TRITON - Data Security Help

Transcription

1 TRITON - Data Security Help Websense Data Security v7.6

2 , Websense, Inc. All rights reserved Sorrento Valley Rd., San Diego, CA 92121, USA Published 2010 Printed in the United States and Ireland The products and/or methods of use described in this document are covered by U.S. Patent Numbers 5,983,270; 6,606,659; 6,947,985; 7,185,015; 7,194,464 and RE40,187 and other patents pending. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense, Inc. Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense, Inc., shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.

3 Contents Part 1: Getting Started Topic 1 Overview Data Security basics Data Security protector Data Security databases What can I protect? PreciseID fingerprinting Managing Websense Data Security Web Security Gateway Anywhere mode Security Gateway mode Topic 2 Navigating the System Data Security s navigation and content panes Main tab Settings tab Today page Deploy button Icons Breadcrumbs Check boxes Pagination Topic 3 Initial Setup Entering your subscription key Defining general system settings Configuring user directory server settings Setting up alerts Setting up notifications Configuring system modules Configuring the protector Deploying your settings TRITON - Data Security Help i

4 Contents Part 2: Securing Your Company s Data Topic 4 Policies Overview What s in a policy? Viewing policies Editing a policy Update rules of current policy Update exceptions of current rule Update rules of multiple policies Update exceptions of multiple rules Delete policies Policy levels Selecting items to include or exclude in a policy Topic 5 Configuring the Data Loss Prevention Policy Configuring outbound and inbound attributes Defining policy owners Identifying trusted domains Topic 6 Configuring the Web Data Loss Prevention Policy Configuring Web attributes Selecting Web destinations Defining policy owners Topic 7 Creating DLP Policies for Regulatory & Compliance Creating a regulatory and compliance policy Welcome Regions Industries Finish Policy list Changing the policies you selected Changing your industry or region Topic 8 Creating Custom DLP Policies Custom Policy Wizard - General Custom Policy Wizard - Condition Viewing or editing a conditions and thresholds Custom Policy Wizard - Severity & Action Custom Policy Wizard - Source Custom Policy Wizard - Destination Rule Wizard - Finish Selecting a content classifier Patterns & Phrases ii Websense Data Security

5 Contents File Properties Fingerprint Transaction Size Number of Attachments Number of Destinations Managing rules Adding exceptions Rearranging exceptions Adding a new exception Topic 9 Classifying Content Content classifier menu bar Details pane Patterns & Phrases Adding or editing a regular expression classifier Adding a key phrase classifier Adding a dictionary classifier File properties Adding a file-type classifier Adding a file-name classifier Adding a file-size classifier Scripts Editing a predefined script File fingerprinting File Fingerprinting Wizard - General File Fingerprinting Wizard Root Folder/Site Root File Fingerprinting Wizard - Scanned Files/Documents File Fingerprinting Wizard - Scheduler File Fingerprinting Wizard - File Filtering File Fingerprinting Wizard - Finish Database fingerprinting Connecting to data sources Preparing for fingerprinting How matches are counted Creating a database fingerprint classifier Database Fingerprinting Wizard - General Database Fingerprinting Wizard - Data Source/Site Database Fingerprinting Wizard - Field Selection Database Fingerprinting Wizard - Scheduler Database Fingerprinting Wizard - Fingerprinting Type Database Fingerprinting Wizard - Finish Creating a rule from a content classifier TRITON - Data Security Help iii

6 Contents Topic 10 Defining Resources Sources and destinations User directory entries Custom users Custom computers Networks Domains Business Units URL categories Printers Endpoint Devices Endpoint Applications Endpoint Application Groups Applying a column filter Adding custom application groups Remediation Action Plans Remediation scripts Notifications Topic 11 Creating Discovery Policies Creating a discovery policy Scheduling the scan Performing file system discovery Performing SharePoint discovery Performing database discovery Performing Exchange discovery Performing Outlook PST discovery Performing endpoint discovery Viewing discovery status Viewing discovery results Updating discovery Configuring discovery incidents Copying or moving discovered files Preparing and running the remediation scripts Topic 12 Scheduling Discovery Tasks Scheduling network discovery tasks File System tasks SharePoint tasks Database tasks Exchange tasks iv Websense Data Security

