Web Security Service Policy Guide Version 6.10.4.1/OCT.12.2018 Symantec Web Security Service/Page 2 Policy Guide/Page 3 Copyrights Copyright © 2018 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other coun- tries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA 94043 www.symantec.com Policy Guide/Page 4 Symantec Web Security Service Policy Guide The Symantec Web Security Service solutions provide real-time protection against web-borne threats. As a cloud-based product, the Web Security Service leverages Symantec's proven security technology as well as the WebPulse™ cloud com- munity of over 75 million users. With extensive web application controls and detailed reporting features, IT administrators can use the Web Security Service to create and enforce granular policies that are instantly applied to all covered users, including fixed locations and roaming users. If the Web Security Service is the body, then the policy engine is the brain. While the Web Security Service by default provides malware protection (blocks four categories: Phishing, Proxy Avoidance, Spyware Effects/Privacy Concerns, and Spyware/Malware Sources, the additional policy rules and options you create dictate exactly what content your employees can and connot access—from global allows/denials to individual users at specific times from specific locations. This document provides policy concepts and describes how to use the Web Security Service portal to define policies. It includes high-level and use case examples. The document breaks out information in three areas. n "About Web Security Service Policy" on page 11 n "Filter Content" on page 14 n "Malware Policy" on page 31 n "Web Application Policy" on page 58 n "SSL Policy" on page 78 n "Policy: How Do I?" on page 96 n "Policy Reference" on page 126 This document contains topics collected from the Web Security Service online documentation. For the complete doc set, see: Symantec Support Site > WSS Documentation Table Of Contents Copyrights 3 Symantec Web Security Service Policy Guide 4 Table Of Contents 4 About Web Security Service Policy 11 About Geolocation Policies 12 Supported Methods 12 Reporting 12 Exception Pages 12 User Privacy 13 Define Policies? 13 Symantec Web Security Service/Page 5 Filter Content 14 About Content Filtering 15 Control User Access to Web Content 17 About the Default Policies 17 Step 1—Review the current Content Filtering policies and adjust if necessary. 18 Step 2—After the Web Security Service begins processing data, monitor employee web use activity. 18 Step 3—(Optional) Configure an exception page that users see when they browse to a blocked web des- tination. 18 About the Content Filtering Rule Editor 19 Content Filter Policy Construct 19 Group and Global Rows 20 Create a new rule? 22 Create Custom Content Filtering Rules 23 Construct and Editor Tutorials 23 Create a List 26 Conflicts with Actions and File Types 27 Allow 27 Activate Policy 28 Exempt URLs from Permanently Blocked Categories 29 Malware Policy 31 About Malware Scanning 32 Base Level 32 Malware Analysis Standard Service 34 Malware Analysis Advanced Service 34 Protect Your Network From Web Threats 36 Content Analysis 36 Malware Analysis 36 Malware Exemptions and Policy 37 Geolocation-Based Polices 37 Web Isolation 37 Threat Protection Policy Editor 38 Malware Policy From Risk Score 40 Web Isolation Policy Based on Risk Score 41 Policy Guide/Page 6 Risk Score Reporting 41 Exempt a Source From Malware Scan 43 Exemptable Sources 43 Exemption Levels 43 Procedure 43 Change Exemption Scanning Level 45 Next Step 46 Exempt a Destination From Malware Scan 47 Exemptable Destinations 47 Exemption Levels 47 Procedure 47 Next Step 49 About Web Isolation 50 What is Web Isolation? 