect content, so DLP is still needed. If the message is S/MIME-encrypted end-to-end, the DLP sensor may not match.
Traps
- Thinking TLS encrypts stored mail or prevents data leaks by itself.
- Forgetting IBE recipient enrollment, then calling delivery broken.
- Applying DLP only inbound when the risk is outbound.
- Missing S/MIME certificates and expecting encryption to succeed.
- Confusing authentication, who you are, with authorization, what you may relay.