7 Contents Outlook PST tasks Scheduling endpoint discovery tasks Topic 13 Viewing Incidents and Reports The report catalog Editing a report Scheduling tasks Viewing the incident list Previewing incidents Managing incident workflow Remediating incidents Escalating incidents Managing incident reports Tuning policies Viewing the dashboard Viewing top violated policies Viewing incidents by severity and action Viewing top sources and destinations Viewing incident trends Viewing assessment reports Viewing sensitive data reports Topic 14 Viewing Status and Logs Viewing the Today page Monitoring system health Viewing endpoint status Viewing deployment status Viewing logs Traffic log System log Audit log Part 3: Administering the System Topic 15 Configuring System Settings Setting reporting preferences Setting general preferences Setting preferences for data loss prevention forensics Setting preferences for discovery incidents Backing up the system Scheduling backups Monitoring backups Backup folder contents TRITON - Data Security Help v

8 Contents Restoring the system Exporting incidents to a file Configuring endpoints Configuring user directory settings Adding a new user directory server Rearranging user directory servers Importing users Configuring remediation Configuring alerts Setting general alert preferences Setting up properties Editing outgoing mail server properties Configuring the incident archive Entering subscription settings Subscription alerts Configuring URL categories and user names Importing URL categories Topic 16 Configuring Authorization Defining administrators Viewing administrators Editing administrators Working with roles Adding a new role Configuring personal settings Topic 17 Archiving Incidents Remote SQL Server machines Archiving a partition Restoring a partition Deleting a partition Archive threshold Topic 18 Updating Predefined Policies and Classifiers Viewing your update history Installing policy updates Restoring Policies to a previous version Determining the policy version you have Topic 19 Managing System Modules Adding modules Configuring modules Configuring the management server vi Websense Data Security

9 Contents Configuring a supplemental Data Security Server Configuring the SMTP agent Configuring the fingerprint repository Configuring the endpoint server Configuring the crawler Configuring the forensics repository Configuring the policy engine Configuring the protector Configuring ICAP Configuring the Web Content Gateway module Configuring the Security Gateway module Configuring the ISA agent Configuring the printer agent Configuring the integration agent Configuring protector services Configuring SMTP Configuring HTTP Configuring FTP Configuring chat Configuring plain text Balancing the load Defining load balancing distribution Topic 20 Configuring Endpoint Deployment Viewing and managing endpoint profiles Adding an endpoint profile General tab Servers tab Properties tab Encryption tab Rearranging endpoint profiles Deploying endpoint profiles Backing up encryption keys Restoring encryption keys Configuring endpoint settings Monitoring endpoint removable media Selecting endpoint destination channels to monitor Bypassing endpoint clients Using the endpoint client software Disabling an endpoint client Viewing contained files Viewing logs TRITON - Data Security Help vii

10 Contents Updating the endpoint client Topic 21 Troubleshooting Part 4: Appendices Problems and Solutions Discovery Endpoint Fingerprinting Incidents Miscellaneous Performance Printer agent Linking Service Online Help Technical Support Appendix A Predefined Policies Data Loss Prevention policies Personally Identifiable Information (PII) Private Health Information (PHI) Credit Cards Financial Data Acceptable Use Company Confidential and Intellectual Property United States Federal and Industry Regulations IUnited States - State Laws EMEA Policies APAC Regulations Discovery policies PCI Private Information Company Confidential and Intellectual Property Acceptable Use Regulations Appendix B Predefined Classifiers File-type classifiers NLP scripts Dictionaries Regular Expression patterns Appendix C Supported File Formats viii Websense Data Security

11 Contents Appendix D Endpoint Applications Built-in support Importing other applications Appendix E File Size Limits Appendix F How Do I Archive my incident data? Configure a policy? Create a custom block message? Define an exception? Filter incidents? Fingerprint data? Ignore sections of my document when fingerprinting? Fingerprint specific field combinations in a database table? Mitigate false positives in pattern or dictionary phrases? Move from monitor to protect? Perform discovery? Permanently delete incidents? Appendix G Glossary Index TRITON - Data Security Help ix

