Proofpoint is a security company that offers multiple solutions to protect your organization’s online communications and digital assets. Proofpoint URL Defense is part of their Business, Advanced and Professional packages and works as an anti-phishing tool by re-writing embedded links in your e-mail messages.

How URL Defense Works

When you get an incoming message with a URL inserted in the message body, you cannot be sure the link redirects to a legitimate web address. In other words, the URL may well lead to an infected website or a malicious address created solely for phishing purposes.

URL Defense rewrites the URL in a fashion to redirect you to Proofpoint’s servers before you access the website to which the link refers and embeds some unique codes to track your clicks and user behavior.

The main advantage of such a technology and anti-phishing method is that it effectively protects you against opening links to perfectly legitimate websites, which have been compromised only recently, within a few hours before you open the message.

There is a good chance for an e-mail filter to miss a link to a recently hacked site in a message, while URL Defense guards you exactly against that.

You should keep in mind that URL Defense does not rewrite URLs inside encrypted or protected messages, so be careful when opening such emails. The same applies to attachments inside your e-mail messages.

How to Use Proofpoint URL Defense

Despite being included in all service tiers, you should be aware that URL Defense is disabled by default.

You can activate or deactivate URL Defense in your Proofpoint Essentials portal. To activate it, go to Proofpoint Essentials’ dashboard:

• Administration Section
• Then, open Account Management
• Select Features option
• Click on Enable to activate.

Once you have URL Defense activated, you can check for rewritten URLs by simply hovering your mouse pointer over a link in your message. If the link is rewritten, you will see a link appearing as https://urldefense.proofpoint.com/v1/url? =...

After you click on a protected URL, the Proofpoint servers analyze the respective site and redirect you there if no threat is detected. When the URL in question is suspicious in some way, you will get a message that URL Defense is blocking the website.

The service for finding fake or compromised URL’s is working in real-time and you should not experience lower speeds due to having URL Defense enabled on your systems.

The anti-phishing service checks each URL upon every click, which is a measure to protect you against malicious URLs that have been safe in the past. Actually, this feature gives you continuous protection as any legitimate URL address can be compromised at any time. If you have clicked on a safe link in the past, you can rest assured the URL is still safe the next time you open a link to this website.

Conclusion

Tools like URL Defense do not provide complete protection against phishing e-mails and malicious links inside a message but they markedly improve your overall e-mail security.

They also provide security experts with additional tools and data to analyze should a malicious URL penetrates your perimeter. The tracking codes that the service embeds into the URL defense mechanism allow security researchers to uncover and analyze how an attack occurs and develops, which in turn enables you to enhance your cyber defenses against future phishing attacks.