50 Protect Endpoints from Attack 50 Topography 51 About the Two Web Isolation License Types 52 Geolocation—The Advanced Web Security Add-On 52 About Web Isolation Operations 52 Enable Web Isolation 54 Step 1—Enable Web Isolation 54 Step 2—Define an Isolation Policy Rule 54 Isolation Based on Risk Scores 56 Monitor Licensed Capacity 57 Web Isolation Reporting 57 Skype for Business Issue 57 Web Application Policy 58 About Controlling Web Application Access 59 Web Application Category Reference 61 Set Default Web Application Policy to Allow 62 Reference 62 Procedure 62 Set Default Web Application Policy to Block 64 Symantec Web Security Service/Page 7 Reference 64 Procedure 64 Define a User-Based Web Applications Policy 66 Use Case 66 Example Policy 66 Connect to the CASB Audit Service 70 Audit Service Topography 70 Access the CASB Audit App 72 Reference: Supported Web Applications 73 Web Application Policy 73 Add Reporting Users 73 CASB Policy and Reports 74 Reference: Supported Web Applications 74 Take Action on Specific Web Applications 74 View CASB Reports 77 SSL Policy 78 About Scanning Encrypted Traffic 79 Next Step 82 Examine Encrypted (HTTPS) Traffic 83 About the Root Certificate Recommendation 83 Procedure 83 Install Encrypted Traffic Certificates 88 Install SSL Root Certificate for Chrome Browsers 89 Install SSL Root Certificate for Mozilla Firefox Browsers 91 Install SSL Root Certificate for Microsoft Internet Explorer Browsers 93 Install SSL Root Certificate for Safari Browsers 94 Troubleshoot Dropped SSL Connections 95 Dropped SSL Connections 95 Policy: How Do I? 96 Define Object Lists to Use in Custom Policy 97 Use Case Procedure 97 Geolocation Objects 100 Modify the Default Exception Notifications 101 Policy Guide/Page 8 Customize the User Notification Template 105 Tips 105 Use Cases 105 The Editor 105 Examples 106 Best Practices 108 Provide Browsing Coaching to Users 109 Policy Example—Prevent Unauthenticated User Access to Content 110 Allow Individuals Access to Blocked Content 112 Create Policy From a Reported User 114 Create Policy Based on Reporting Usernames 118 Create A Reporting Username Policy 118 Advanced Policy Example—Set Web Access Times 119 Policy Example—Define Policy For Mobile Users 121 Policy Example—Block Application Actions 122 Force Safe Searches 124 Policy Reference 126 Reference: Updated Content Filtering Categories 127 Reference: Role-Based Access Fields 130 Reference: File Types Detected by Advanced Policy 131 Lossless Audio 133 Lossy Audio 133 Other Music Formats 134 Playlist Formats 135 Audio Editing and Music Production Formats 135 HTTP File Extensions 140 HTTP Response Headers 140 Content Dispositions 140 HALO Engine 141 TrackMania United/Nations Forever Engine 141 DOOM Engine 141 Quake Engine 141 Unreal Engine 142 Symantec Web Security Service/Page 9 Duke Nukem 3D Engine 142 Diablo Engine 142 Other Formats 142 Color Palettes 143 Raster Graphics 143 Vector graphics 145 3D graphics 146 Other 147 Cursors 148 Financial Records 148 Documents 149 Mathematical Markup Language (MML) 150 Page Description Language 150 Personal Information Manager 151 Presentation 151 Project Management Software 151 Formats of files used in software for bibliographic information (citation) management. 151 Spreadsheet 151 Tabulated data 152 Object Code, Executable Files, Shared and Dynamically-Linked Libraries 154 Object Extensions 155 Source Code for Computer Programs 155 Video File Formats 157 Video Editing & Production formats 158 Microsoft Virtual PC/Virtual Server 159 EMC VMware ESX/GSX/Workstation/Player 159 Virtualbox 159 Parallels Workstation 159 Policy Guide/Page 11 About Web Security Service Policy For the Symantec Web Security Service solution, policy refers to configuration controls that restrict or allow network and web elements such as IP addresses and content filtering categories. Only Web Security Service users in the Admin Role can define the policies that comprise a Secure Web Gateway solution. Policy controls are flexible and allow you to apply global settings (basic policy) or granular rules (advanced policy, Content Filtering only). For example, you can determine what happens to requests based on the role of requester. In the above example, Web Security Service policy is defined to achieve the following: n A—Allow a network subnet, which requires the highest performance level possible, to bypass Web Security Service malware scanning, but explicitly block another specific destination. For example, you do not want Group B allowed access to sensitive locations that have company IP. n B—Allow the Sports website category, but deny Gambling sites. n C—Allow access the Facebook social networking web application but within Facebook block games; allow webmail