Web Security Service Policy Guide Revision: NOV.07.2020 Symantec Web Security Service/Page 2 Policy Guide/Page 3 Copyrights Broadcom, the pulse logo, Connecting everything, and Symantec are among the trademarks of Broadcom. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Copyright © 2020 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. For more information, please visit www.broadcom.com. Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliability, function, or design. Information furnished by Broadcom is believed to be accurate and reliable. However, Broadcom does not assume any liability arising out of the application or use of this information, nor the application or use of any product or circuit described herein, neither does it convey any license under its patent rights nor the rights of others. Policy Guide/Page 4 Symantec WSS Policy Guide The Symantec Web Security Service solutions provide real-time protection against web-borne threats. As a cloud-based product, the Web Security Service leverages Symantec's proven security technology, including the WebPulse™ cloud community. With extensive web application controls and detailed reporting features, IT administrators can use the Web Security Service to create and enforce granular policies that are applied to all covered users, including fixed locations and roaming users. If the WSS is the body, then the policy engine is the brain. While the WSS by default provides malware protection (blocks four categories: Phishing, Proxy Avoidance, Spyware Effects/Privacy Concerns, and Spyware/Malware Sources), the additional policy rules and options you create dictate exactly what content your employees can and cannot access—from global allows/denials to individual users at specific times from specific locations. PDF Part One The WSS portal provides several policy editors, plus enhancements if you obtain add-on licenses. To familiarize you with how the WSS evaluates the various policies, the first part of this document presents a policy introduction. Each sections provides a brief introduction and discusses policy evaluation in the order that the WSS processes web transactions. PDF Part Two The remainder of the document expands on policy concepts and policy editors, plus add-on solutions such as Cloud Firewall Service and CASB. It includes high-level use case examples. Table Of Contents Symantec WSS Policy Guide 4 PDF Part One 4 PDF Part Two 4 Table Of Contents 4 WSS High Performance Policy Tuneup—Begin Here 11 Policy Overviews 11 Web Use 11 SSL Interception 12 Location Policy (Authentication) 12 Threat Protection 12 Policy Testing Best Practices 13 WSS Policy Custom Shop 01—Bypass 14 Why Bypass Certain Destinations? 14 Technical Requirements 14 Portal Locations 14 Best Practices 14 Symantec Web Security Service/Page 5 WSS Policy Custom Shop 02—SSL Interception 15 Why Intercept SSL Traffic? 15 Technical Requirements 15 Portal Location 15 Use Case 15 WSS Policy Custom Shop 03—Authentication Exemptions/Locations 18 What is Authentication Exemption? 18 What is Location Policy? 19 WSS Policy Custom Shop 04—Content Filtering 21 What is Content Filtering? 21 Technical Requirements 21 Portal Location 21 About the Editor 21 Use Case 22 WSS Policy Custom Shop 05—Threat Protection 25 What is Content Analysis? 25 Technical Requirements 25 What is Malware Analysis? 25 Technical Requirements 26 About the Threat Protection Policy Editor 26 About Exemptions 26 WSS Policy Custom Shop 06—Risk Score 28 What is Risk Score? 28 Technical Requirements 28 Portal Location 28 Enhanced Threat Protection Policy Editor 28 Strategic Policy Example 29 WSS Policy Custom Shop 07—Geolocation 31 What is Geolocation? 31 Technical Requirements 31 Portal Location 31 Enhanced Policy Editors 31 Strategic Policy Example 32 WSS Policy Custom Shop 08—Web Isolation 33 What is Web Isolation? 33 Technical Requirements 33 Portal Location 33 About the Editor 33 WSS Policy Custom Shop—Roll Out 35 Policy In Review 35 Full Help Topics 35 About Web Security Service Policy 37 About the Traffic Evaluation Order 37 SSL Policy 39 About Scanning Encrypted Traffic 40 Policy Guide/Page 6 Distribute WSS Root Certificate to Endpoints 44 Best Practice—Replacing a Certificate 44 Procedure—Obtain Certificate and Propagate 44 Related Topics 45 Install SSL Root Certificate for Chrome Browsers 46 Install SSL Root Certificate for Mozilla Firefox Browsers 48 Install SSL Root Certificate for Microsoft Internet Explorer Browsers 50 Install SSL Root Certificate for Safari Browsers 51 Create SSL Policy 52 Technical Requirement 52 Procedures 54 Deploy a Self Managed Certificate for SSL Interception 58 About Integrating HSM 58 Frequently Asked Questions 58 Technical Requirements 59 Troubleshoot Dropped SSL Connections 68 Filter Content 69 About Content Filtering 70 Control User Access to Web Content 72 About the Default Policies 72 Step 1—Review the current Content Filtering policies and adjust if necessary. 73 Step 2—After WSS begins processing data, monitor employee web use activity. 