The Web settings in your security software is a crucial feature that safeguards you while browsing the internet. It actively scans web traffic, downloads, and scripts to block malware, phishing attempts, and other online threats, ensuring a safer browsing experience.
Web Shield
Web Shield settings are the controls for your security software’s primary defence against online threats. They allow you to customize how your program actively protects you from malware, phishing, and dangerous websites as you browse the internet, ensuring a safer digital experience.
Navigating to Web Shield Settings
To access and configure Web Shield settings within a specific policy:
⦁ Go to “Policy Management”: From the EDR LAN dashboard, click on the “Policy Management” section.
⦁ Select the Desired Policy: A list of available policies will be displayed. Identify and click on the specific policy you wish to modify.
⦁ Toggle the Web Shield Settings within the Policy: Within the selected policy’s configuration view, look for a section or tab related to “Web Shield Setting”.
Web Shield Settings Include
A. Web scanning for viruses: A real-time security feature, including websites, to detect and block malicious content like viruses, malware, and phishing attempts before they can harm your device.
B. Block dangerous sites: Used to block unknown sites that are dangerous and affect your system.
C. Enable Anti-Phishing: Anti-Phishing is a vital security feature that acts as your defence against online scams. It helps your security software identify and block fake websites and messages designed to trick you into revealing sensitive information like passwords or credit card details, keeping your personal data safe.
D. Enable Log: Used for detailed log creation for further analysis. It gives more information about what settings and blocking details in detail.
E. Add-Ware-Gen: Refers to software that primarily focuses on displaying unwanted advertisements to the user. It often comes bundled with free software, masquerading as a legitimate tool, or can be installed without clear consent.
Update Policy: After updating the policy, it is used to apply the policy to the required machine present in the ‘Key details’ tab.
Advance Web Shield Settings Include
A. HTTPS Mode: Scan HTTPS connections.
B. HTTPS2 Mode: Enhanced HTTPS scanning.
C. Scan All Ports: Monitor all network ports.
D. Download Scan: Scan downloaded files.
E. Botnet IP Protection: Blocks harmful botnet IPs from attacking your system.
F. Encrypted Traffic Inspection: Provides a dedicated capability to inspect and scan encrypted network communications, such as SSL/TLS traffic, to detect and block threats hidden within secure connections.
G.Bad Domain Live Feeds: Fetches hourly updated harmful domains for automatic blocking.
H.Local IP Scanning: Filters locally hosted sites from scan results for improved accuracy and security.
Web Protection
Web Protection is a real-time security feature that acts as a filter between your browser and the internet. Its main goal is to prevent access to unsafe, suspicious, or unauthorized websites before any data reaches your system.
Web Restriction Types
There are 4 types of web restriction modes you can configure:
- Allow All
Description: All websites are accessible.
Steps to Enable:
⦁ Click the Web Protection Toggle to turn it on.
⦁ Select the “Allow All” option.
⦁ Click “Update Policy” to save your changes. - Block All
Description: Blocks access to all websites.
Steps to Enable:
⦁ Click the Web Protection Toggle.
⦁ Select the “Block All” option.
⦁ Click “Update Policy” to save your changes. - Allow All Except Block-list
Description: All websites are allowed except those you manually block.
Steps to Enable:
⦁ Click the Web Protection Toggle.
⦁ Select “Allow All Except Block-list”.
⦁ Enter the URL(s) you want to block in the “URL for Blocking” text field. The URLs will be displayed in a list below.
⦁ Enter the Regex Pattern you want to block in the “Regex Pattern for Blocking” text field.
⦁ Enter the keyword that you want to block. A domain group means one main domain that has many subdomains; through the main domain, we allow them.
⦁ Click “Update Policy” to apply the changes. - Block All Except Allow-list
Description: All websites are blocked except those you manually allow.
Steps to Enable:
⦁ Click the Web Protection Toggle.
⦁ Select “Block All Except Allow-list”.
⦁ Enter the URL(s) you want to allow in the “URL for Allowing” text field. The URLs will appear in a list below.
⦁ Enter the Regex Pattern you want to allow in the “Regex Pattern for Allowing” text field. A domain group means one main domain that has many subdomains; through the main domain, we block them.
⦁ Click “Update Policy” to save your changes.
