To ensure that executive messages are originating from legitimate sending addresses, the

administrator must take two steps:

Create an incoming content filter with the Forged Email Detection condition. This will allow the

administrator to detect and block messages that have a forged “From: header” that matches or is

similar to any of the names in a content dictionary.

Create a content dictionary including a list of the names that are being spoofed. This will allow the

administrator to specify the names of the executives that are being targeted by spoofing attacks and

use them in the Forged Email Detection condition. The other options are not relevant or sufficient for

this task. Reference: [Cisco Secure Email Gateway Administrator Guide - Forged Email Detection] and

[Cisco Secure Email Gateway Administrator Guide - Creating Content Dictionaries]