Web Gateway 7.1.5 Product Guide - McAfee

Operating system
Introduction
Filtering rules on the McAfee Web Gateway appliance 1
The subsystems of the appliance rely on the functions of its operating system, which is MLOS (McAfee
Linux Operating System) version 1.0.
The operating system provides functions for executing the actions that the filtering rules trigger, file
and network reading and writing, and access control.
A configuration daemon (sysconfd daemon) implements changed configuration settings in the operating
system.
Filtering rules on the McAfee Web Gateway appliance
Rules control the filtering process on the appliance. Reviewing these rules lets you understand what the
appliance does to ensure web security. You need not set up these rules yourself, a wizard can do this
for you, according to your instructions, or a default system of rules is implemented. You can then still
modify every detail of the implemented system.
It is the job of the filtering rules to look at web objects before users of your network are allowed to
access them and also at these users. These rules check the properties of objects and users and if, for
example, an object is virus-infected or a user not in an allowed user group, they block access to the
object or let the user not complete further activities.
Rule sets for filtering
A rule usually works with other rules to do its job. For example, a whitelisting rule can work with a few
blocking rules to do URL filtering. The whitelisting rule says which URLs are allowed and the blocking
rules say which are not. Together, these rules are in a URL filtering rule set.
The implemented system of rule sets is displayed on the Rule Sets tab of the user interface. When you
review it, you will see rule sets there for URL filtering, virus and malware filtering, media type filtering,
and other purposes. When you open a rule set, you will see the individual rules that are contained in it.
Even a rule that works on its own, like a global whitelisting rule might do, is embedded in a rule set.
Some rule sets have other rule sets nested within them. This way, for example, media type filtering can
be split up between a nested rule set that filters media type uploads and another nested rule set that
filters the downloads.
Lists and modules for filtering
Rules are interested in the properties of web objects and users. A blocking rule for URLs needs to know
which categories URLs belong to, so it can block, for example, a URL that is in the online-shopping
category and prevent the users of your network from accessing it.
To get at the information they need, rules rely on:
• Filter lists — A list can, for example, contain URLs of web sites for online shopping. When a user
requests access to a particular URL, a blocking rule goes through the list to see if that URL is on it.
• Special modules — Information on URL categories can be retrieved from the Global Threat
Intelligence system. A module on the appliance communicates with this system and tells the blocking
rule about its findings.
Other modules scan web objects for infections, inspect certificates, check user credentials for
authentication, or perform other activities related to web and user filtering.
McAfee Web Gateway 7.1.5 Product Guide 17