Trend Micro InterScan M Series, Administrator'S Manual

Page: 29 / 480

Introducing Trend Micro InterScan Gateway Security Appliance
1
-
9
• Moves from prevention to cure. The OPP remains in effect until TrendLabs
develops a more complete solution to the threat.
Web Reputation
Web Reputation is a new feature in InterScan Gateway Security appliance that
enhances protection against malicious Web sites. Web Reputation leverages Trend
Micro’s extensive Web security database to check the reputation of URLs that users
are attempting to access or that are embedded in mail messages. In InterScan
Gateway Security Appliance, Web Reputation is applied to three primary network
services – HTTP, SMTP, and POP3.
• HTTP Web Reputation evaluates the potential security risk of any requested URL
by querying the Trend Micro Web security database at the time of each HTTP
request. Depending on the security level that has been set, it can block access to
Web sites that are known or suspected to be a Web threat on the reputation
database. HTTP Web Reputation provides both email notification to the
administrator and inline notification to the user for Web Reputation detections.
• SMTP Web Reputation evaluates the potential security risk of any URL
embedded in messages by querying the Trend Micro Web security database.
Depending on the action that has been set, it can insert a notification stamp to the
message containing the URL and deliver the message, or delete the message
immediately. SMTP Web Reputation provides email notifications to both the
administrator and message recipient, as well as an inline notification stamp in the
message that contains the URL.
• POP3 Web Reputation is similar to SMTP Web Reputation, but it only provides
the Delete action for messages that contain known or suspected malicious URLs.
Reputation Score
A URL's "reputation score" determines whether it is a Web threat or not. Trend Micro
calculates the score using proprietary metrics.
• Trend Micro considers a URL "a Web threat", "very likely to be a Web threat", or
"likely to be a Web threat" if its score falls within the range set for one of these
categories.
• Trend Micro considers a URL safe to access if its score exceeds a defined
threshold.