Forcepoint Web Security Administrator - Module 4

Prévia do material em texto

<p>forcepoint.com</p><p>Forcepoint Web Security</p><p>Administrator - Module 4</p><p>Student Guide</p><p>Rev: CA0300</p><p>Public</p><p>Forcepoint Web Security 8.5.4 Administrator Course Student Guide forcepoint.com</p><p>© 2020 Forcepoint. Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.</p><p>All other trademarks used in this document are the property of their respective owners.</p><p>This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or</p><p>reduced to any electronic medium or machine-readable form without prior consent in writing</p><p>from Forcepoint. Every effort has been made to ensure the accuracy of this manual. However,</p><p>Forcepoint makes no warranties with respect to this documentation and disclaims any implied</p><p>warranties of merchantability and fitness for a particular purpose.</p><p>Forcepoint shall not be liable for any error or for incidental or consequential damages in</p><p>connection with the furnishing, performance, or use of this manual or the examples herein. The</p><p>information in this documentation is subject to change without notice.</p><p>2 > 3</p><p>© 2020 Forcepoint Public</p><p>Module 4:</p><p>Disaster Response</p><p>and Recovery</p><p>4 > 5</p><p>Public © 2020 Forcepoint 267</p><p>Module agenda</p><p>This module contains the following topics:</p><p> Incident Response</p><p> System Health</p><p> Updates and Upgrades</p><p> Disaster Recovery</p><p>The way we are going to meet this module’s objectives is through these topics.</p><p>6 > 7</p><p>Public © 2020 Forcepoint 269</p><p>Incident Response Overview</p><p>Incident = security breach or attack</p><p>Response = To address and manage</p><p>Incident Response</p><p>• Case to case basis</p><p>• Addressing and managing the aftermath of an</p><p>incident with the goal of handling the situation in a</p><p>way that limits damage and reduces recovery time</p><p>and costs</p><p>Incident response involves a meticulous process of addressing, managing, and preventing</p><p>security breaches or cyber attacks.</p><p>The strategy when planning for and coming up with a complete solution for incident</p><p>response varies for organizations that cater to local and/or global sectors.</p><p>Noise, whether it comes from personal communication, broken business processes or</p><p>false positives, makes the task of identifying genuine security risks challenging, even for</p><p>well-resourced security operations teams.</p><p>With Web Security, there are default settings and available options that help narrow down</p><p>high value data to pinpoint alerts that represent critical risks:</p><p>• Alert limit for email or SNMP alerts</p><p>• Total number of incidents included in Advanced File Analysis report</p><p>• Real-Time Monitor</p><p>In addition, Forcepoint offers solutions and services to improve an organization’s security</p><p>posture and incident response. Please refer to the following resources for an overview:</p><p>https://www.forcepoint.com/resources/webcasts/gdpr-improving-data-protection-incident-</p><p>response</p><p>8 > 9</p><p>This list aims to provide insights into how to prepare for an effective overall strategy for</p><p>incident response. Take this with a grain of salt as solutions, requirements, and</p><p>complexities differ from one network environment to the next. Incident response is not a</p><p>one size fits all.</p><p>Public © 2020 Forcepoint 271</p><p>Incident Response Guide</p><p>Before</p><p>• Data collection and</p><p>monitoring infrastructure</p><p>• Incident command principles</p><p>• Roles and organizational</p><p>structure</p><p>• Response infrastructure and</p><p>preparatory steps</p><p>During</p><p>• Trigger, escalate, and size</p><p>appropriately</p><p>• Detect, contain, and mitigate</p><p>After</p><p>• Triage</p><p>• Analyze</p><p>• Effectiveness of quality</p><p>assurance</p><p>10 > 11</p><p>The Status > Alerts page provides information about problems affecting the health of Web</p><p>Security, get troubleshooting help, and review the details of recent real-time updates to the</p><p>Forcepoint Master Database. The following options are available:</p><p>• The Active Alerts list shows the status of monitored Web Security components.</p><p>• For detailed information about which components are monitored, click the What is</p><p>monitored? link above the list of alert messages.</p><p>• To troubleshoot a problem, click the Solutions button next to the error or warning</p><p>message.</p><p>• To hide an alert message, click Hide Persistent Alerts. If your organization does not</p><p>use Log Server, Network Agent, or User Service, or if you do not plan to enable</p><p>WebCatcher, mark the appropriate check box in the Hide Alert column of the table.</p><p>Alerts associated with the selected service are no longer displayed.</p><p>The Real-Time Database Updates list provides information about emergency updates to</p><p>the Forcepoint</p><p>Master Database, showing:</p><p>• When the update occurred</p><p>• The update type</p><p>• The new database version number</p><p>• The reason for the update</p><p>• The IP address of the Filtering Service instance that received the update</p><p>These supplemental updates occur in addition to regular, scheduled Master Database</p><p>updates. These can be used, for example, to re-categorize a site that has been temporarily</p><p>miscategorized. Web Security checks for database updates every hour.