12 Contents x Websense Data Security

13 Part I Getting Started Websense Data Security

14 TRITON - Data Security Help

15 1 Overview Websense Data Security protects organizations from information leaks and data loss both at the perimeter and inside the organization. Websense Data Security can operate alone in the network, or be paired with Websense Web and security solutions (on-premises or in the cloud), to provide a wellrounded Essential Information Protection solution for your organization. When paired with Websense Web security solutions, Data Security prevents data loss over Web channels such as HTTP, HTTPS, and FTP. When paired with Websense security solutions, Data Security prevents data loss through . If Web or channels are all you need to monitor, you do not need a separate Websense Data Security subscription; Data Security technology is built in. You can manage all 3 Websense solutions Web, data, and from a central location: the TRITON Unified Security Center. If you require data loss prevention over other channels such as printers, USB drives, or LANs or if you are interested in discovering the location of sensitive data inside your network, you can subscribe to additional Websense Data Security components. Websense Data Security can utilize a variety of agents to intercept data on ISA servers, print servers, and more. Endpoints that are deployed on users computers (PCs, laptop, etc.) enable administrators to analyze content within a user s working environment and block or monitor policy breaches as defined by the endpoint profiles. Speak to your Websense sales representative for more information about these Data Security options. Data Security basics Websense Data Security protects organizations from data loss by: Monitoring data as it travels inside or outside the organization Protecting data while it is being manipulated in office applications, with policybased controls that align with business processes The 2 main components of Websense Data Security are: The Data Security Management Server TRITON - Data Security Help 1

16 Overview The Data Security Policy Engine The Data Security Management Server is a Windows-based machine where you install the Websense Data Security software. This machine provides the core information loss technology, capturing fingerprints, applying policies, and storing incident forensics. You can install multiple Data Security servers, sharing the analysis load, but one must be the primary, management server. There is a policy engine on all Websense Data Security servers, Web Security Gateway proxies, and Security Gateway appliances. The policy engine is responsible for parsing your data and using analytics to compare it to the rules in your policies. The policy database is a repository for all of the policies you create. For optimal performance, it is stored locally on each server as well, as is the fingerprint database. The policy database is pushed during the deploy operation, while fingerprints are distributed automatically as they are generated. Data Security protector If you have a full Websense Data Security subscription, you may also make use of the Data Security protector. The protector is a Linux-based machine that intercepts and analyzes traffic on a variety of channels, such as , HTTP, FTP, and chat. It is an essential component of Websense Data Security providing monitoring and blocking capabilities to prevent data loss and leaks of sensitive information. Using PreciseID technology, the protector can accurately monitor sensitive information in transit on any port. Content analysis is performed by the on-box policy engine, so no sensitive data leaves the protector during this process. Data Security databases Websense Data Security has 2 databases for incident and forensics data: The incident database contains information about policy breaches, such as what rule was matched, how many times, what were the violation triggers, what was the date, channel, source, ID, and more. It is stored in Microsoft SQL Server along with policy configuration data. When the incident database gets very large, it is partitioned so you can archive it onto different physical disks. You do this by navigating to Settings > General > Archive and using the options on the resulting screen. The forensics repository contains information about the transaction that resulted in the incident, such as the contents of an body: From:,To:, Cc: fields; attachments, URL category, host name, file name, and more. To configure the size and location of the forensics repository, navigate to Settings > Deployment > System Modules and click Forensics Repository on the management server. Both incident data and forensics data are displayed in the Incidents, Last n days report. 2 Websense Data Security

17 Overview What can I protect? Related topics: Sources and destinations, page 131 Classifying Content, page 91 Defining Resources, page 129 Remediation, page 141 Websense Data Security lets you control or monitor the flow of data throughout your organization. You can define: Who can move and receive data What data can and cannot be moved Where the data can be sent How the data can be sent What action to take in case of a policy breach With a full subscription, Websense Data Security secures: Network and endpoint - You can monitor or prevent sensitive information from being ed in or outside of your domain from both network and endpoint computers. Web channels FTP - You can monitor or prevent sensitive information from being uploaded to file transfer protocol (FTP) sites. Chat - You can monitor sensitive information going out via instant messenger applications such as Yahoo! Messenger. Plain text -You can monitor or prevent sensitive information from being sent via plain text (unformatted textual content). HTTP/HTTPS - You can monitor or prevent sensitive information from being posted to a Web site, blog, or forum via HTTP. Endpoint HTTP/HTTPS - You can monitor or protect endpoint devices such as laptops from posting sensitive data to the Web. Network and endpoint printing - You can monitor or prevent sensitive data from being printed on any printer in your network. Endpoint applications - You can monitor or prevent sensitive data from being copied and pasted from one application to another on Windows endpoint clients. This is desirable, because endpoint clients are often disconnected from the corporate network and can pose a security risk. Endpoint removable media - You can monitor or prevent sensitive information from being written to a removable device such as a USB flash drive, CD/DVD, or TRITON - Data Security Help 3

