Trend Micro InterScan M Series, Administrator'S Manual

Page: 77 / 480

How InterScan Gateway Security Appliance Works
3
-
17
When InterScan Gateway Security Appliance denies access to a Web site, it sends a
notification message to the user's browser informing them that it has denied access to
the site based on company policy. InterScan Gateway Security Appliance also sends
a notification to the administrator, if he or she has enabled that feature, whenever a
user requests access to a prohibited site.
Note: If the rating server does not return a rating result in time, the default action is to
allow access to the URL.
Unless the administrator has disabled this feature in the Log Settings screen,
InterScan Gateway Security Appliance logs requests to access prohibited sites to the
URL filtering log. You can export the contents of the log for inclusion in reports.
The URL filtering function in InterScan Gateway Security Appliance uses the
following components when checking a URL:
• Trend Micro URL rating database
• Category filter list
• Blocked and Approved URL lists
InterScan Gateway Security Appliance applies the URL filtering rules according to
the order shown in the URL Filtering > Target screen.
File Blocking
One of the ways that malware can arrive on your desktop or network is through files
that an HTTP server has sent by streaming or downloading them when a client com-
puter accesses a Web site or an FTP site (FTP over HTTP). It is important to protect
your network from this security risk. InterScan Gateway Security Appliance can scan
for and block certain file types that originate from HTTP and FTP servers, thereby
protecting your network and computers. The appliance can block both predefined and
administrator-specified file types.
File Blocking checks the file type (true file type and file extensions) of both inbound
and outbound HTTP and FTP files. The File Blocking feature blocks files according
to the settings defined by the administrator in the File Blocking screen of the Web
console.