SECURE ICAP Gateway. Blue Coat Implementation Guide. Technical note. Version /12/13. Product Information. Version & Platform SGOS 6.

Full text

(1)

SECURE ICAP Gateway

Blue Coat Implementation Guide

Technical note

Version 1.0 23/12/13

Product Information

Partner Name Blue Coat Systems, Inc. Web Site www.bluecoat.com

Product Name ProxySG Version & Platform SGOS 6.5

(2)

SECURE ICAP Gateway

Blue Coat Implementation Guide

Copyright

Revision 1.0, December, 2013 Published by Clearswift Ltd. © 1995–2013 Clearswift Ltd. All rights reserved.

The materials contained herein are the sole property of Clearswift Ltd unless otherwise stated. The property of Clearswift may not be reproduced or disseminated or transmitted in any form or by any means electronic, mechanical, photocopying, recording, or

otherwise stored in any retrievable system or otherwise used in any manner whatsoever, in part or in whole, without the express permission of Clearswift Ltd.

Information in this document may contain references to fictional persons, companies, products and events for illustrative purposes. Any similarities to real persons, companies, products and events are coincidental and Clearswift shall not be liable for any loss

suffered as a result of such similarities.

The Clearswift Logo and Clearswift product names are trademarks of Clearswift Ltd. All other trademarks are the property of their respective owners. Clearswift Ltd. (registered number 3367495) is registered in Britain with registered offices at 1310 Waterside,

Arlington Business Park, Theale, Reading, Berkshire RG7 4SA, England. Users should ensure that they comply with all national legislation regarding the export, import, and use of cryptography.

(3)

SECURE ICAP Gateway

Blue Coat Implementation Guide

Contents

1   Introduction ... 4  

2   Architecture Overview ... 4  

3   Clearswift SECURE ICAP Gateway Configuration ... 5  

4   Blue Coat ProxySG Configuration ... 6  

5   Feature List ... 11  

5.1   Certified Platform ... 11  

(4)

SECURE ICAP Gateway

Blue Coat Implementation Guide

1

Introduction

The Clearswift SECURE ICAP Gateway is an ICAP server that provides all the Clearswift Content inspection functionality to Blue Coat ProxySG product. This document describes the steps to take when deploying and integrating both products.

2

Architecture Overview

The Blue Coat ProxySG is a scalable, high performance web security product that can extend its capabilities through the addition of external components. The communication between the different elements is performed using the Internet Content Adaptation Protocol (ICAP). In such configurations, the ProxySG performs the communication between the user and the Internet, redirecting the selected requests or responses to the available ICAP servers.

Users

ICAP

Blue Coat ProxySG

Clearswift SECURE ICAP Gateway

(5)

SECURE ICAP Gateway

Blue Coat Implementation Guide

3

Clearswift SECURE ICAP Gateway Configuration

The Blue Coat ProxySG acts as an ICAP client, as it sends requests for content to be inspected. The Clearswift ICAP Gateway act as an ICAP server, as it responds to requests made by the ProxySG.

The ICAP Gateway only scans requests from registered ICAP clients’ served. Thus, the IP address that the ProxySG will be using to communicate to the ICAP Gateway is required in order to perform the configuration.

Configuration is done on the “ICAP Server Configuration” page, available under the System menu.

In the ICAP Clients area all of the ProxySG deployed servers must be configured. The Clearswift ICAP Gateway is configured to listen on the port 1344, the default ICAP communications port. This can be modified if required through the

configuration page.

(6)

SECURE ICAP Gateway

Blue Coat Implementation Guide

order to identify them individually, different service URLs are used. These can be defined in the “ICAP Services Configuration” box, including whether message previewing option will be accepted or not.

Additionally, the Clearswift SECURE ICAP Gateway can be configured to log specific actions and to have an appropriate logging level.

It must be noted that a high log level can have a negative performance impact on the platform.

4

Blue Coat ProxySG Configuration

The Blue Coat ProxySG allows creating policies to send content for inspection by the ICAP Gateway. The following steps should be taken as a basic configuration guideline, and never be taken as the optimum configuration.

It is required that the configuration is done by an administrator with working knowledge of the platforms involved.

The entire configuration of the ProxySG is done through the management web interface. The steps to redirect the users’ requests and responses follow:

1. Connect to the Blue Coat web interface. Open a web browser and point it to https://Blue_Coat_IP_address:8082.

(7)

SECURE ICAP Gateway

Blue Coat Implementation Guide

3. In the Blue Coat Management UI, browse to ICAP Services configuration under the “External Services” option in the “Configuration” tab.