18 Overview external hard disk. All removable media is supported on Windows endpoints. All but CD/DVD devices are supported on Linux endpoints. Endpoint LANs - Users commonly take their laptops home and then copy data through a LAN connection to a network drive/share on another computer. You can specify a list of IP addresses, host names or IP networks of computers that are allowed as a source or destination for LAN copy. You can intercept data from an endpoint client. You can set a different behavior according to the endpoint type (laptop/other) and location (connected/not connected to the corporate network). Note that Endpoint LAN control is currently applicable to Microsoft sharing only. By such comprehensive monitoring of these channels, you can prevent data from leaving your organization by the most common means. PreciseID fingerprinting Related topics: File fingerprinting, page 106 Database fingerprinting, page 112 Scripts, page 104 Classifying Content, page 91 One of the ways that you can classify data in your organization is by fingerprinting it using the Websense patented PreciseID technology. (Other ways include identifying key phrases, regular expression patterns, dictionaries, or file types. See Classifying Content, page 91.) The power of PreciseID techniques is its ability to detect sensitive information despite manipulation, reformatting, or other modification. Fingerprints enable the protection of whole or partial documents, antecedents, and derivative versions of the protected information, as well as snippets of the protected information whether cut and pasted or retyped. PreciseID technology can fingerprint 2 types of data: structured and unstructured. Structured fingerprinting defines what tables and what data inside the table should be fingerprinted. (To set this up, select Main > Policy Management > Content Classifiers > Database Fingerprinting.) Unstructured fingerprinting defines files and folders that should be fingerprinted. (To set this up, select Main > Policy Management > Content Classifiers > File Fingerprinting.) 4 Websense Data Security

19 Overview These classifiers not only define what to fingerprint, but when and how often to run the fingerprinting scan. That way, if files or data change after fingerprinting, Data Security stays up to date. At scan time, PreciseID technology examines the content of documents or raw data and extracts a set of mathematical descriptors or information fingerprints. These fingerprints are compact and describe the underlying content. By assigning unique identities to each information asset, PreciseID technology can track information in motion with great precision. Original content cannot be recreated or reverse engineered from the PreciseID information fingerprint. PreciseID supports real-time hash validation for data identification and integrity. You can fingerprint data in all common languages. Websense has fine-tuned fingerprinting for English, Spanish, German, Russian, Hebrew, and Japanese. Managing Websense Data Security Related topics: Navigating the System, page 7 The interface that you use to manage Websense Data Security is called the TRITON Unified Security Center. TRITON has modules for Web security, security, and data security. TRITON is a Web-based user interface that enables you to perform basic setup, system maintenance, policy creation, reporting, and incident management for all three modules in the same location. The TRITON center consolidates all aspects of Websense setup and configuration, incident management, system status reports, and role-based administration. For more information on using the TRITON interface, see the TRITON Help system. Select TRITON Settings on the TRITON toolbar, then click Help > Help Contents. Web Security Gateway Anywhere mode Websense Data Security works seamlessly with Websense Web Security and Websense Web Security Gateway. If you have Websense Web Security Gateway Anywhere, only content on Web channels is analyzed, and you are not required to purchase a separate Data Security subscription or a protector appliance. TRITON - Data Security Help 5

20 Overview The Web channels covered by Web Security Gateway Anywhere include HTTP, HTTPS, FTP, and FTP-over-HTTP. This allows you to prevent posts to Web sites, blogs, and forums as well as FTP sites. Note If you have Websense Web Security Gateway Anywhere, you won t see all the options that are presented in this Help documentation. If you require access to other options and channels that you see here, talk to your Websense account representative about purchasing a full Websense Data Security subscription. Security Gateway mode Websense Data Security is integrated into Websense Security Gateway and Websense Security Gateway Anywhere. If you have Websense Security Gateway, data loss is prevented over . You are not required to purchase a separate Data Security subscription, SMTP agent, or a protector appliance. Note If you have Websense Security Gateway, you won t see all the options that are presented in this Help documentation. If you require access to other options and channels that you see here, talk to your Websense account representative about purchasing a full Websense Data Security subscription. 6 Websense Data Security

