Objects (infected files, spam e-mails) rejected by the content vectoring system are usually deleted. However, in some environments this is not acceptable: these objects might be temporarily stored in a location where they can do no harm (that is, in the quarantine), until it can be verified that they do not contain any useful information. The reason for using a quarantine is that occasionally information in a file might be needed even though the file is infected (disinfecting a file is not always possible, and sometimes may damage the non-infected parts of the file as well). Also, virus and spam filters are not unerring; occasionally they might detect a file/e-mail as infected/spam even when it is not. If rejected objects are simply deleted, important information might be lost in these cases.
Tip |
---|
In production environments it is recommended to use multiple content filtering engines to examine the same traffic to reliably detect viruses. Zorp ZCV fully supports the use of multiple content vectoring engines to inspect the same content. |
Published on May 30, 2024
© BalaSys IT Ltd.
Send your comments to support@balasys.hu