Web Protection Module1 for Endpoint Security Platform Administrator’s Guide e Endpoint d i t Security S
Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the applicable user documentation. Trend Micro, the Trend Micro t-ball logo, OfficeScan, Damage Cleanup Services, ScanMail, and TrendLabs are service marks, trademarks or registered trademarks of Trend Micro, Incorporated.
The user documentation for Trend Micro™ Web Protection Module 1.0 is intended to introduce the main features of the software and installation instructions for your production environment. You should read through it prior to installing or using the software. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at docs@trendmicro.com. Please evaluate this documentation on the following site: http://www.
Contents Preface Trend Micro Web Protection Module Documentation ...............................iv Audience ..............................................................................................................iv Document Conventions .................................................................................... v Supported Client Operating Systems ............................................................... v Hardware Requirements ............................................................
Trend Micro™ Web Protection Module 1.
Preface Preface Welcome to the Trend Micro™ Web Protection Module User’s Guide. This guide contains information about product settings and service levels. Trend Micro Web Protection Module (WPM) joins its real-time visibility and control platform with your existing desktop security solution to prevent Web-based malware from infecting your users’ computers. Trend Micro Web Protection Module reduces the need for threat scanning and clean-up by intercepting malware before it reaches your users’ computers.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide • Incompatible Software • Process Overview Trend Micro Web Protection Module Documentation The Trend Micro Web Protection Module documentation consists of the following: Trend Micro™ Web Protection Module User’s Guide — Helps you install, plan for deployment, and configure all product settings.
Preface Document Conventions To help you locate and interpret information easily, the Web Protection Module documentation uses the following conventions.
Trend Micro™ Web Protection Module 1.
Preface Incompatible Software • Trend Micro™ RUBotted (Beta) • Trend Micro™ TrendProtect 1.2 • Trend Micro™ Web Protection Add-On (Any) • Trend Micro™ OfficeScan™ Client/Server Edition 8.0 • Any other Trend Micro product with Trend Micro Web Reputation Services enabled Process Overview This procedure assumes that you have already installed the Trend Micro Endpoint Security Platform. To begin the gathering process: 1. Obtain a masthead for the Web Protection Module site. Email http://us.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide You will see a new Web Protection Module entry in the Dashboards menu and links to Web Protection Module Tasks and Wizards in your Navigation Bar. FIGURE P-2. Web Protection Module Entry In addition, the Web Protection Module site displays the Subscribed status in the Manage Sites window. FIGURE P-3.
Chapter 1 Installing Trend Micro Web Protection Module This section provides instructions for performing the most common tasks with Trend Micro Web Protection Module.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Checking for Incompatible Software Trend Micro Web Protection Module includes several AUDIT fixlets that automatically detect any of the following Trend Micro products: • Trend Micro™ OfficeScan™ Client/Server Edition 8.0 • Trend Micro™ TrendProtect • Trend Micro™ Internet Security 2009 • Trend Micro™ Internet Security Pro ESP cannot install Trend Micro Web Protection Module on an endpoint if one of these applications is installed.
Installing Trend Micro Web Protection Module 4. If one of the AUDIT fixlets appears, double-click on it to display the Document tabs for the message. FIGURE 1-2. 5. AUDIT Fixlet Document tabs Click the Applicable Computers tab to determine which endpoint or endpoints are running the software. FIGURE 1-3. Applicable Computers tab 6. Manually remove the incompatible software from the endpoint or endpoints, and then reboot. 7. Access the Fixlet Messages tab again.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Deploying Trend Micro Web Protection Module Agents You will now need to deploy the applicable Trend Micro Web Protection Module tasks. To deploy Trend Micro Web Protection Module Agents: 1. From the Tasks Navigation bar, click to View Applicable Web Protection Module Tasks link. The Web Protection Module Tasks window appears. FIGURE 1-4. 2. In the List Panel, click the Web Protection Module – Deploy link.
