McAfee MSA09EMB1RAA - Site Advisor Plus 2009 User manual

McAfee SiteAdvisor Enterprise Plus 3.0
Product Guide

COPYRIGHT
Copyright ©2009 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE
EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,
WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in
connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property
of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
License Attributions
Refer to the product Release Notes.
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide2

Contents
Introducing SiteAdvisor Enterprise Plus.................................................5
Benefits of using SiteAdvisor Enterprise Plus....................................................5
Howsafetyratingsarecompiled..............................................................6
Safety icons and balloons protect during searches ...............................................6
Using site safety balloons ............................................................7
SiteAdvisormenuprotectswhilebrowsing......................................................7
Using the SiteAdvisor menu ..........................................................8
Safetyreportsprovidedetails.................................................................9
Viewingsafety reports..............................................................10
Administrators customize policy settings ......................................................11
Setting up a Browsing Security Strategy ..............................................13
Guidelines for creatingastrategy............................................................13
Selecttherightpolicyoptionsandfeatures....................................................14
Information that SiteAdvisor Enterprise Plus sends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Configuring Policies ......................................................................16
How policies work ........................................................................16
Types of policy categories ..................................................................17
Default policy settings .....................................................................17
Creatingand editingpolicies................................................................19
Apply general options......................................................................19
Configuring proxy settings ..........................................................20
Enabling observe mode .............................................................21
Settingthecontrolpaneloption.......................................................21
Blockandwarnsitesbyratingsandthreatfactors...............................................22
Configuring access based on ratings ..................................................22
Use Authorizeand Prohibit listsfor sites.......................................................24
How site patterns work .............................................................25
How multiple-instance policies work...................................................26
Working with Authorize lists .........................................................27
WorkingwithProhibitlists...........................................................32
Customize messages for users ..............................................................35
3McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Creating customized messaging ......................................................35
Disable andreenablethe software ...........................................................38
Disabling and re-enabling from the ePO server..........................................38
Disabling andreenabling from thebrowser.............................................39
Track events for reports....................................................................39
Tracking visits to domains and downloads..............................................40
Tracking domain page views and downloads............................................41
Tracking green site content categories.................................................41
Using Dashboards, Monitors, and Reports ............................................43
Use queries to create reports ...............................................................43
Creating reports ...................................................................44
Running a purge task...............................................................45
Usedashboardsandmonitors...............................................................45
Creating monitors .................................................................46
Reference..................................................................................47
Frequently Asked Questions ................................................................47
Where to find more information .............................................................50
Web Filtering for Endpoint and Web Reporter Appendix.............................51
How web content filtering works.............................................................51
Policy additions with web content filtering.....................................................51
Report and dashboard additions with web content filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
How WebReporterworks...................................................................52
Sending Web Reporter logs.................................................................53
Applying the Content Actions policy..........................................................53
Workingwiththe WebReporter..............................................................54
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide4
Contents

Introducing SiteAdvisor Enterprise Plus
McAfee®SiteAdvisor®Enterprise Plus is a browser protection solution that can be deployed
and managed by using McAfee ePolicy Orchestrator®4.0 or 4.5. The client software runs on
managed systems to protect users from threats they encounter while searching and browsing
websites with Internet Explorer or Firefox or downloading files with Internet Explorer. SiteAdvisor
Enterprise Plus is integrated with McAfee advanced protection solutions.
This guide provides information that you need to create a browsing security strategy for your
business and configure SiteAdvisor Enterprise Plus policy options.
Contents
Benefits of using SiteAdvisor Enterprise Plus
How safety ratings are compiled
Safety icons and balloons protect during searches
SiteAdvisor menu protects while browsing
Safety reports provide details
Administrators customize policy settings
Benefits of using SiteAdvisor Enterprise Plus
As SiteAdvisor Enterprise Plus runs on each managed system, it notifies users about threats
they might encounter when searching or browsing websites by displaying the following:
Safety rating for each site
• When searching, safety ratings of green, yellow, red, and gray icons appear next to each
site listed on a search results page.
• When browsing, the SiteAdvisor menu button appears in the browser window in the color
that matches the safety rating for the current site.
Safety report for each site
• The report includes a detailed description of test results and feedback submitted by users
and site owners.
• Users access safety reports to learn more about how the safety rating for a site was
calculated.
Using the ePO Policy Catalog, administrators can create SiteAdvisor Enterprise Plus policies that
determine which sites managed systems can access. They can assign actions to sites based on
their SiteAdvisor rating (for example, block red sites and warn users trying to access yellow
sites). They can create lists of authorized and prohibited sites based on URLs and domains.
Administrators can also customize the messaging that SiteAdvisor Enterprise Plus displays to
managed systems, and prevent users from disabling the client software on managed systems.
5McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

