Web Security Service Registration and Admin Guide Revision: NOV.07.2020 Symantec Web Security Service/Page 2 Page 3 Copyrights Broadcom, the pulse logo, Connecting everything, and Symantec are among the trademarks of Broadcom. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Copyright © 2020 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. For more information, please visit www.broadcom.com. Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliability, function, or design. Information furnished by Broadcom is believed to be accurate and reliable. However, Broadcom does not assume any liability arising out of the application or use of this information, nor the application or use of any product or circuit described herein, neither does it convey any license under its patent rights nor the rights of others. WSS Admin Guide/Page 5 WSS Admin Guide The Symantec Web Security Service solutions provide real-time protection against web-borne threats. As a cloud-based product, the Web Security Service leverages Symantec's proven security technology, including the WebPulse™ cloud community. With extensive web application controls and detailed reporting features, IT administrators can use the Web Security Service to create and enforce granular policies that are applied to all covered users, including fixed locations and roaming users. Symantec Web Security Service/Page 6 Table Of Contents Copyrights 3 WSS Admin Guide 5 Table Of Contents 6 Register Your Web Security Service Portal 8 Technical Requirements 8 Procedure 8 Manage Service Access 16 Allow Access to Outside Personnel 16 Manage Other Admins and Roles 17 Add Service User in the Administrator Role 18 Procedure 18 Add Service User in the Reporting Only Role 20 Procedure 20 Add Service User in a Reviewer Role 23 Procedure 23 Assign Service User Based on Role 25 Switch Roles 26 Assign Roles 26 Change the Role of a Current Service User 28 Disable or Enable Current Service Users 30 Edit Information for a Current Service User 31 User: Change Your Personal Information 32 Reference: Role-Based Access Fields 33 Review Web Security Service User Access 34 XFF Header Controls 35 Generate API Credentials 36 WSS Admin Guide/Page 7 Procedure 36 Download Audit Logs with REST API 38 Step 1—Generate WSS API Credentials 38 Step 2—Use the REST API 38 Filter Options 38 Admin Reference Topics 40 Reference: Required Locations, Ports, and Protocols 41 Symantec Resource 41 Connectivity Methods 41 Authentication 43 Reference: Web Security Service Data Center Ingress IPs 45 Reference: Authentication IP Addresses 46 Reference: Updated Content Filtering Categories 47 Generate API Credentials 52 Procedure 52 Reference: File Types Detected by Advanced Policy 54 Reference: Supported Cipher Suites (Datapath) 87 Reference: Supported Cipher Suites (Portal) 89 Symantec Web Security Service/Page 8 Register Your Web Security Service Portal When you access the Web Security Service for the first time, the browser displays the first page of the Initial Configuration Wizard. The only required tasks are to define the administrator credentials and set an initial default policy template. You can perform all connection configurations and custom policy definitions at a later time. Technical Requirements Before beginning, you must have: n A Subscription ID, which was sent in a Welcome email by Symantec. n A Primary Administrator email address. Your WSS portal account will be tied to this address. n The WSS uses the Okta Identity Provider (IdP) to authorize Admin access. o If you had a Symantec NSL account before the migration to Okta, Symantec Enterprise sent you (the Admin address on record) an email that describes how to activate your new Okta account. o If access to your portal account requires access through a SAML IdP, Symantec Enterprise sent an additional email that provides assertions required to configure the IdP. Procedure Tip: Certain wizard pages provide configuration options, such as adding a location or adding the Auth Connector. No such configurations are required to complete the initial registration process. You can perform these specific connectivity tasks from within the portal at any time following registration. Some methods require considerable planning. The options are provided for experienced WSS users who already know this information and require a quicker deployment process. 1. In a browser, enter https://portal.threatpulse.com/register. Register Your Web Security Service Portal/Page 9 a. Enter the Email Address and name of who will be the primary WSS administrator. b. Enter your Subscription ID. c. Attest that you have read the EULA. d. Click Register. The portal displays a dialog informing you to check the newly-registered email account. Symantec Web Security Service/Page 10 e. In that mail, click the link to create your Broadcom password. f. Close the dialog. g. Understand and accept the terms. h. Log in. 2. If your company requires multiple-factor authentication (MFA), you are prompted to complete that setup. Register Your Web Security Service Portal/Page 11 Tip: To perform post-registration MFA changes, access https://avagoext.okta.com/. 