21 2 Navigating the System TRITON Unified Security Center navigation is described in the TRITON Help System. Select TRITON Settings on the TRITON toolbar, then click Help > Help Contents for more information. In this section, you will learn how to navigate the TRITON - Data Security interface. It covers: Data Security s navigation and content panes Today page Deploy button Icons Breadcrumbs Check boxes Pagination Data Security s navigation and content panes Related topics: Main tab, page 10 Settings tab, page 11 The left pane of the TRITON Unified Security Center is known as the navigation pane. The navigation pane is organized with tabs and buttons, some of which offer a TRITON - Data Security Help 7

22 Navigating the System menu of options. The right pane is known as the content pane. The content in this pane varies according to the selection in the navigation pane. The navigation pane is collapsible to enable larger working space and a wider display area for all TRITON pages. In TRITON - Data Security, this is especially useful for the Data Loss Prevention and Discovery reports. 8 Websense Data Security

23 Navigating the System To collapse the navigation pane, click the arrows in the upper-right corner of the pane. To expand it, click the arrows again. You can do this on any page in the TRITON security center. Collapse Arrow There are 2 tabs on the navigation pane: Main and Settings. In TRITON - Data Security: The Main tab is where you create and fine-tune policies, perform discovery, manage incidents, and view system status and logs. The Settings tab is where you administer the system. Here, you can perform system maintenance; configure endpoint deployment; and configure settings, modules, and roles. Note If you have Websense Web Security Gateway Anywhere, your tabs look slightly different. That s because not all of the options apply to you, such as discovery and endpoint. TRITON - Data Security Help 9

24 Navigating the System Main tab Related topics: Viewing Incidents and Reports, page 199 Creating Custom DLP Policies, page 67 Creating Discovery Policies, page 155 Scheduling Discovery Tasks, page 169 Classifying Content, page 91 Defining Resources, page 129 Viewing Status and Logs, page 241 Reporting Data Loss Prevention: View and manage data loss prevention incidents relevant to the active administrator. You can assign incidents to other administrators and view consolidated reports on incidents and information leaks. This gives you a complete picture of what s going on inside your network. You can also schedule reporting tasks. Discovery*: View information about incidents that were discovered through discovery. Using this screen, you can assign, view, and monitor discovery incidents. *Not included with Websense Web Security Gateway Anywhere or Security Gateway. Policy Management Data Loss Prevention (DLP) Policies: Create or manage a network or endpoint policies. You can create policies from scratch or by using predefined regulatory and compliance policies. Discovery Policies*: Create or manage discovery policies. You can create policies from scratch or by using a predefined regulatory template. Discovery Tasks*: Schedule discovery tasks. Content Classifiers: Describe the data to be governed. You can classify data by file properties, key phrases, dictionaries, scripts, a database fingerprint, a directory (including SharePoint) fingerprint, and/or a file fingerprint. Resources: Define the source and destination of the data you want to protect, the endpoint device or application that may be in use, and the remediation or action to take when a violation is discovered (such as block or notify). *Not included with Websense Web Security Gateway Anywhere or Security Gateway. 10 Websense Data Security

25 Navigating the System Status Today: The Today page appears first when you first view TRITON - Data Security. It provides an at-a-glance dashboard of the enterprise data loss prevention status. For more information about the Today page, see Today page, page 12. System Health: This enables you to monitor Websense Data Security performance. See Monitoring system health, page 244. Endpoint Status*: On this page you can view a list of data endpoints that are registered with the Data Security Management Server, including information regarding an endpoint s discovery, profile and policy, and the host s system summary. See Viewing endpoint status, page 246. Traffic Log: This enables you to see details of the traffic being monitored by Websense Data Security. See Traffic log, page 248. System Log: Here you can view a list of the events sent from system components, such as the Data Security servers, protectors, and policy engines. See System log, page 251. Audit Log: This page displays a list of actions that administrators have performed in the system. See Audit log, page 251. Settings tab * Not included with Websense Web Security Gateway Anywhere. Related topics: Configuring System Settings, page 255 Configuring Authorization, page 283 Archiving Incidents, page 293 Managing System Modules, page 303 Configuring Endpoint Deployment, page 341 Main tab, page 10 General System: Configure basic system settings for incidents and forensics, user directories, mail gateways, Websense product integration, and more. Authorization: Set up and manage TRITON - Data Security system administrators and assign roles. Archive: Archive partitions for incident storage. Policy Updates: Install updates to Websense predefined regulatory and compliance policies. TRITON - Data Security Help 11

