Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
Media type filtering
Media type filtering
The appliance filters media according to their types, based on rules that use appropriate filter lists, so
particular text, audio, image, streaming, and other media can be blocked. This section explains media
type filtering and tells you how to modify the rules and lists that are involved in the filtering.
Rules for media type filtering
Rules for media type filtering block and whitelist media types. This section explains how these rules
work and how you can modify them. It also describes a media type filtering rule set from the library.
A media type filtering rule set typically includes nested rule sets for controlling media upload and
download. In each rule set, there is at least one rule that blocks media if their types are on a blocking
list.
There can be whitelisting rules that let media skip the blocking rule. There can also be several blocking
rules to handle different media types or media types in different contexts, for example, media types
embedded in archives. A special rule calls an opener module to open media.
Note: Media type filtering rules can also be included in rule sets that are not media type filtering rule sets in
the first place, for example, in virus and malware filtering rule sets.
Media type filtering rule
The following is an example of a rule for blocking media types.
Note: The rule is shown here in a notation similar to the one used on the user interface.
Name
Block types from list Download Media Type Blocklist
Criteria Action
MediaType.EnsuredTypes at least one in list Download Media Type –> Block
Blocklist
In plain text, this rule can be rephrased as follows:
If media belongs to a type that is on a particular blocking list, block access to it.
The rule criteria checks the MediaType.EnsuredTypes property. Media have this property if it can be
ensured with a probability of more than 50% that they are of a particular type. This is the case if a
signature from an internal list on the appliance can be found in the object code of the media.
For media that have their types ensured in this sense, the rule looks up the specified blocking list to see
whether they are on it. It they are, the criteria is matched and the rule applies. If media belong to
multiple types, already one of them on the list is sufficient to let the criteria match.
The rule then executes the Block action. Processing of all rules stops and the media is not passed on to
the user who requested it. This way, access to it is blocked.
The settings of the Block action specify a message that is sent to a user who is affected by the action.
The message mentions media type as the blocking reason.
200 McAfee Web Gateway 7.1.5 Product Guide