Installing Trend Micro Web Protection Module An Action window appears in which you can track the progress of your deployment. When it is finished, the status shows “Completed.” FIGURE 1-6. Note: Action window Trend Micro recommends configuring new Trend Micro Web Protection Module agents to prevent them from accumulating overly-large URL log files. (By default, ESP does not deploy new Agents with log maintenance configured.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 3. Click the here link in the Actions box. The Take Action window appears. 4. Select the computer or computers from which you want to uninstall the Web Protection Agent and click OK. The Private Key Password window appears. 5. Enter your Private Key Password and click OK. An Action window appears in which you can track the progress of your uninstall. When it is finished, the status shows “Pending Restart.” FIGURE 1-8.
Installing Trend Micro Web Protection Module To enable log maintenance: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Log Maintenance link. The Web Protection Module – Log Maintenance task window appears. FIGURE 1-9. 3. Web Protection Module - Log Maintenance page Click the here link in the Actions window. An Action Parameter window appears.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide value in the indicated drop-down. You can increase the frequency with which logs are archived to as little as 15 minutes or decrease it to as long as 30 days. 5. The Take Action window appears and displays “Fixlet Action Defaults” in the Action Preset drop down box. FIGURE 1-11. Take Action window Note: 6. 1-8 On the Targeting tab, select the All Computers button to target by property.
Installing Trend Micro Web Protection Module • Archive the current URL history and Web threat logs • Delete archived logs older than number of days you specify in Action Parameter window FIGURE 1-12. Take Action - Applicability tab 7. Click OK. The Private Key Password window appears. 8. Enter your Private Key Password and click OK. An Action window appears in which you can track the progress of your change. When it is finished, the status shows “Completed.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Note: If you want to change log maintenance behavior, first find any older log maintenance actions under the Actions tab and stop them. Then repeat steps 1-8. Note: You can audit endpoints to ensure they are configured with a log maintenance action by checking that no machines are relevant for the “Log Maintenance Not Configured” Fixlet. Trend Micro recommends that you check this Fixlet on a regular basis.
Installing Trend Micro Web Protection Module To configure one or more of the Agent’s proxy settings: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Enable/Configure Proxy Settings link. The Web Protection Module – Enable/Configure Proxy Settings task window appears. FIGURE 1-13. Web Protection Module - Enable/Configure Proxy Settings page 3.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Encrypting a Proxy String If your proxy server requires a password, you must encrypt it before you can continue. Click the tm_cli.exe link in the Web Protection Module – Enable/Configure Proxy Settings document page to download a zipped version of the password encryption utility. 1. Unzip the tm_cli.zip file and place both the tm_cli.exe and TmpxCfg.dll contents in a folder or target_directory that you can easily access. 2.
Installing Trend Micro Web Protection Module Configuring the Proxy You must configure the proxy settings as described in the section that follows. To configure the proxy: 1. Access the Web Protection Module – Enable/Configure Proxy Settings document page and click the here link in the Actions window. The first of four Action Parameter windows appears. FIGURE 1-15. Action Parameter window 1 2. Enter the IP address or hostname of the Web proxy your wish to use and click OK.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 3. Enter the port number and click OK. Another window appears asking for the username for accessing the proxy. FIGURE 1-17. Action Parameter window 3 4. Enter the username you would like to use. If your proxy does not require a username, leave the field blank. When you are finished, click OK. Another window appears, asking you to enter the password you would like to use to access the proxy. FIGURE 1-18. Action Parameter window 4 1-14 5.
Installing Trend Micro Web Protection Module 7. Enter your Private Key Password and click OK. An Action window appears in which you can track the progress of your uninstall. When it is finished, the status shows Completed. FIGURE 1-19. Action window Disabling a Proxy Server You can also disable a proxy server without uninstalling it. To disable one or more Agent’s proxy settings: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Note: Because ESP saves the proxy configuration for each user, you can easily re-enable the use of the proxy by running the Enable/Configure Proxy Settings task again. Disabling Web Reputation Technology This section contains instructions for disabling Trend Micro Web Reputation Technology (WRT).
Installing Trend Micro Web Protection Module 5. Enter your Private Key Password and click OK. An Action window appears in which you can track the progress of your change. When it is finished, the status shows Completed. Enabling Web Reputation Technology You can enable Trend Micro Web Reputation Technology (WRT) for one or more endpoints. Complete the steps that follow: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Configuring the Web Reputation Technology Security Level Trend Micro Web Protection Module enables you to set security levels for your endpoints. You can choose one of the following settings for each endpoint or group of endpoints: TABLE 1-1. 1-18 High Blocks URLs that have a malicious payload, those that are very likely to have a malicious payload, and those that are likely to have a malicious payload.
Installing Trend Micro Web Protection Module To set the WRT security level for one or more of your endpoints: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Configure Web Reputation Technology Security Level link. The Web Protection Module – Configure Web Reputation Technology Security Level Task window appears. FIGURE 1-23.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide helpful if individuals in your environment use something other than a Web browser to access potentially bad sites. When activated, this feature displays a pop-up window like the one that follows that appears for 30 seconds in the lower left corner of the screen whenever the Agent detects a threat. FIGURE 1-24. Threat Detection screen Note: 1-20 Threat events are also recorded in the logs.
Installing Trend Micro Web Protection Module To enable alert notification: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Enable Alert Notification for Detected Threats link. The Web Protection Module – Enable Alert Notifications for Detected Threats task window appears. FIGURE 1-25.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide To disable alert notification: 1. From the Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Disable Alert Notification for Detected Threats link. The Web Protection Module – Disable Alert Notifications for Detected Threats task window appears. FIGURE 1-26.
Installing Trend Micro Web Protection Module To see the client ID for an individual endpoint, see the Properties area of the Computer Summary tab. To upload logs to the ESP server: 1. From the ESP Tasks Navigation bar, click the View Applicable Web Protection Module Tasks link. The Web Protection Module Task window appears. 2. In the List Panel, click the Web Protection Module – Upload Web Threat Logs link. The Web Protection Module – Upload Web Threat Logs task window appears. FIGURE 1-27.
Trend Micro™ Web Protection Module 1.
Chapter 2 Using Trend Micro Web Protection Module This section provides instructions on using the Web Protection Module.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Blacklist and Whitelist Policies The Web Protection Module Blacklist-Whitelist Wizard enables you to create and maintain global lists of Web sites in the form of policies that you can use to control your user’s Web access. After you have defined these policies, you use them to create Custom Tasks that you can then apply to your endpoints.
Using Trend Micro Web Protection Module Creating and Deploying a New Policy This section describes how to create and deploy a new blacklist/whitelist policy. To create a new Blacklist / Whitelist policy: 1. Click Wizards > Web Protection Module Blacklist - Whitelist Wizard to access the Web Protection Module Blacklist-Whitelist Wizard from the ESP Console menu bar. The Blacklist-Whitelist Wizard Policy Management window appears, showing a list of all currently available policies: FIGURE 2-28.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 2. Click New. The Blacklist-Whitelist Configuration – New Policy window appears with the Blacklist tab open by default. FIGURE 2-29.
Using Trend Micro Web Protection Module 3. Enter a name for your policy in the Policy Name field. FIGURE 2-30. Policy Name field 4. In the Blacklist pane below the Policy Name field, enter, copy or paste the URLs you want to block. You can enter up to 500 URLs. You also must have “http://” before each URL entry. To block all the pages for a site, enter the name of the domain followed by “/*”, for example: http://www.badURL.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Note: You can block as many as 500 URLs per policy. If you wish to block more, create a different policy for each category of URLs you want to block. Note: If you do not want to include a Whitelist in the policy, you can skip this part of the process. The Web Protection Module allows you to create Blacklist / Whitelist policies with both list types (Blacklist and Whitelist), only a Blacklist, or only a Whitelist. 5.
Using Trend Micro Web Protection Module 7. When you are finished creating your policy, click Finish. The Edit Task window appears. FIGURE 2-31. Edit Task window 8. Enter the name of your Blacklist / Whitelist policy in the Name field. This ensures that the name of the policy appears as the name of the custom task when you generate it. 9. Click OK. 10. Enter your Private Key Password and click OK.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 11. In the Filter Panel, click My Custom Tasks. Your new Blacklist / Whitelist policy appears in the List Panel. FIGURE 2-32. List Panel screen 12. Double-click the name of your new Blacklist / Whitelist policy. The task pane for the policy appears. FIGURE 2-33. Task Pane screen 13. Click the here link in the Actions window. The Take Action window appears. 14.