With the addition of the Web Filtering for Endpoint extension, you can expand safety ratings
to include site content and track pages viewed on domain sites. With the addition of Web
Reporter you can create detailed reports on websites.
The SiteAdvisor Enterprise Plus client software supports both Microsoft Internet Explorer and
Mozilla Firefox browsers.
NOTE: The only difference in functionality between the browsers is that Firefox does not allow
users to hide the SiteAdvisor button with the View | Toolbars command or check file
downloads.
How safety ratings are compiled
A McAfee team derives safety ratings by testing a variety of criteria for each site and evaluating
the results to detect common threats.
Automated tests compile safety ratings for a website by:
• Downloading files to check for viruses and potentially unwanted programs bundled with the
download.
• Entering contact information into signup forms to check for resulting spam or a high volume
of non-spam emails sent by the site or its affiliates.
• Checking for excessive popup windows.
• Checking for attempts by the site to exploit browser vulnerabilities.
• Checking for deceptive or fraudulent practices employed by a site.
The team assimilates test results into a safety report that can also include:
• Feedback submitted by site owners, which might include descriptions of safety precautions
used by the site or responses to user feedback about the site.
• Feedback submitted by site users, which might include reports of phishing scams, bad
shopping experiences, and selling services that can be obtained without cost from other
sources.
• Additional analysis by McAfee professionals.
Safety icons and balloons protect during searches
When users type keywords into a popular search engine such as Google, Yahoo!, MSN, Ask, or
AOL.com, color-coded safety icons appear next to sites listed in the search results page:
Tests revealed no significant problems.
(Green, checkmark)
Tests revealed some issues users should know about. For example,
the site tried to change the testers’ browser defaults, displayed
popups, or sent them a significant amount of non-spam email.
(Yellow, exclamation point)
Tests revealed some serious issues that users should consider
carefully before accessing this site. For example, the site sent
testers spam email or bundled adware with a download.
(Red, x)
This site is blocked by a Prohibit List, Rating Actions, or Content
Actions policy option.
(Red, bar)
This site is unrated.
(Gray, question mark)
Introducing SiteAdvisor Enterprise Plus
How safety ratings are compiled
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide6

Placing the cursor over an icon displays a safety balloon that summarizes the safety report for
a site. Click More Info or a report link for a detailed safety report.
Using site safety balloons
Use this task to view additional information available through a site’s safety icon listed in a
search results page.
Task
1Hold the cursor over the site’s safety icon. A safety balloon displays a high-level summary
of the site’s safety report.
2Click a safety report link or the More info link in the safety balloon to view details of the
site's safety report.
SiteAdvisor menu protects while browsing
When users browse to a website, a color-coded menu button appears in the top-left corner of
the window. The color of the button corresponds to the site’s safety rating. Placing the cursor
over this button displays a safety balloon that summarizes the safety report for the site, with
a link to the detailed site report page. The menu button next to the icon displays the SiteAdvisor
menu.
Indicates this...With this color
and symbol...
This button...
The site is safe.Green, checkmark
There might be some issues with the site.Yellow, exclamation
point
There might be some serious issues with the site.Red, x
No rating is available for the site.Gray, question
mark
A communication error occurred with the SiteAdvisor website that
contains rating information.
Gray, disconnected
cables
Client settings that affect the SiteAdvisor menu button
• When SiteAdvisor Enterprise Plus is disabled, the menu button is gray with a question mark.
•When event tracking is disabled for specific sites in the Authorize List or in the Event Tracking
policy, the menu button is gray with a question mark while visiting the sites.
• When a communication error occurs with the SiteAdvisor server, the menu button is gray
with disconnected cables.
• In Internet Explorer, users can display or hide the menu button by using the View |
Toolbars | McAfee SiteAdvisor menu option. This does not affect the functional status
(enabled or disabled) of the SiteAdvisor Enterprise Plus client software.
NOTE: Firefox users cannot hide the menu button while SiteAdvisor Enterprise Plus is enabled.
Introducing SiteAdvisor Enterprise Plus
SiteAdvisor menu protects while browsing
7McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Troubleshooting link
If the gray communication error button appears, a troubleshooting link in the site's safety
balloon opens to a connection status page. This page displays the reason for the communication
error and provides information on possible resolutions. Clicking this link runs these test with
these results:
Explanation if there is an
issue
What this meansTest
Your computer cannot access the
Internet. This might indicate the
Does the browser have internet access?Internet Access
SiteAdvisor policy for proxy
settings are configured
incorrectly. Contact your
administrator.
The SiteAdvisor servers appear
to be down.
Is the SiteAdvisor server down?SiteAdvisor Server Availability
The SiteAdvisor servers are up,
but they are not responding to
requests.
Is the SiteAdvisor server responding to requests?SiteAdvisor Server Response
Format
The Repeat Tests button allows the user to see if the error persists or has been corrected
while the page is open.
Using the SiteAdvisor menu
Use this task to display the options for accessing SiteAdvisor features on managed systems.
Task
1Click the down arrow on the SiteAdvisor menu button to view the SiteAdvisor menu and
do any of the following:
To do this...Select this command...
Display the safety report for the current site (not
available when SiteAdvisor Enterprise Plus is disabled).
NOTE: You can also click Read site report in the site
safety balloon.
View Site Report
Display the current site’s safety balloon (not available
when SiteAdvisor Enterprise Plus is disabled). The
Show Balloon
balloon disappears after a few seconds, or you can click
the close button.
NOTE: The site safety balloon also appears by placing
the cursor over the menu button.
Turn the SiteAdvisor Enterprise Plus client software off
or on (available only when an Enable/Disable policy
option is configured to allow this functionality).
Disable/Enable SiteAdvisor
Access a brief description of browser protection, its
license agreement, and its privacy policy.
About
2If the communication error button appears, show the balloon for the site, and click
Troubleshoot. The connection status page that appears indicates the possible cause of
the communication error.
Introducing SiteAdvisor Enterprise Plus
SiteAdvisor menu protects while browsing
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide8