(8)

SECURE ICAP Gateway

Blue Coat Implementation Guide

5. ICAP feedback can be configured, such as when to show the patience page to the user while the inspection takes place.

6. A pool of SECURE ICAP Gateways can be configured so that ProxySG will make requests evenly through the pool. In order to do that, a Service Group needs to be configured containing the available ICAP Gateways.

Once the basic configuration has been done, the policy needs to be set up so that the selected requests or responses are sent to the SECURE ICAP Gateway for inspection. This process will usually be performed on an existing ProxySG. Thus, the policy will need to be modified for the redirection.

As a simple reference, the following steps show how to configure a basic policy for inspecting requests from users and responses from servers.

(9)

SECURE ICAP Gateway

Blue Coat Implementation Guide

2. In the appropriate Web Content Layer policy set a new action object.

3. Select the previously created ICAP services so that the content that hits this rule is redirected to the ICAP Gateway for inspection.

Logs provide information to validate that the integration has been properly done. 1. Enable access logging by selecting the option in the web interface and

(10)

SECURE ICAP Gateway

Blue Coat Implementation Guide

2. In the log tail of the main log, new entries should be shown with “404 TCP_NC_MISS” which correspond to the tests that the ProxySG does to validate that the ICAP Gateway is running.

(11)

SECURE ICAP Gateway

Blue Coat Implementation Guide

5

Feature List

5.1

Certified Platform

Certification Environment

Product Name Version Information Operating System

Clearswift SECURE ICAP Gateway 3.1.1 Virtual Appliance Blue Coat Proxy SG 300 Series

500 Series SGOS 6.5.1

5.2

Feature List

Feature Benefit

Platform

ICAP server Connect to existing ICAP clients within your infrastructure. Supported ICAP client: Blue Coat Proxy SG

Flexible deployment options: Hardware,

Software image, VMware vSphere Provides full flexibility to adapt to your organization’s IT strategy.

Active Directory (AD) / LDAP integration Full user-based policy control for flexible policy and audit reporting bygroup or individual.

Policy

Flexible and granular policy controls Easily define policies to enable and allow Web 2.0 usage while minimizingrisk.

Facebook, LinkedIn, Twitter and YouTube policy

Allow access to Web 2.0 sites, but only to content and features allowed by your policy.

Policy direction to provide additional contextPrevent certain file types, e.g. spreadsheets, from being uploaded but allow them to be downloaded.

Customizable block pages Educate users by providing personalized feedback on their actions.

Data Loss Prevention

Adaptive Redaction: Data Redaction (Optional)

Modify content in real time to avoid delaying business processes while protecting sensitive information.

Adaptive Redaction: Document Sanitization (Optional)

Prevent hidden information within documents (e.g. metadata, properties, or quick save data) from being leaked.

Adaptive Redaction: Structural Sanitization (Optional)

Detect and strip active content from documents and HTML pages to protect from APT’s and unknown threats.

Clearswift Information Governance Server integration (Optional)

Detect full or partial files being uploaded or downloaded. Allow tracking of any information traversing the SECURE ICAP Gateway.

External data source connection Accurately identify data from your databases that is found in transit. Lexical analysis and regular expression rules Search file content for key words and phrases using simple or more complex

pattern matching to identify sensitive data in over 200 character encodings. Pre-defined sensitive data templates Identify credit card, bank account, social security and national security

numbers.

Compliance dictionaries Multi-language editable compliance dictionaries including GLBA, HIPAA, SEC, SOX, PCI and PII to minimize risks.

Predefined Tokens Multiple, including: Credit Card, Social Security, IBAN, National Insurance, Tax file number, German Identity, Business Identifier Code

MIMEsweeper true ‘binary file-type’ identification

Accurate binary based identification with the ability to define own file signatures.

Hygiene

Bi-directional virus and anti-malware scanning

Stops known and unknown malware infection entering or leaving the network. Bi-directional anti-spyware scanning Stops spyware, adware, key loggers and spyware call homes from infected

machines.

(12)

SECURE ICAP Gateway

Blue Coat Implementation Guide

Feature Benefit

Real-time categorization engine Prevents access to new or uncategorized sites with inappropriate content. Content aware recursive inspection Decomposes the requests and responses to provide true detection of content

like executables even when embedded in other file types or compressed containers.

Management and Reporting

Intuitive web-based interface Ease of use and no requirement to learn complex syntax or operating system commands.

Pre-defined customizable reports Easy to modify, run and share graphical reports with intuitive drill down. Scheduled reporting Allows create once, run and distribute many times with circulation via email. Multi-Gateway consolidated reporting Consolidated reporting view of user’s activities for easier analysis and sharing of

management data.

Figure

Updating...

References

Updating...

Related subjects :