Web Category
Navigating to Web Category Restrictions
To access and configure Web Category Restrictions within a specific policy:
⦁ Go to “Policy Management”: From the EDR LAN dashboard, click on the “Policy Management” section.
⦁ Select the Desired Policy: Identify and click on the specific policy you wish to modify.
⦁ Go to the “Web Setting”: The Web Protection Toggle must be enabled to access the Web Category Restrictions.
Web Category Restrictions
- Allow All Except Block List
In this mode, access to all website categories is allowed by default. You can specify particular websites to block by adding them to the block list. Only these specified sites will be restricted, while all others remain accessible.
How to Enable “Allow All Except Block List” in Web Settings:
⦁ Go to the “Policy” section.
⦁ Select “Web Setting” from the available options.
⦁ Turn on the “Web Protection” toggle.
⦁ Choose the “Allow All Except Block List”.
A. Exclude List: The Exclude List option is available in Allow All Except Block. You can add URLs and domains by clicking the Exclude List button. This allows you to exclude specific URLs or domains from the general settings, effectively creating exceptions to the blocking rules.
Steps to Add the Exclude List:
⦁ Add Individual URLs or Domains: Enter the URLs or domains in the provided field, then click the Add button to include them in the Exclude List.
⦁ Import Multiple URLs or Domains: To add multiple URLs or domains at once, use the import feature. Choose the file containing the list of URLs or domains and click the Import button.
⦁ Add Domain Groups: Click the “+” button to access the Domain Group option. Here, you can select multiple domains and add them to the Exclude List by clicking the Add button.
B. Recommended Website Categories: When you select the “Recommended Website Categories” checkbox, nine categories are automatically selected for restriction: Adult Sites, Alcohol, Gambling, Hacking, Malicious Sites, Weapons, Violence, Online Games, and Social.
2. Block All Except Allow List
In this mode, access to all websites is blocked by default. You can specify particular websites to allow by adding them to the allow list. Only these specified sites will be accessible, while all others remain blocked.
Internet Time
The Internet Time Access feature enables administrators to control and restrict internet access for users based on specific time periods and website categories. This allows for flexible policy enforcement, where restrictions can be set to block certain categories of websites during defined times, and the behaviour of the restriction adapts if the category type is changed.
How the Feature Works
The feature operates in three distinct modes, each offering different levels of time-based control:
- Always Mode
Purpose: Restricts internet access for selected website categories for the entire day.
Steps:
⦁ Go to Policy Management.
⦁ Click on Web settings.
⦁ Enable the Web-Protection toggle.
⦁ Select the desired Website Restrictions Type.
⦁ Enable the Internet Access Time toggle.
Effect: The restriction remains active for the whole day for the specified category.
2. Specific Mode
Purpose: Restricts access for selected categories during specific hours of the day.
Steps:
⦁ Go to Policy Management.
⦁ Click on Web settings.
⦁ Enable the Web-Protection toggle.
⦁ Select the Website Restrictions Type.
⦁ Enable the Internet Access Time toggle.
⦁ Set the specific hours for restriction on the current day.
Effect: The restriction is enforced only during the chosen hours.
3. Flexible Mode
Purpose: Allows granular control by restricting access for selected categories down to specific minutes within a day.
Steps:
⦁ Go to Policy Management.
⦁ Click on Web settings.
⦁ Enable the Web-Protection toggle.
⦁ Select the Website Restrictions Type.
⦁ Enable the Internet Access Time toggle.
⦁ Select the Flexible Time option.
⦁ Choose the day, then add the start and end times for the restriction.
Effect: Highly customizable; restrictions can be set for any minute range on any day.
Web Exclude
Web Exclude Domain/Process
The Web Exclude Domain/Process feature allows administrators to specify certain domains, URLs, or processes that should be excluded from blocking or filtering rules. This is commonly used in security and web content management systems to ensure that trusted or necessary domains are not mistakenly blocked, or that certain processes are not interrupted by security scans or policies.
Add Excluding Domains/URLs
Definition: This feature can add a list of domains or specific URLs that should not be blocked or scanned.
Process:
⦁ Click the toggle for Web Exclude.
⦁ Check the box labelled “Domain for exclusion.”
⦁ Enter the domain in the “Domain for exclusion” text field (for example: google.com, wikipedia.org, india.gov.in).
