The TRACEnet feature is a “zero day” protection framework supported by the Trustwave Security Labs team. TRACEnet identifies malicious URLs and allows you to block access to these sites. The Security Labs team provides frequent updates to the listed URLs, based on data from a number of sources. This framework gives protection against “blended” threats and new risks.
When TRACEnet is enabled, it receives updated URL information from Trustwave. The TRACEnet digest collator reports summary data about blocked threats to Trustwave over a secure Web connection. The Security Labs team uses the reported data as part of the threat identification process that feeds back in to TRACEnet updates.
TRACEnet initially provides four categories:
•Spam sites (URLs offering products or services, that are promoted through spam email)
•Phishing sites (URLs hosting fraudulent attempts to harvest personal information)
•Anonymous proxies (sites that allow users to bypass security by retransmitting web requests)
•Malicious sites (sites hosting malware or exploits)
Trustwave may add new categories to TRACEnet. New categories can be added dynamically during the standard update process.
TRACEnet service is included for WebMarshal customers holding current maintenance contracts, as well as with product trials. The maintenance expiration for TRACEnet displays on the TRACEnet page. This information is provided by the TRACEnet update server.
Figure 19: WebMarshal Console, TRACEnet window
To configure TRACEnet, in the left pane of the WebMarshal Console expand Access Policy and select TRACEnet.
To enable or disable the feature, check or clear the box on the main TRACEnet page. To enable or disable the individual categories, check or clear the box for each.
You can configure advanced settings for TRACEnet, including User Group and URL exclusions, an end-user “request reclassification” option, and download options. To configure advanced settings, at the top right of the main TRACEnet page click Settings. For more information, see Help.
To review TRACEnet activity and library updates, see the TRACEnet section of the Real-Time Dashboard. You can also request an immediate check for library updates using the Update Now button on the Dashboard.