26 Navigating the System Deployment System Modules: Manage system components such as Data Security servers, fingerprint repositories, policy engines, and agents. Endpoint*: Configure endpoint profiles. * Not included with Websense Web Security Gateway Anywhere or Security Gateway. Today page When you log onto TRITON - Data Security, the Today page displays. This page includes a comprehensive view of data loss prevention incidents that occurred in the last 24 hours, and the total number of discovery incidents. From the Today page, you can see any system alerts and act on them quickly and easily. You can also view incidents by host names and policy categories so you know where your greatest risks lie. For details about the Today page and its contents, see Viewing the Today page, page 242. Deploy button In Websense Data Security, your policy and configuration changes are saved as soon as you make them and click OK, but they are localized to the Data Security Management Server. To deploy changes across all servers running Websense Data Security components in your network, you must click the Deploy button on the TRITON toolbar. The Deploy button deploys your policy changes across all Data Security components the protector, agents, gateways, endpoint hosts, etc. This includes changes to policies, rules, exceptions, resources, content classifiers, and tasks. If you have changes waiting to be deployed, the Deploy button turns yellow to indicate the deployment is required. 12 Websense Data Security

27 Navigating the System Click the left button (the magnifying glass icon) to view the status of the last deployment. Click the right button to deploy the settings you configured. If no changes are awaiting deployment, the Deploy button is white, but you can still view deployment status. If you are not allowed to deploy or see the last status, these buttons are greyed out. In TRITON - Web Security, the Save All button performs a similar function. Before you click Deploy, be sure to review your configuration changes. When you click Deploy, a confirmation message appears: You are about to deploy the current settings. Click OK to continue. Click OK to deploy the changes across your network. You will see a table indicating the dynamic status of the components being deployed. Deploying changes can take time, and if a component is down or disconnected from the network, deployment to that specific component will fail. However, once the component becomes available again, it will get all the pending updates. If Websense Data Security encounters problems, you ll see a message indicating deployment failure in the table. While your changes are being deployed across your network, you can see the status column updates for each module change from Processing to either Success or Failed. See Troubleshooting for tips on how to solve failed deployments. Note When deploying settings to the protector, active instant messenger (IM) sessions are no longer monitored. Every IM session that is opened after the deploy is monitored; however, existing connections are not be monitored after the deploy. If you have deployed a protector in inline mode, users lose Internet connection for approximately 5 seconds when you deploy changes to network settings. TRITON - Data Security Help 13

28 Navigating the System Icons The following icons are used throughout the TRITON - Data Security interface: Icon System Modules Data Security Management Server Data Security Server Protector Content Gateway SMTP agent ISA agent Printer agent Security Gateway agent Fingerprint repository Endpoint server Crawler Forensics repository Policy engine 14 Websense Data Security

29 Navigating the System Icon ICAP server Deployment Status Modified Disabled Forced Bypass Severity High Medium Low Incident Status Flags New In Process Closed Endpoint Operations Print Cut/copy TRITON - Data Security Help 15

30 Navigating the System Icon Paste File access Download Screen capture Channels HTTP Endpoint FTP IM Printer SMTP ICAP Web Details report Escalate View 16 Websense Data Security

31 Navigating the System Icon Print preview - Current, selected, or all filtered incidents Reporting Details report Summary report Run Edit Save As Export to PDF Export to CSV Add scheduled task - accesses the Task Scheduler screen Delete Print and Export Export to PDF Export to CSV Print Preview System-wide TRITON - Data Security Help 17

32 Navigating the System Icon When a user modification or update to the system fails, the Error icon is displayed at the top of the screen with an explanation of the failure. When a user modification or update to the system succeeds, the Success icon is displayed at the top of the screen with a description of what has been done. The Information icon provides added details when clicked. The Note icon is displayed when extra information is supplied that is pertinent to the configuration. Breadcrumbs Breadcrumbs appear at the top of each screen, providing you with the complete path of screens that you have visited up to the current page. The paths are clickable links that direct you to the relative screen. The Help system also includes breadcrumbs. Check boxes Most check boxes used in the TRITON - Data Security interface function in a hierarchical manner. In tables, the title check box enables you to select or deselect all the check boxes below it. In forms, clicking a check box allows you to access the 18 Websense Data Security