Safety reports provide details
Users can supplement the color-coded safety information for a site by viewing its detailed safety
report. These reports describe specific threats discovered by testing and include feedback
submitted by site owners and users.
Safety reports for sites are delivered from the McAfee SiteAdvisor and provide the following
information:
ExplanationItem
The overall rating for the website. We determine this rating
by looking at a wide variety of information. First, we
Summary
evaluate a website's email and download practices using
our proprietary data collection and analysis techniques.
Next, we examine the website itself to see if it engages
in annoying practices such as excessive pop-ups or
requests to change your home page. Then we perform an
analysis of its online affiliations to see if the site associates
with other sites flagged as red. Finally, we combine our
own review of suspicious sites with feedback from our
volunteer reviewers and alert you to sites that are deemed
suspicious.
The year the domain name was registered. More recently
registered websites have had less time to prove their safety
and trustworthiness.
Established
The country where a domain is registered. Keep in mind
that it's sometimes more difficult to get good customer
Country
service or resolve disputes with websites registered outside
of your country of residence.
The level of how popular the website is. Don't assume,
however, that popularity always goes hand in hand with
Popularity
safety. For example, some very popular prize sites send
lots of spam, and some very popular file-sharing programs
bundle adware. Likewise, many personal websites, blogs
and small business sites that do not get a lot of traffic can
be safe to browse and use. That's why the analysis behind
SiteAdvisor's overall verdict is so useful.
Overall rating for a website's email practices. We rate sites
based on both how much email we receive after entering
Email Results
an address on the site as well as how spammy the email
we receive looks. If either of these measures is higher
than what we consider acceptable, we'll give the site a
yellow warning. If both measures are high, or one of them
looks particularly egregious, we'll give the site a red
warning.
Each email link opens a detailed email analysis page.
Overall rating about the impact a site's downloadable
software had on our testing computer. Red flags are given
Downloads
to sites that have virus-infected downloads or that add
unrelated software which many people would consider
adware or spyware. The rating also takes note of the
network servers a program contacts during its operation,
as well as any modifications to browser settings or a
computer's registry files.
Each download link opens a detailed download analysis
page.
Introducing SiteAdvisor Enterprise Plus
Safety reports provide details
9McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

ExplanationItem
Indication of how aggressively the site tries to get you to
go to other sites that we've flagged as red. It is a very
Online Affiliations
common practice on the Internet for suspicious sites to
have many close associations with other suspicious sites.
The primary purpose of these "feeder" sites is to get you
to visit the suspicious site. A site can receive a red warning
if, for example, it links too aggressively to other red sites.
In effect, a site can become "red by association" due to
the nature of its relationship to red flagged domains.
Common web practices that users find annoying, such as
excessive pop-ups, requests to change a user's home page,
Annoyances
or requests to add a site to the browser's favorites list.
We also list third-party cookies (sometimes known as
"tracking cookies") in this section. If a website has a lot
of pop-ups, and in particular if it engages in practices such
as popping up more windows when you try to close them,
we will give that website a red flag.
Rare but extremely dangerous security threats caused by
a website "exploiting" a browser's security vulnerability.
Exploits
The exploit can cause the user's computer to receive
programming code that can cause adware infections,
keystroke spying, and other malicious actions that can
leave a computer essentially unusable.
Reviewers and site owners can provide additional
information and commentary to supplement SiteAdvisor's
automated test results.
Reviewer and Site Owner Comments
Summary of the comments of SiteAdvisor's entire reviewer
community. Reviewers can rate sites for downloads, email
Results
practices, shopping experiences and more. This input is
particularly important in helping the SiteAdvisor community
guide each other concerning e-commerce websites.
Anonymous input alone is not enough to change a site's
overall rating, but sufficient votes from registered users
can affect a site's rating.
Allows owners of analyzed websites to address our ratings.
Owners are free to comment, disagree or clarify. These
Website owner comments
comments are posted unedited after we verify the
authenticity of the person leaving the comment. We
manually review all owner comments and if an error was
made, we will try our best to promptly correct it. We don't
allow sites to pay to be rated or to change or improve their
ratings.
What our volunteer reviewers have to say about this
website. These comments are posted unedited.
Reviewer comments
Viewing safety reports
Use this task to view safety reports to obtain more information about a site’s safety rating.
Task
• Do any of the following to view a safety report for a site:
Introducing SiteAdvisor Enterprise Plus
Safety reports provide details
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide10