Default Blocking
Malicious, phishing and botnet/C2 categories are blocked out of the box, for baseline protection from day one.
SecureWebaccessOn-device protection
Keep Users Safe From Malicious Websites, Wherever They Work
Customer problem
Web Threats Follow Users Everywhere
Many attacks start in a browser: a phishing link, a lookalike login page or a site that calls back to an attacker's server.
When everyone sat in one office, a gateway could filter this traffic. Today much of it starts on a laptop at home or on a public network and never touches the office gateway.
Backhauling it to a central proxy adds delay and cost.
- Phishing pages that copy familiar login screens
- Malicious domains hosting harmful downloads
- Botnet and command-and-control hosts
- Risky categories creating legal or data concerns
- Remote devices bypassing the office gateway
- Different web policy rules in every location
THE COSGRID SOLUTION
Web Policy That Follows the User
SecureWebAccess enforces web policy on the device through the COSGrid endpoint agent. Policy is set centrally and pushed to each device, which makes allow and block decisions locally. Malicious, phishing and botnet/C2 categories are blocked by default.
With SecureWebAccess, organisations can
- Block malicious, phishing and botnet/C2 sites by default
- Build policy from categories, domains, IPs and custom lists
- Allow or block named web applications per user or group
- Keep enforcing the last policy when the device is offline
- Export web activity logs to their SIEM
How It Works
Set Central Policy
Define policy by user or group using categories, applications, domains, IPs and custom lists, with allow, block or bypass and a default action.
Push to the Device
Policy is pushed to each device through the COSGrid endpoint agent, which makes allow and block decisions locally.
Check DNS and Requests
While connected to the COSGrid secure access service, DNS lookups for blocked domains are not resolved. On the device, requests are matched on host name.
Block and Log
Blocked requests show a block page explaining why. Web activity logs export to Splunk, Elasticsearch and CEF.
Key Benefits
DNS Security
Known bad domains are not resolved while the device is connected to the COSGrid secure access service.
On-Device Enforcement
The same policy applies at home, in the branch and on the road, without backhauling web traffic.
Flexible Policy
Build rules from categories, exact and wildcard domains, IPs, subnets, custom lists and web applications.
Works Offline
The agent keeps the last policy it received and continues to enforce it until it can fetch an update.
SIEM-Ready Logs
Logs show user, device, host, action, category or app, and process, and export to your SIEM.
Traditional Perimeter Web Security vs SecureWebAccess
Traditional Perimeter Web Security
- Protects traffic through the office gateway
- Remote and branch traffic backhauled or unfiltered
- Filtering appliance needed at each site
- Off-network devices often have no policy
- Office and remote policies set in different tools
- Logs tied to network location
SecureWebAccess
- Enforces policy on the device, wherever it connects
- Policy applies locally, without backhauling
- No web-filtering hardware per site for agent-running devices
- Agent keeps the last policy when offline
- One central policy pushed to every enrolled device
- Logs tied to user, device and process
Use cases
Built for every web access scenario
Stop phishing clicks at home
A user at home clicks a phishing link. The domain is in a blocked category, so the request is stopped and a block page explains why.
Limit shared devices without a filtering appliance
Staff on shared devices are limited to the sites and applications they need, without a filtering appliance at every site.
Keep web policy on hotel and public Wi-Fi
A laptop on hotel Wi-Fi keeps its web policy, and keeps enforcing the last policy if the policy server is unreachable.
Tighter policy for a separate group
A separate group gets a tighter policy, with only the categories and applications their role needs.
Who Is This For
Need SaaS discovery and control? See "See and control the SaaS apps your staff actually use"
- CISOs
- IT Operations Teams
- Endpoint Teams
- SOC Analysts
- Branch & Store Organisations
FAQs
Have a question about secure web access and SecureWebAccess?
What is a secure web gateway?
A secure web gateway (SWG) applies security and acceptable-use policy to users' web traffic. SecureWebAccess does this on the device itself, so policy applies wherever the user works.
How does SecureWebAccess protect users from malicious websites? It blocks malicious, phishing and botnet/C2 categories by default. You can add your own category, application, domain, IP and custom lists. Requests that match a block rule are stopped, and the user sees a block page.
Does DNS security work everywhere? DNS security works while the device is connected to the COSGrid secure access service. Endpoint web policy applies whether or not that connection is up.
