Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Application Defenses
Application
Defenses
4-14 Understanding Policy Configuration
Please note the following points about service groups:
The services in a service group can be either all allowed or all
denied on a proxy rule. It is not possible to use the same proxy
rule to allow access to a subset of services in a service group while
at the same time deny access to a different subset of services.
Service groups are extremely effective when implemented in a
proxy rule that regulates access for a user group or netgroup. Keep
in mind, however, that all members in the user group or netgroup
must conform to the same security policy (that is they will all be
allowed or denied access to the same collection of services).
Authentication can be configured for a service group rule, even if
not every service in the group permits authentication. The
Sidewinder G2 is able to differentiate which services require
authentication within a group. Mixed service groups
(authenticating and non-authenticating services) are best used with
allow rules. You can use SSO to require authentication for all
services in a service group.
You can define as many service groups as needed.
As always, the sequencing of rules within the active rule group
remains important, regardless of whether a service group is used.
Application Defenses allow you to configure advanced applicationspecific
properties for each proxy, including basic timeout properties
and application-specific permissions. You can also configure key
services such as anti-virus, anti-spam, SSL decryption, and Web
services management.
You can create Application Defenses in advance and then select the
defense for each rule that you create, or you can create defenses
during rule creation. Whether you create Application Defenses in
advance or within a proxy rule, the defense will be saved to a
common database and can be used for other proxy rules without
needing to be recreated for other rules.
Application proxies that allow you to configure connection properties
are included in the Standard Application Defense. (You can also
configure transparency properties for the Telnet proxy within a
Standard Application Defense.) Application proxies that allow you to
configure advanced, application-specific options (such as anti-virus,
application permissions, etc.) as well as connection properties have
their own branch in the Defenses branch (e.g., Web, Secure Web,
Mail, Multimedia).