Using Trend Micro Web Protection Module An Action window appears in which you can track the progress as ESP deploys your Blacklist / Whitelist policy to your endpoints. When it is finished, the status shows Completed. Importing Lists of Web Sites The Web Protection Module allows you to import URLs for new Blacklist and Whitelist policies from newline-delimited files. Note: The Blacklist / Whitelist file import feature requires ActiveX controls enabled in your browser.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 5. Click the Import List tab. The Import List pane appears. FIGURE 2-34. Import List tab 2-10 6. Enter the name for the new policy in the Policy Name field. 7. Select the text file you wish to import by either manually entering the path in the field under the Blacklist File Import / Whitelist File Import heading or by clicking Browse next to the type of file you wish to import. If you click Browse, the Open window appears. 8.
Using Trend Micro Web Protection Module 9. Select the file and click Open. The path to the selected file appears in the Import pane. FIGURE 2-35.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 10. Click Import. An ActiveX warning message appears. FIGURE 2-36. ActiveX Warning message 11. Click Yes to import the file. If you click No, to import the list you must re-launch the Wizard and perform the import process again. After you click Yes, the Blacklist / Whitelist Wizard displays the contents of the tab associated with the file. FIGURE 2-37.
Using Trend Micro Web Protection Module 12. Click Finish to end the import process and start generating the relevant Custom Action. Note: To see the process required to finish generating your Custom Action and deploying the policy, see Steps 7-16 in the Creating and Deploying a New Blacklist / Whitelist Policy section. Viewing an Existing Policy You can also view an existing policy. To view an existing Blacklist / Whitelist policy: 1.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 2. Select the name of the Blacklist / Whitelist policy you want to examine and click View. The Blacklist-Whitelist Configuration – View Policy window appears. FIGURE 2-39. Blacklist-Whitelist Configuration – View Policy window Notice that the contents of the Policy Name field and the Finish button are grayed out. This indicates that you are in View-only mode and you cannot make any changes. 3.
Using Trend Micro Web Protection Module keyboard. You can also return to the Policy view by clicking Back. (In this case, the Import List feature is disabled). FIGURE 2-40. View Policy page 4. To exit the Blacklist-Whitelist Configuration – View Policy window, click either Cancel or Close.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Copying and Editing a Policy The Web Protection Module enables you to create copies of existing Blacklist / Whitelist policies. Use this feature to create copies of existing policies or to create slightly modified versions of existing policies. To create a copy of an existing Blacklist / Whitelist policy: 1.
Using Trend Micro Web Protection Module The name of the policy appears in the form of “Copy of…” followed by the policy name you chose to copy. The Web Protection Module automatically copies the contents of the Blacklist and Whitelist fields into the new policy. 3. Change the name in the Policy Name field to what you want it to be. 4. Make any other changes you want to the policy. For example, in copied policies you can: 5.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide To make modifications using the Edit Task window, either access it as part of the Custom Task generation process or select it by right-clicking on the name of an existing Custom Task and selecting Edit. FIGURE 2-42. Edit a Custom Task pull-down The Edit Task window consists of four tabs: • Description • Actions • Relevance • Properties FIGURE 2-43.
Using Trend Micro Web Protection Module Use the Description tab to make modifications to the task name, title, and description. Use the Actions tab to view or change the Action this Custom Task performs. For example, use this window to add or remove Blacklisted or Whitelisted URLs from the presented Action Script. FIGURE 2-44.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Use the Relevance tab to view and make modifications to the relevance of a Custom Task. By default, the relevance for Blacklist / Whitelist is static. Its purpose is to detect endpoints for the Web Protection Module. FIGURE 2-45.
Using Trend Micro Web Protection Module Use the Properties tab to view and modify the properties of this custom task. FIGURE 2-46. Properties tab When you have finished making modifications, click OK. When the Private Key Password window appears, enter your password and click OK again. The edited/changed Blacklist / Whitelist policy appears in the List Panel when you choose My Custom Tasks.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide To delete a policy: 1. Click Wizards > Web Protection Module Blacklist-Whitelist Wizard to access the Web Protection Module Blacklist-Whitelist Wizard from the ESP Console menu bar. The Blacklist-Whitelist Wizard Policy Management window opens. 2. Select the name of the Blacklist / Whitelist policy you want to delete and click Remove. The Remove window appears. FIGURE 2-47. Remove window 3. Click OK.
Using Trend Micro Web Protection Module 7. Click OK. The Private Key Password window appears. 8. Enter your Private Key Password and click OK. ESP displays a series of messages as it removes the Custom Task from the affected WPM Agents and the List Panel. Analyses The Web Protection Module allows you to view detailed information about an endpoint or group of endpoints protected by a Web Protection Agent. By default, Trend Micro delivers these analyses activated.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide TABLE 2-2.
Using Trend Micro Web Protection Module Viewing the Client Information Analysis The following section describes how to view and analyze client information. To view a client information analyses: 1. Click the Analyses tab. The List Panel changes to show all available analyses. 2. Click All Applicable Analyses. 3. Click the “+” sign and then click By Site. 4. Click Web Protection Module.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 6. To view the details about each property, click the Applicable Computers tab. FIGURE 2-50. Applicable Computers tab You can view the analysis property results in either List or Summary format. To select a perspective, choose the desired format from the drop down box in the upper-right corner of the analysis in the Results tab. FIGURE 2-51. View as Summary option 7.
Using Trend Micro Web Protection Module Viewing the Site Statistics Analysis You can also view the site statistics analysis. To view the site statistics analysis: 1. Click the Analyses tab. 2. The List Panel shows all available analyses. 3. Click All Applicable Analyses. 4. Click the “+” sign and then click By Site. 5. Click Web Protection Module. The Web Protection Module presents you with a list of both available analyses. 6.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide 7. To view the details of each property, click the Results tab. FIGURE 2-53. Results tab You can view the analysis property results as either a list or in summary form. To select a perspective, choose the desired format from the drop down box in the upper-right corner of the analysis in the Results tab. FIGURE 2-54.
Using Trend Micro Web Protection Module 8. To deactivate the analysis, return to the click the here link in the Action window. The Web Protection Module Dashboard The Web Protection Module provides a dashboard that enables you to view statistics about the Web sites users’ access and the number of threats that it blocks. You can access the Dashboard in one of two ways: 1. To access the Dashboard from the ESP Console, select Dashboards > Web Protection Module. 2.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide Note: The Web Protection Module Dashboard only reports the information that is currently on each endpoint. If you have both a Log Maintenance and a corresponding Log Upload policy in place (which Trend Micro recommends as a best practice), historical information older than your specified aging threshold is archived on the ESP server.
Using Trend Micro Web Protection Module • Filters—Use these filters to restrict and organize Dashboard information. After you set them, these settings enable you to do the following: TABLE 2-4. F ILTER C ATEGORY Filter by Date D ESCRIPTION Set the date and time range of the information you want displayed in the Blocked Sites and Visited Sites tables. The entries default to the current date and time in a 24-hour format beginning at 00:00 hours and ending at 23:59 hours.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide • • Blocked Sites—This table lists the Web sites blocked for the endpoints specified using Filters. Information is displayed by: • URL • Most Recent Block • Number of Blocks • Blocked Devices Visited Sites—This table lists the Web sites visited by endpoints using Filters.
Using Trend Micro Web Protection Module To further sort a display, click or double-click on a column header. The header color changes and displays an arrow to indicate least to greatest (up arrow) or greatest to least (down arrow) number of entries. FIGURE 2-56. Visited Sites page Additionally, you can create “ad-hoc” listings and drill down to individual endpoints by double-clicking an entry in the Number of Devices column. FIGURE 2-57.
Trend Micro™ Web Protection Module 1.0 Administrator’s Guide FAQs What is the performance impact of the Web Protection Module Agent on network performance? The Web Protection Module Agent is very lightweight and requires no pattern updates. It checks for Web threats when the user accesses the Internet by performing a lookup on an “in-the-cloud” database. The Web Protection Module Agent uses the site’s “reputation” score and a security level set by the Console Operator to block access to suspicious sites.
Using Trend Micro Web Protection Module Support Search the Trend Micro User Forums for discussion threads and community-based support on a wide variety of topics. For questions or troubleshooting issues, search the list of available articles in the Trend Micro Knowledge Base at http://support.trendmicro.com. Get technical assistance from Trend Micro’s support team from anywhere in the world: United States (866) 752-6208 International (661) 367-2202 support.trendmicro.
Trend Micro™ Web Protection Module 1.
