Cisco Cisco Web Security Appliance S170 사용자 가이드

This chapter contains the following information:

Malware is pervasive and persistent, and unfortunately, usually finds access to the computers inside your 
network. Users increasingly work with customers and partners to collaborate on projects and increase 
productivity. This increased collaboration poses challenges for information security professionals to 
determine how to prevent malware infections on internal systems from accidentally infecting key 
partners, and therefore adversely affecting their reputation.

The Web Security appliance provides the outbound malware scanning feature which allows you to stop 
malware that is already active on computers inside the network from escaping the network and affecting 
customers and partners. 

The Cisco IronPort Dynamic Vectoring and Streaming (DVS) engine scans transaction requests as they 
leave the network in real time. By working with the Cisco IronPort DVS engine, the Web Security 
appliance enables you to prevent users from unintentionally uploading malicious data. 

To prevent malicious data from leaving the network, the Web Security appliance provides the Outbound 
Malware Scanning policy groups. You define which uploads are scanned for malware, which 
anti-malware scanning engines to use for scanning, and which malware types to block.

For more information on anti-malware scanning, see 

.

When the Cisco IronPort DVS engine blocks an upload request, the Web Proxy sends a block page to the 
end user. However, not all websites display the block page to the end user. For example, some Web 2.0 
websites display dynamic content using javascript instead of a static webpage and are not likely to 
display the block page. Users are still properly blocked from uploading malicious data, but they may not 
always be informed of this by the website.