Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
Virus and malware filtering 6
Process flow in a virus and malware filtering rule set
This section describes the process flow in a rule set for virus and malware filtering. This rule set could,
for example, include:
• A whitelisting rule for media types
• A whitelisting rule for URLs
• A blocking rule that blocks access to objects if they are infected.
When, for example, an infected, non-whitelisted object is sent in response to a user request from a web
server, these rules work together, creating a process flow as follows:
Object is a URL and on the whitelist?
– No. –>
Object is streaming media and on the
whitelist? – No.
Object is infected by a virus or other
malware? – Yes. –>
Processing continues with the next rule in the rule set.
–> Processing continues with the next rule in the rule set.
Processing of rules stops.
The object is blocked (and not passed on to the user
who requested it). A block message is sent to this user.
If the object were streaming media and on the whitelist, the process flow would be:
Object is URL and on the whitelist? –
No. –>
Object is streaming media and on the
whitelist? – Yes. –>
Object isinfected bya virus or other
malware?
Processing continues with the next rule in the rule set.
Processing of the rule set stops.
The blocking rule is not processed. The object is not
scanned for infections.
McAfee Web Gateway 7.1.5 Product Guide 173