Web_Reputation_Policies

Web Reputation Policies

Web reputation policies dictate whether OfficeScan will block or allow access to a Web site. To determine the appropriate policy to use, OfficeScan checks the client's location. Location is based on either the client computer's gateway IP address or the client's connection status with the OfficeScan server or any reference server.

A client's location is "internal" if:

The client’s gateway IP address matches any of the gateway IP addresses specified on the Computer Location screen
If the client can connect to the OfficeScan server or any of the Reference Servers.

Otherwise, a client's location is "external".

To configure a Web reputation policy: >>>

Networked Computers > Client Management > Settings > Web Reputation Settings

Configure a policy for External Clients and Internal Clients.
Select the check box to enable/disable the Web reputation policy. Enabling the Web reputation policy means OfficeScan clients query the Smart Protection Network except if the Use the Smart Protection Server Web Reputation Service option is enabled.

Trend Micro recommends disabling Web reputation for internal clients if you already use a Trend Micro product with the Web reputation capability, such as InterScan Gateway Security Appliance.

Optionally, enable the following:

Assessment (Internal/External): When in assessment mode, Web Reputation Service will log all URLs but will allow access to them. Trend Micro provides assessment mode to allow you to evaluate URLs and then take appropriate action based on your evaluation.
Use the Smart Protection Server Web Reputation Service (Internal only): Internal clients connect to the Smart Protection Server and use the Web Reputation Service to determine the reputation of the URL.
Ensure that there are several Smart Protection Servers on the smart protection source list to maintain Web reputation security. If the OfficeScan client is unable to connect to any Smart Protection Server, OfficeScan will allow access to the URL.
Use only Smart Protection Servers, do not send queries to Smart Protection Network (Internal only): Internal clients connect only to the Smart Protection Servers and will not connect to the Smart Protection Network if the web reputation service is unable to determine the reputation of the URL.

Select from the available Web reputation security levels: High, Medium, or Low

The security levels determine whether OfficeScan will allow or block access to a URL. For example, if you set the security level to Low, OfficeScan only blocks URLs that are known to be Web threats. As you set the security level higher, the Web threat detection rate improves but the possibility of false positives also increases.

Specify if you want to block Untested URLs.

Untested URLs refer to URLs that have not been assessed by Trend Micro. While Trend Micro actively tests Web pages for safety, users may encounter untested pages when visiting new or less popular Web sites. Blocking access to untested pages can improve safety, but it also prevents access to safe pages.

Separately add URLs to the Approved/Blocked List of External and Internal clients:

The approved list takes precedence over the blocked list. When a URL matches an entry in the approved list, Web reputation always allows access to the URL, even if it is in the blocked list.

Specify whether to enable the Approved or Blocked URL List feature.
Specify a URL in the text box.

Use the wildcard character (*) anywhere on the URL.

Select whether to approve or block the URL.
Repeat step ii to step iii until all the URLs you want to approve are included in the list.
To export the list to a .dat file, click Export and then click Save.
If you have exported a list from another server and want to import it to this screen, click Import and locate the .dat file. The list loads on the screen.

To submit Web reputation feedback, use the provided URL. The URL opens the Trend Micro Web Reputation Query system.
Select whether to allow the OfficeScan client to send Web Reputation Logs to the server. Allow clients to send logs if you want to analyze URLs being blocked by OfficeScan and take the appropriate action on URLs you think are safe to access.
Click Save.