73 Step 3—(Optional) Configure an exception page that users see when they browse to a blocked web destination. 73 About the Content Filtering Rule Editor 74 Content Filter Policy Construct 74 AND/OR Constructs 75 Group and Global Rows 75 Group A Rules 75 Group B Rules 76 Global Rules 76 Create Custom Content Filtering Rules 78 Construct and Editor Tutorials 78 Activate Policy 84 Exempt URLs from Permanently Blocked Categories 85 Prevent a Domain From Routing to WSS 86 Notes 86 Procedure—Manually Add Domain Entries 86 Import IP Address Entries From a Saved List 87 Prevent IP/Subnet From Routing to the Web Security Service 88 Notes 88 Procedure—Manually Add IP Addresses 88 Import IP Address Entries From a Saved List 89 Modify the Default Response Page 90 Procedure 91 Troubleshooting Assistance 93 Symantec Web Security Service/Page 7 Customize the Response Pages 94 Portal Location 94 Use Cases 94 Best Practices 94 The Editor 95 Examples 96 Web Application Policy 99 About Controlling Web Application Access 100 Always Block or Always Allow a Web Application 100 Allow a Web Application But Block an Action 100 Define Who Can Access Web Applications 101 Web Application Category Reference 102 About the CloudSOC Integration 103 CASB Gatelets Topography 103 About the Traffic Evaluation Order 105 Current Limitations 106 Integrate With CloudSOC 107 Technical Requirements 107 Procedure 107 CASB Gatelets Solution Only 108 Delete the CloudSOC Integration 110 Set Default Web Application Policy to Allow 112 Reference 112 Set Default Web Application Policy to Block 114 Reference 114 Define a User-Based Web Applications Policy 116 Use Case 116 Malware Policy 120 About Malware Scanning 121 Base Level 121 Basic Level Protection 122 Malware Analysis Standard Service 123 MASS License Protection 123 Malware Analysis Advanced Service 123 Supported Common Documents and File Types 123 Protect Your Network From Web Threats 126 Content Analysis 126 Malware Analysis 126 Malware Exemptions and Policy 127 Geolocation-Based Polices 127 Web Isolation 127 Threat Protection Policy Editor 128 Malware Policy From Risk Score 130 Web Isolation Policy Based on Risk Score 132 Risk Score Reporting 132 Policy Guide/Page 8 Exempt a Source From Malware Scan 134 Exemptable Sources 134 Exemption Levels 134 Procedures 134 Change Exemption Scanning Level 136 Exempt a Destination From Malware Scan 138 Exemptable Destinations 138 Exemption Levels 138 Procedures 138 Exempt Files From Error Handling 141 About Web Isolation 142 What is Web Isolation? 142 Protect Endpoints from Attack 142 Topography 143 About the Two Web Isolation License Types 144 Geolocation—The Advanced Web Security Add-On 144 About Web Isolation and UPE 144 About Web Isolation Operations 144 Traffic 145 Enable Web Isolation 146 Procedure 146 Step 1—Enable Web Isolation 147 Step 2—Define an Isolation Policy Rule 147 Isolation Based on Risk Scores 148 Monitor Licensed Capacity 149 Web Isolation Reporting 149 Skype for Business Issue 150 About Web Isolation With UPE 151 Technical Requirements 151 Limitations 151 Supported Deployments 151 Web Isolation Policy Template 154 Technical Requirements 154 About the Policy Objects 154 UPE and Web Isolation Policy Template 154 About SSL Interception of Mobile Traffic (UPE) 155 About Failure Modes 155 About Geolocation Policies 156 Supported Methods 156 Reporting 156 Exception Pages 156 User Privacy 157 CFS Policy 158 About the Cloud Firewall Service 159 Licensing and Use Cases 159 Symantec Web Security Service/Page 9 Supported Connectivity Matrix 163 CFS Traffic Overviews 163 About the CFS Policy Editor 167 Technical Requirements 167 Limitations 167 About the CFS Policy Editor 167 CFS Policy Construct 167 Global Rules 168 Create Custom CFS Rules 169 CFS Policy Planning and Examples 181 Plan CFS Policy Enforcement 181 Example Planning Use Case 181 Example Policies 183 Default Deny Policy? 184 Policy: How Do I? 185 Service 185 Content 185 User-Related 185 Define Object Lists to Use in Custom Policy 186 Geolocation Objects 189 Modify the Default Response Page 190 Procedure 191 Troubleshooting Assistance 193 Customize the Response Pages 194 Portal Location 194 Use Cases 194 Best Practices 194 The Editor 195 Examples 196 Provide Browsing Coaching to Users 199 Policy Example—Prevent Unauthenticated User Access to Content 201 Allow Individuals Access to Blocked Content 203 Create Policy From a Reported User 205 Create Policy Based on Reporting Usernames 209 Advanced Policy Example—Set Web Access Times 211 Policy Example—Define Policy For Mobile Users 213 Policy Example—Block Application Actions 214 Force Safe Searches 216 Policy Reference 217 Reference: Updated Content Filtering Categories 218 Reference: Role-Based Access Fields 223 Reference: File Types Detected by Advanced Policy 224 Policy Guide/Page 11 WSS High Performance Policy Tuneup—Begin Here Next to routing traffic to the Web Security Service, defining policies is the most important aspect of your web security solution.