Content Security
The Internet gives users access to a wide range of downloadable software
and content. While in the past administrators could easily "lock down"
desktop systems by removing floppy drives, Internet access lets anyone
with a Web browser download an enormous amount of content. This content
ranges from valuable business-related information and software to time-wasting
games to pirated movies or MP3 files. In order for organizations to give
their users the Internet access they need to do their job, without overwhelming
the corporate network with potentially dangerous content, its essential
for administrators to be able to create and manage policies governing who
can download what types of content from the Internet. A proxy server is required
to achieve this. As enterprises move
to tighten security against known viruses, new Malicious mobile code viruses
such as Nimda and Code Red, enter the network as embedded executables (e.g.
ActiveX, JavaScript, Visual Basic Scripts, etc).
Unfortunately, today's firewalls are not designed to secure against
cross-packet or object level threats, such as malicious mobile code viruses. A new layer of content security infrastructure has emerged
using proxy server technology that, in
combination with the firewall, is optimized to protect networks from content-level
threats.
The BlueCoat Solution
BlueCoat's Proxy SG range of secure web proxy servers provide a robust and flexible way to
manage content-based threats whether they originate from inside or outside
the firewall. In addition, they provide the visibility and flexible policy capabilities needed
to manage and enforce Enterprise Web security policies.
With Blue Coat products, security administrators can:
-
Block potentially dangerous active content.
-
Strip and replace potentially dangerous active content from web page, while
still serving remainder of the web content.
-
Send potentially dangerous active content to an off-box Malicious mobile code
antivirus server, based on security policy (e.g. content type, user, destination
IP, etc.)
-
Implement granular stripping of active content.
For example, strip Visual Basic scripts for all users, but allow ActiveX
for certain people.
-
Block specific file extensions and mime-types from specific groups of users.
-
Restrict the use of certain methods for a given user request.
For example, a company may determine that only a certain group of employees
are allowed to post information to a partner site or accept attachments
in web-based email.
-
Restrict upload of information via multi-part forms or web-based email
in order to prevent intellectual property from leaving the company.
-
Allow only use of specific browser types due to potential security holes
in non-approved browsers.
For example, security admins can enforce security policies to only use
a specific version of the Internet Explorer browser, with a patch that
has fixed certain security vulnerabilities.
-
Limit, or strip and replace what information is available in certain content
headers so that information about the corporate network doesn't find its
way into the Internet.
|