⦁ After typing the domain, click the “Add” button. The domain is displayed in the text box list.
⦁ Click “Update Policy” to save your changes. The domain will now be excluded.
Remove Excluding Domains/URLs
Definition: This feature can remove all domains or a specific URL from the Domain Exclusion List.
Process:
⦁ Click the toggle for Web Exclude.
⦁ In the list of excluded domains, locate the domain you want to remove.
⦁ Select the domain entry from the Domain exclusion list.
⦁ Click the “Remove” or “Delete” button to remove the domain from the exclusion list.
⦁ Click “Update Policy” to save your changes. The domain will no longer be excluded.
Add Excluding Processes
Definition: Allows you to specify processes (by name) that should not be scanned or blocked. This ensures that critical applications continue to run without interference.
Process:
⦁ Click the toggle for Web Exclude.
⦁ Check the box labelled “Process for exclusion.”
⦁ Enter the process in the “Process for exclusion” text field (for example: chrome.exe, teams.exe).
⦁ After typing the process, click the “Add” button. The process is displayed in the text box list.
⦁ Click “Update Policy” to save your changes. The process will now be excluded.
Remove Excluding Processes
Definition: This feature removes all processes or a specific process from the Process Exclusion List.
Process:
⦁ Click the toggle for Web Exclude.
⦁ In the list of excluded processes, locate the process you want to remove.
⦁ Select the process entry from the Process exclusion list.
⦁ Click the “Remove” or “Delete” button to remove the process from the exclusion list.
⦁ Click “Update Policy” to save your changes. The process will no longer be excluded.
Google Login Control (GLogin)
The Google Login Control (GLogin) feature provides granular management over authentication for Google Workspace email domains. This functionality enables administrators to define specific access policies, thereby allowing or blocking sign-ins based on designated email domains or individual email addresses.
GLogin operates at both the domain and individual email address levels. For instance, an administrator can configure GLogin to permit access exclusively from a specified domain, such as npav.net, while simultaneously blocking all other domains. Additionally, administrators possess the capability to restrict access to only certain, pre-approved email IDs.
For comprehensive oversight, the system includes a robust reporting feature. This functionality allows system administrators to generate detailed reports itemizing all allowed and blocked email addresses, facilitating audit and compliance requirements.
Configuration Steps
⦁ Enable Google Login Control: Activate the Google Login Control setting and its associated reporting functionality.
⦁ Specify Allowed Email Domains: Input the email domains authorized to access Google accounts. Example: gmail.com
⦁ Specify Allowed Email Addresses: Enter the specific email addresses authorized to access Google accounts. Example: user@example.com
⦁ Apply and Assign Policy: Apply the configured policy settings and assign them to the relevant machines or user groups.
YouTube Controller
A YouTube Controller is used to block specific YouTube channels and publishers, allowing you to control access to YouTube content.
Navigating to YouTube Controller
To enable the YouTube Controller settings within a specific policy:
⦁ Go to “Policy Management”: From the EDR LAN dashboard, click on the “Policy Management” section.
⦁ Select the Desired Policy: A list of available policies will be displayed. Identify and click on the specific policy you wish to modify.
⦁ Go to Web Settings and toggle on the YouTube Controller within the Policy: Within the selected policy’s configuration view, look for a section or tab related to “YouTube Controller”.
You can customize settings as needed by selecting a protection mode. The “Enable YouTube Access Control Report” checkbox is available; tick this checkbox to generate reports.
Allow All
Permit all categories without any restrictions.
⦁ Go to Web Settings.
⦁ Navigate to the YouTube Controller and toggle it on.
⦁ Select the “Allow All” protection mode.
⦁ Update the policy to apply the changes.
Block All
Block all categories.
⦁ Go to Web Settings.
⦁ Navigate to the YouTube Controller and toggle it on.
⦁ Select the “Block All” protection mode.
⦁ Update the policy to apply the changes.
Allow All Except Blocklist
Allow all categories except those on the blocklist.
⦁ Go to Web Settings.
⦁ Navigate to the YouTube Controller and toggle it on.
⦁ Select the “Allow All except Block list” protection mode, then select desired categories. To select all categories, tick the ‘Select All Category List’ checkbox.
⦁ When the setting is “Allow all except block list,” you can use the “Add Exclude channels and publisher” feature to permit specific channels from the blocked category.
