Cyan Networks Secure Web vs. Websense Security Gateway Battle card

Transcription

1 URL Filtering CYAN Secure Web Database - over 30 million web sites organized into 31 categories updated daily, periodically refreshing the data and removing expired domains Updates of the URL database are published on a daily basis - the frequency can be increased, but we did not have customer demands yet; the update of the AV database can be scheduled in minute interval - a reasonable minimum for sensitive environments is, however, 4 hours. WebSense Database - Daily updated database with over 40 millions web sites Real-Time Security Updates - A customer security database automatically looks every 5 minutes for updates about new mobile malware code, spyware or phishing pages. CYAN Secure Web provides categories that hold web sites with streaming information, etc. and provides a mechanism to prevent certain applications like various audio/video clients to connect to the Internet CYAN Networks believes that automatic categorization results in a false-positive rate not applicable for business environments; rather than pushing the technology to the customer all robots and agents are run solely in the laboratory of Cyan Networks - the result is reviewed and approved by personnel in order to maintain a high level of accuracy Web 2.0 protection mechanisms are integrated Web 2.0 protection mechanisms are integrated (HTTPS Interception, AV scanning on downloads, content type limits) - additional protection mechanisms are in the roadmap (full HTML/Script content scanning, post request analysis, keyword scanning) Our robots analyze web content that is retrieved by crawlers for harmful or infected pages Bandwidth Filtering - Manage web pages with an impact on bandwidth, such as radio and internet TV, P2P, personal archiving sites, Internet mobile and multimedia streaming. Real-Time engine for Uncategorized - The inline categorization engine allows to categorize on the fly every sites not yet known to Websense. Dynamic Malware Control - The dynamic engine allows to analyze the content of each single element crossing the gateway, searching for malicious code within the web pages. Real-Time engine for Web The inline categorization engine tries to categorize the dynamic page contents of site offering dynamic contents, such as social networks or portals. ThreatSeeker Analytics - The threatseeker engine permits to execute a general control, in search of single elements with low significance that pose a threat when correlated. SiteWatcher - Websense notifies customers whether their home page are infected by malware or spyware.

2 ThreatWatcher - Websense analyses the customer's Web Server and perform a multi-layered scan to find potential threats or vulnerabilities. Feature to anonymously report uncategorized URLs automatically is in the roadmap and will be available soon Application Blocking Filtering applications embedded in HTTP transfers (application blocking) with thousands of patterns daily updated. Next release also include white & black listing on application blocking Available via mime type analysis (true content type is inspected rather than relying on extensions) and part of the application blocking in order to control based on the "content meaning" rather than only on the type of data IM applications can be controlled as allow/deny via the application blocking mechanism HTTPS Interception Interception of HTTPS, POP3S and IMAPS HTTPS Interception is part of the product (without additional cost!) which analyzes encrypted traffic; exclusions to the interception can be made for particular target hosts and can be refined per user/group Management (create/import) of a certification authority. Dynamic creation of signed certificates Certificate validation and fine grain control of the user actions on inaccurate certificates (certificate policies) BrandWatcher - Websense warns customers whom web site is under phishing or malware attacks. WebCatcher & ProtocolCatcher - Anonymously catch unknown sites and protocols and send them to Websense to categorize. Dynamic Protocol Management - Filter over 100 protocols in 12 categories. File Type Manager - While granting site access, block of downloading file types such as audio, video files, executables, etc. IM Attachment Manager - Block attachments within IM applications. Interception of HTTPS SSL Manager - The SSL management module permits to decrypt SSL sessions and look for potential malicious components or categorize the encrypted page content in Real Time. n.a

