Cisco Cisco Web Security Appliance S690 User Guide
13-4
AsyncOS 9.0 for Cisco Web Security Appliances User Guide
Chapter 13 Configuring Security Services
Overview of Anti-Malware Scanning
Web Reputation in Decryption Policies
Web Reputation in Cisco IronPort Data Security Policies
Overview of Anti-Malware Scanning
The Web Security appliance anti-malware feature uses the Cisco IronPort DVS™ engine in combination
with anti-malware scanning engines to stop web-based malware threats. The DVS engine works with the
Webroot™, McAfee, and Sophos anti-malware scanning engines.
with anti-malware scanning engines to stop web-based malware threats. The DVS engine works with the
Webroot™, McAfee, and Sophos anti-malware scanning engines.
The scanning engines inspect transactions to determine a malware scanning verdict to pass to the DVS
engine. The DVS engine determines whether to monitor or block the request based on the malware
scanning verdicts. To use the anti-malware component of the appliance, you must enable anti-malware
scanning and configure global settings, and then apply specific settings to different policies.
engine. The DVS engine determines whether to monitor or block the request based on the malware
scanning verdicts. To use the anti-malware component of the appliance, you must enable anti-malware
scanning and configure global settings, and then apply specific settings to different policies.
Related Topics
•
•
Understanding How the DVS Engine Works
The DVS engine performs anti-malware scanning on URL transactions that are forwarded from the Web
Reputation Filters. Web Reputation Filters calculate the probability that a particular URL contains
malware, and assign a URL score that is associated with an action to block, scan, or allow the transaction.
Reputation Filters. Web Reputation Filters calculate the probability that a particular URL contains
malware, and assign a URL score that is associated with an action to block, scan, or allow the transaction.
When the assigned web reputation score indicates to scan the transaction, the DVS engine receives the
URL request and server response content. The DVS engine, in combination with the Webroot and/or
Sophos or McAfee scanning engines, returns a malware scanning verdict. The DVS engine uses
information from the malware scanning verdicts and Access Policy settings to determine whether to
block or deliver the content to the client.
URL request and server response content. The DVS engine, in combination with the Webroot and/or
Sophos or McAfee scanning engines, returns a malware scanning verdict. The DVS engine uses
information from the malware scanning verdicts and Access Policy settings to determine whether to
block or deliver the content to the client.
Score
Action
Description
-10 to -9.0
Drop
Bad site. The request is dropped with no notice sent to the end user. Use
this setting with caution.
this setting with caution.
-8.9 to 5.9
Decrypt
Undetermined site. Request is allowed, but the connection is decrypted
and Access Policies are applied to the decrypted traffic.
and Access Policies are applied to the decrypted traffic.
6.0 to 10.0
Pass through
Good site. Request is passed through with no inspection or decryption.
Score
Action
Description
-10 to -6.0
Block
Bad site. The transaction is blocked, and no further scanning occurs.
-5.9 to 0.0
Monitor
The transaction will not be blocked based on Web Reputation, and will
proceed to content checks (file type and size).
proceed to content checks (file type and size).
Note
Sites with no score are monitored.