⦁ When the setting is “Allow all except block list,” you can enable the “Add blocked channels and publisher” feature to block specific channels or publishers as needed.
⦁ Update the policy to apply the changes.
Block All Except Allowlist
Block all categories except those on the allowlist.
⦁ Go to Web Settings.
⦁ Navigate to the YouTube Controller and toggle it on.
⦁ Select the “Block All except Allow list” protection mode, then select desired categories. To select all categories, tick the ‘Select All Category List’ checkbox.
⦁ When the setting is “Block all except allow list,” you can use the “Add allowed channels and publisher” feature to allow specific channels from the allow category.
⦁ Update the policy to apply the changes.
Web Reputation
Web Reputation is a real-time security feature that evaluates the trustworthiness of websites based on threat intelligence before access is granted. It assesses each site’s reputation to identify and block malicious, suspicious, or low-reputation websites, adding an additional layer of protection against newly emerging and unknown web threats.
Navigating to Web Reputation Settings.
⦁ Go to “Policy Management”: From the EDR LAN dashboard, click on the “Policy Management” section.
⦁ Select the Desired Policy: Identify and click on the specific policy you wish to modify.
⦁ Go to Web Settings and toggle on “Web Reputation” within the policy.
⦁ Choose the reputation sensitivity level (for example: High, Medium, or Low) to determine how strictly low-reputation sites are blocked.
⦁ Click “Update Policy” to apply the changes.
Application Control
The Application Control feature allows administrators to manage which applications are permitted to launch on the endpoint. It supports the blocking of prohibited (Deny-List) applications from being launched, as well as the blocking of all applications other than those included in an Allow-List. Application Control policies are enforced on a per-user basis, alongside Device Control and Web Control.
Navigating to Application Control Settings
⦁ Go to “Policy Management”: From the EDR LAN dashboard, click on the “Policy Management” section.
⦁ Select the Desired Policy: Identify and click on the specific policy you wish to modify.
⦁ Go to the “Application Control” section within the policy and toggle it on.
Application Control Modes.
1. Block Prohibited Applications (Deny-List)
Description: Specify applications that are blocked from being launched on the endpoint. All applications on the Deny-List are prevented from running, while all others remain available.
Steps to Enable:
⦁ Toggle on Application Control.
⦁ Select the “Deny-List” (Block Listed Applications) mode.
⦁ Add the applications you want to block by name or path in the provided field, then click the “Add” button.
⦁ Click “Update Policy” to apply the changes.
2. Block All Except Allow-List
Description: Block all applications from launching except those explicitly included in the Allow-List. Only approved applications are permitted to run, providing a stricter security posture.
Steps to Enable:
⦁ Toggle on Application Control.
⦁ Select the “Allow-List” (Block All Except Allow List) mode.
⦁ Add the applications you want to permit by name or path in the provided field, then click the “Add” button.
⦁ Click “Update Policy” to apply the changes.
Test Mode
Application Control supports a Test Mode that monitors and generates reports on the launch of blocked applications without actually enforcing the block. This allows administrators to evaluate the impact of a policy before full enforcement.
⦁ Enable the “Test Mode” toggle within Application Control.
⦁ Enable the associated report generation option.
⦁ Review the generated report to see which blocked applications would have been launched, then disable Test Mode to begin full enforcement.
User-Based Policy Enforcement
The solution enforces user-based policies across Device Control, Web Control, and Application Control. Administrators can define and assign policies to specific users or user groups, ensuring that Device, Web, and Application Control rules are applied per user rather than only per machine.
Access to web resources can be controlled based on website, content type, user, and time of day, using the Web Protection, Web Category, and Internet Time features described above.
Configuration
⦁ Go to Policy Management and select or create the desired policy.
⦁ Configure Device Control, Web Control, and Application Control settings within the policy.
⦁ Assign the policy to the relevant users or user groups.
⦁ Click “Update Policy” to apply and enforce the policy per user.
Zero-Day Web Protection
⦁ This feature gives an additional level of security, which is useful in office and corporate environments.
⦁ All applications can only communicate with a secure, trusted list of websites.
⦁ This is effective to block 0-day malware, yet keeps all functional websites available which are required for the day-to-day operations of that department.
⦁ Advanced security solution providing real-time defence against unknown web threats and zero-day attacks.