3 AV Scanning Secure Web has integrated AV scanning engines as option (ESET NOD32, Sophos, AVIRA), but there is already a Clamav free AV engine on standard package CYAN Secure Web blocks access to content that is infected by viruses, represents malware, etc. by applying AV scanning on the traffic. Content is rather blocked than modified (by means of stripping out malicious pieces) - modification to content in the most cases leaves pages that cannot be rendered correctly by the browsers and results in a "damaged" display of the original page CYAN Networks scans multiple TB of Web content per month; Spyware is prevented by to connect to the Internet by multiple technical approaches (application blocking; IP blocking; HTTPS Interception) Reporting CYAN Secure Web Report - web tool with more than 65 templates; different output formats (pdf, excel, HTML, csv,...) and scheduler able to manage delivering to specific address In case of missing reports CYAN Networks will create the corresponding template and provide it in a software update; the database is in an open format - customers can use arbitrary tools to create reports themselves The reporting system supports different administrative roles: admin, report manager, report viewer and observer (observer is required in the case 4- eyes-principle is turned on) Not yet supported a) anonymizing can be done in the activity logs, b) the reporting system supports the 4-eyes-principle in order to blind user sensitive data and open the data only if the permission is granted by a second person has integrated Authentium AV scanning engine Security Filtering - Websense scans weekly over 350 million web sites seeking and blocking malware, spyware and phishing pages. It prevents also existing spyware applications from transmitting information to third parties. WebSense Presentation Report - Web tools for scheduled in-depth analysis with over 50 report templates to choose from in different formats (pdf, excel, etc....) Delegated Reporting - Permit specific users to access to some web tools for creating reports based on specific users or groups. Auditing - Audit and revision of all Websense policies changes. Anonymous Logging - Optional functionality for maintaining anonymous the activity logs.

4 System Features & Administration CYAN Secure Web passes cached content always through all filters in order to apply different access restrictions on the content depending on the recipient; anonymous proxies are part of the application blocking feature Authentication: MS Active Directory, NTLM transparent, Novell e-directory, LDAPs, integration with MS ISA Server (upstream & downstream) Protocols: HTTP, HTTPS, FTP, FTP over HTTP, IMAP, IMAPS, POP3, POP3S, Deployment: Passthrough, Transparent, Proxy cascading & conditional routing, Cisco WCCP support Keyword Search, Cache & Proxy Avoidance - Enable search based on keyword. Websense filters also cached contents, translation sites, and Proxy Avoidance sites and Akamai protocols. Authentication: MS Active Directory, NTLM transparent, LDAPs, integration with MS ISA Server (downstream only) Protocols: HTTP, HTTPS, FTP, FTP over HTTP Cisco WCCP support Platform deployment: Linux, Windows, Proxmox PVE, VMware virtual appliance, Secure Web appliance series Centrally administrated distributed installations are supported by Secure Web - due to complex and various installation requirements we provide this on a per-project basis Platform deployment: Vxxxxx appliance series & software mixed configuration based on Linux and Microsoft Delegated Administration - Allow managing sector, organization and remote server policies with a central distributed configuration. Managing web access with a productivity focus is the main justification of Cyan Networks, providing a tool to create "Internet for Business" SNMP Support is integrated in the appliance solution; for Software-only installations SNMP is available as a standard for all supported operating systems and can be combined with the Secure Web installation Bandwidth reduction is achieved by caching mechanisms; a dynamic "content shaping" feature is on the roadmap Productivity Filtering - Manage web pages with bad impact on productivity, such as message and club board, advertisement, software/freeware downloads, instant messaging, trading on-line and pay for visit sites. SNMP Alerting - Permit to set thresholds for specific events and to automatically send them to other security systems through Simple Network Management Protocol (SNMP). Dynamic Bandwidth Optimizer - Reduce and optimize bandwidth resources giving priority and handling the traffic in real-time.

5 Secure Web appliance scales from small business with just a few users up to large enterprises with thousands of users - all 4 models available can be operated in high-availability and load-balancing mode out of the box; a cluster can be extended by additional machines anytime in order to scale with growing number of users and/or bandwidths Secure Web appliance system configuration backup/import to/from SD card Websense Content Gateway - Websense Content Gateway is a highly scalable proxy based on Linux platform in on line or transparent mode. Vxxxxx appliance has 2 models: V5000 G2 (from 250 up to users) and V5000 G2 (from up to users)