Guidelines For Creating A Strategy - McAfee MSA09EMB1RAA - Site Advisor Plus 2009 Product Manual

Setting up a Browsing Security Strategy
SiteAdvisor Enterprise Plus includes a default policy with settings recommended by McAfee to
protect managed systems from most web-based threats. This section provides an overview of
features that assist you in customizing policy settings that are specific to your business needs.
The following topics provide details about using these features.
Contents

Guidelines for creating a strategy

Select the right policy options and features
Information that SiteAdvisor Enterprise Plus sends
Guidelines for creating a strategy
Follow these guidelines to design and implement a browsing security strategy that fully protects
your managed systems against web-based threats.
1 Install SiteAdvisor Enterprise Plus, enable Observe mode, and deploy the client
software.
Before deploying the client software, enable Observe mode (Action Enforcement tab on
the General policy page). This prevents SiteAdvisor Enterprise Plus from taking actions
(such as blocking and warning) configured as part of the default policy, but tracks browsing
behavior data that you can retrieve in reports.
See Evaluate policy settings with Observe mode under Configuring Policies .
2 Evaluate browsing traffic and usage patterns (Reports).
Run queries and review the results to learn about network browsing patterns. For example,
what types of sites are users visiting and what tasks are they performing at these sites?
What time of day is browsing traffic heaviest?
See Using Dashboards, Monitors, and Reports .
3 Create policies.
Configure policy options based on the browsing behavior revealed in the query results.
Prohibit, block, or warn about sites or downloads that present threats, and authorize sites
that are important to your users.
See the Configuring Policies chapter for more information.
4 Test and evaluate policy settings (Observe mode).
Enable Observe mode to track the number of users who access sites that would be affected
by the policy settings you have configured. Run queries, then view and evaluate the tracked
data. Are the settings comprehensive enough? Do they have any unintended consequences
you need to resolve? Adjust the policy settings as needed, then disable Observe mode to
activate them.
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide 13