Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working With Websense Data Security
Working With Websense Data Security
Help | Content Gateway | Version 7.8.x
Related topics:
*
Registering and configuring Data Security
*
Configuring the ICAP client
*
ICAP failover and load balancing
 
Websense Content Gateway works together with Websense Data Security components to support:
*
The Threats dashboard with Web Security Gateway
*
Web data loss prevention (DLP) and the Threats dashboard with Web Security Gateway Anywhere
Threats dashboard with Web Security Gateway
When Content Gateway is deployed with Web Security Gateway, several Data Security components are installed on the Content Gateway and TRITON management servers to support the Web Security Threats dashboard (see Web Security Help). Components include the Data Security Policy Engine (on the Content Gateway machine), and the Data Security Forensics Repository (on the TRITON management server).
Content Gateway registers with these components when it's first configured and then checks registration status upon restart, automatically re-registering if necessary.
Web DLP and the Threats dashboard with Web Security Gateway Anywhere
When Content Gateway is deployed with Web Security Gateway Anywhere (or with Web Security Gateway and a full Data Security subscription), capabilities include forensics data in the Threats dashboard and data loss prevention (DLP) over Web channels such as HTTP, HTTPS, FTP, and FTP over HTTP. (A full Data Security deployment can extend Web DLP to include channels such as mobile devices, removable media, and printers. For a complete description of Websense Data Security, visit the Data Security product page at www.websense.com.)
Web DLP, as well as extended Data Security configurations, require separate installation of Data Security and other Data Security components. Before configuring Content Gateway to work with Data Security, see the deployment and installation information hosted in the Websense Technical Library.
Content Gateway supports 2 methods of working with Data Security:
*
Preferred: Data Security components installed with Content Gateway.
*
Over ICAP using Data Security components located on a separate host. This intended for use with Data Security Suite versions 7.1 and earlier.
Only one method can be used at a time.
How Web DLP works
In addition to the Web DLP data flow described below, enabling a special analytic engine causes outbound traffic to be analyzed for data theft. In the Web Security manager, see the Outbound security options on Scanning > Scanning Options.
Web DLP data flow works as follows:
1.
The proxy intercepts outbound content and provides that content to Data Security.
2.
Data Security analyzes the content to determine if the Web posting or FTP upload is allowed or blocked.
*
The determination is based on Data Security Web DLP policy.
*
The disposition is communicated to the proxy.
*
Data Security logs the transaction.
3.
The proxy acts on the Data Security determination.
a.
If the content is blocked, it is not transmitted to the remote host and Data Security returns a block page to the sender.
b.
If the content is allowed, it is forwarded to its destination.
 
* 
Note 
When a request is blocked and the DLP server sends a block page in response:
*
Content Gateway forwards the block page to the sender in a 403 Forbidden message.
*
The block page must be larger than 512 bytes or some user agents (e.g., Internet Explorer) will substitute a generic error message.
*
The block page can be customized. See Modifying Data Endpoint Confirm And Block Messages.
Transactions over HTTP, HTTPS, FTP, and FTP over HTTP can be examined.
Transaction details are logged by Data Security, per its configuration.
Data Security components on-box with Content Gateway
When Content Gateway is installed, a small number of Data Security components are installed on the same box. Content Gateway registers with these components when it's first configured and then checks the registration status whenever it's restarted, automatically re-registering if necessary. For more information about Data Security registration, see Registering and configuring Data Security.
After policies have been created and deployed in the Data security manager, Content Gateway sends content, such as postings and uploads, to Data Security for analysis and policy enforcement.
Content Gateway collects and displays Data Security transaction statistics, such as:
*
The total number of posts
*
The total number of posts analyzed
*
The number of FTP uploads analyzed
*
The number of blocked requests
*
more
These statistics can be viewed in the Content Gateway manager by navigating to Monitor > Security > Data Security. For a complete list of statistics, see Data Security.
Data Security over ICAP
When the Data Security policy engine is located on a separate host, Content Gateway can communicate with Data Security over ICAP v1.0. For configuration details, see Configuring the ICAP client. Note that integration with on-box components is the preferred deployment.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working With Websense Data Security
Copyright 2016 Forcepoint LLC. All rights reserved.