33 Navigating the System check boxes below it and then activate them as necessary. Disabling the highest-level check box disables lower-level check boxes as well. Pagination In tables where there is more than one page of data (more than 100 items), the pagination control enables you to move from one page to another. The Next and Previous buttons move to the next or previous pages, while the First button moves to the first page and the Last button accesses the final page. TRITON - Data Security Help 19

34 Navigating the System 20 Websense Data Security

35 3 Initial Setup Related topics: Entering your subscription key, page 22 Defining general system settings, page 22 Setting up notifications, page 25 Configuring Web attributes, page 56 Configuring outbound and inbound attributes, page 51 Creating a regulatory and compliance policy, page 63 Configuring system modules, page 27 Deploying your settings, page 31 If you have Websense Web Security Gateway Anywhere or Websense Security Gateway installed, follow these steps: 1. Define the general system settings, such as user directories and alerts. (See Defining general system settings, page 22.) 2. Select and define attributes for your Web or policy. (See Configuring Web attributes, page 56 and Configuring outbound and inbound attributes, page 51.) 3. Deploy your settings. (See Deploying your settings, page 31.) If you have only Websense Data Security, follow these basic steps: 1. Enter your Websense Data Security subscription key. (See Entering your subscription key, page 22.) 2. Define the general system settings, such as user directories and alerts. (See Defining general system settings, page 22.) 3. Set up notifications. (See Setting up notifications, page 25.) 4. Configure system modules (protector deployments only). (See Configuring system modules, page 27.) 5. Create regulatory and compliance policies. (See Creating a regulatory and compliance policy, page 63.) 6. Deploy your settings. (See Deploying your settings, page 31.) TRITON - Data Security Help 21

36 Initial Setup Basic instructions are provided in this chapter. For more detailed instructions, follow the links under Related topics. Entering your subscription key Related topics: Entering subscription settings, page 278 Before beginning to work with Websense Data Security you must enter your subscription key: 1. Log on to TRITON - Data Security. If you have never entered subscription information before, the subscription page appears automatically. If you need to navigate to the subscription page: a. Select Settings > General > System. b. From the System pane, choose Subscription. 2. Browse to your subscription file, then click Submit. Your current subscription information is displayed, and the TRITON - Data Security application restarts. 3. If your license is about to expire, you ll see a notice in this screen, along with an Update button. Click the Update button to update your subscription. Once updated, you ll need to log off and then log on again to see accurate information on the subscription screen. Note If you have Websense Web Security Gateway Anywhere or Websense Security Gateway, your subscription information is communicated to the Data Security Management Server automatically. Defining general system settings Related topics: Configuring user directory server settings, page 23 Setting up alerts, page 24 Configuring System Settings, page 255 On the Settings tab, there are settings to configure before you can get started. Namely, you need to: 22 Websense Data Security

37 Initial Setup Configure user directory server settings. This lets you resolve user details during analysis and enhance the details displayed with the incident. Set up alerts. This lets you configure the cases when administrators receive alerts from the system, such as when a subscription is about to expire or disk space is reaching its limit. Configuring user directory server settings Related topics: Configuring user directory settings, page 267 In the TRITON Console, define the LDAP user directory to use when adding and authenticating TRITON administrators with network accounts. (Select TRITON Settings from the TRITON toolbar, then select User Directories.) On the Data Security tab, you define the user directory to use for Data Security users and other policy resources such as devices and networks. 1. Select Settings > General > System. 2. Click the User Directories option in the System pane. 3. Click New in the toolbar. 4. In the Add User Directory Server screen, complete the following fields: Field Name Type Connection Settings IP address or host name Port User distinguished name Password Root naming context Use SSL encryption Enter a name for the user directory server. Select the type of directory from the drop-down menu: Active Directory, Domino, ADAM, or CSV file. Enter the IP address or host name of the user directory server. Enter the port number of the user directory server. Enter a user name that has access to the directory server. Enter the password for this user name. Optionally, enter the root naming context that Websense Data Security should use to search for user information. If you supply a value, it must be a valid context in your domain. If the Root naming context field is left blank, Data Security begins searching at the top level of the directory service. Select this box if you want to connect to the directory server using Secure Sockets Layer (SSL) encryption. TRITON - Data Security Help 23