3. WSS begins the second initial configuration phase, the first of which is Product Configuration. Symantec Web Security Service/Page 12 Locate the Web Security product line and click the Configure link, which is in the Action column. 4. WSS displays the Default Policy page. Register Your Web Security Service Portal/Page 13 a. Select the Policy Source. n Select WSS Portal, which is the cloud security service default. n The Management Center option applies only to the Unified Policy Enforcement solution, which uses Symantec (Symantec) Management Center to implement Blue Coat ProxySG appliance-defined policies in the portal. See the Symantec Unified Policy Enforcement Solution documentation. b. Default Policy—By default and unchangeable, WSS blocks access to known malware sources and some inappropriate content. n Liability Concerns n Child pornography n Security Concerns n Spam n Security Threats n Malicious Outbound Data/Botnets n Malicious Sources n Phishing n Proxy Avoidance The following policy controls provide a baseline policy against all other transactions: n Monitor—Provides only malware scanning. Users are allowed to browse anywhere. n Child pornography n Malicious Outbound Data/Botnets n Malicious Sources n Phishing n Proxy Avoidance n Spam n Standard— In addition to the Monitor categories, provides malware scanning plus blocks access to the most common questionable content, such as mature. n Adult/Mature Content n Controlled Substances n Gambling n Hacking Symantec Web Security Service/Page 14 n Nudity n Peer-to-Peer (P2P) n Piracy/Copyright Concerns n Placeholders n Pornography n Potentially Unwanted Software n Remote Access Tools n Scam/Questionable/Illegal n Suspicious n High—In addition to the Monitor and Standard categories, provides malware scanning plus blocks access to the most common questionable content and common categories that are not work-related, such as social networking sites. n Dynamic DNS Host n Extreme n Intimate Apparel/Swimsuit n Mixed Content/Potentially Adult n Sex Education n Sexual Expression n Software Downloads n Violence/Hate/Racism n Weapons Regardless of this selection, you can further modify policy from the WSS portal after completing the registration process. c. Click Next. 5. Privacy— n WSS reports are generated from data in access logs, which are populate by employee web use. Your organization might require stricter privacy concerns. You can suppress information such as usernames from reports. 6. The wizard progresses through three more screens: Mobile Users, Static Location, and Auth ConnectorSetup, with each providing an option and/or configure additional components. Advanced WSS admins will understand what these configurations are, but you can configure these connectivity and authentication methods at a later time. For each of these screens, click Next. 7. The final wizard screens confirms that you have completed the registration process. Click Go To Product Setup (lower- right corner). Register Your Web Security Service Portal/Page 15 8. WSS returns to the Product Configuration screen; the Web Security product line now displays Configured as the Configuration Status. Click Continue (lower-right corner). WSS portal loads and displays the Overview Dashboard landing page. These reports are not populated as you have yet to have clients sending traffic to the service. Next Step You are ready to configure an connectivity method—that is, configure your network assets to route traffic to the service for threat protection and content policy checks. Symantec Web Security Service/Page 16 Manage Service Access Only Admin Users can modify other Web Security Service users. For example, change the default role or temporarily disable a user's access. Allow Access to Outside Personnel As you work with Symantec Technical Support or your partner provider, personnel can assist with issues by logging into your portal account through WSS Operations. You must grant permission to allow access. You can set your account to always allow, never allow, or temporarily allow. Tip: Customer accounts created after the July 26, 2019 service update have the option in the configuration wizard to set the initial access setting. For example, access is set to deny, but you use this feature to allow temporary access as required. 1. Navigate to Account Configuration > Administrators. 2. The first row in the table (Support Operators) contains the option. Select it and click Edit. The portal displays the Edit Support Access dialog. a. Allow Support Operators to access my account is the master setting. Clearing the toggle means your account cannot be accessed. Enabling it allows access. b. If you allow access, select if the access is Permanent or Temporary. Manage Service Access/Page 17 c. If Temporary, specify the Expiry date and time when portal access returns to denied. For example, a Support person asks for access until the end of the business day.