</p><p>Public © 2020 Forcepoint 274</p><p>Web Security Alerts</p><p> Active Alerts</p><p>• Shows the status of monitored</p><p>Web Security components</p><p> Real-Time Security Updates</p><p>• Provides information about emergency</p><p>updates to the Forcepoint Master</p><p>Database</p><p>12 > 13</p><p>In addition to the GUI-based options, run these commands using appliance CLI to</p><p>determine the health of your appliance.</p><p>Public © 2020 Forcepoint 276</p><p>Appliance Health CLI Commands</p><p># show appliance status</p><p># show email</p><p># show networkagent</p><p># show proxy</p><p># show web</p><p># show cpu</p><p># show mem</p><p># show diskio</p><p># show diskspace</p><p># show bandwidth</p><p>14 > 15</p><p>Public © 2020 Forcepoint 278</p><p>Web Security Updates</p><p> Forcepoint.com</p><p>• Product Installers</p><p>• Patches & Hotfixes</p><p>• Upgrades</p><p> Which version is running?</p><p>• Security Manager</p><p>• Content Gateway Manager</p><p>• Appliance CLI</p><p>Updating Security Manager is easy. The first process you need to complete is to register for</p><p>a Forcepoint account. To request an account, click the option to register and request a new</p><p>login. Once you logged in, you will see the subscriptions attached to your account. Here</p><p>you can see which subscriptions are close to the expiration date or have already expired as</p><p>well as support entitlements and other relevant subscription information.</p><p>If you are looking to obtain the latest or past product installers, ensure that you are logged</p><p>in to access https://support.forcepoint.com/Downloads.</p><p>This is the only way to officially</p><p>obtain the latest product</p><p>downloads. Forcepoint does</p><p>not host installers anywhere</p><p>else.</p><p>16 About menu.</p><p>• Security Manager:</p><p>Access Security Manager, click the Help icon ( ), and then select About Security Manager.</p><p>• Content Gateway:</p><p>Access Content Gateway Manager. The Monitor > My Proxy > Summary page displays the</p><p>version and build number.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 17</p><p>For any minor or major version update of any</p><p>publicly available software version, you must log</p><p>on to https://support.forcepoint.com/Downloads</p><p>and download any applicable update.</p><p>For example, to upgrade to Web Security 8.5,</p><p>you must first download the Setup file (e.g.</p><p>Forcepoint85Setup.exe, WebsenseInstaller-</p><p>8.5.0.1978.exe).</p><p>A full installer is around the 2.5GB in size so take</p><p>a break or lunch time depending on your internet</p><p>connection. Once the file has been fully</p><p>downloaded, save it on a location with enough</p><p>disk space. To install the full product, extract the</p><p>file contents first. Contents of an installer file are</p><p>compressed using 7zip’s compression algorithm.</p><p>By default Forcepoint extracts the installer</p><p>contents into C:\Windows\Installer\{E546D7B7-</p><p>67FE-456b-A3CA-87CF3BD80743}, this HEX</p><p>code is unique to the Forcepoint installer and the</p><p>same for ALL versions, so every time you</p><p>download a newer version of Forcepoint, the</p><p>same folder will receive the extracted update.</p><p>You can later copy the extracted contents from</p><p>this location and move them to another server, if</p><p>you would like to save time in extracting the</p><p>contents.</p><p>Public © 2020 Forcepoint 279</p><p>Web Security Upgrades</p><p> Download each from</p><p>https://support.forcepoint.com/Downloa</p><p>ds</p><p> Always check for additional notes</p><p>• MD5 of executable is always added,</p><p>make sure to verify the integrity of</p><p>the downloaded file</p><p> Other installers for other OS’s will also</p><p>be found in this section, and any other</p><p>additional file not found on the compiled</p><p>installer (full installer).</p><p>18 > 19</p><p>On this example, we have an appliance running the Full Policy Source mode, this means</p><p>the Policy Broker service is running on this specific appliance. Always upgrade this</p><p>machine first. While running in this mode, you will also upgrade components running on this</p><p>appliance, components from the Web module, the Content Gateway module, the Network</p><p>Agent Module and if applicable or in Forcepoint terminology, if the Appliance Security Mode</p><p>is Dual-Mode meaning the Email Security component is also running, this update will also</p><p>upgrade this module at the same time.</p><p>After the upgrade has completed successfully on the main appliance, you then need to</p><p>upgrade the secondary appliances running in other modes, like for example User</p><p>Directory</p><p>and Filtering, which runs the Policy Server, User Service, Filtering Service on the</p><p>appliance. Also consider and similar as we explained before, this update will also upgrade</p><p>all components running on the appliance and the Email Security components as well if this</p><p>module is enabled.</p><p>Once the upgrade is complete on the previous services mentioned, upgrade the Security</p><p>Manager server and all other services running on this server. Lastly, upgrade the</p><p>Forcepoint Log Server. This will upgrade the Log DB, so expect a connection to SQL and</p><p>depending on the upgrade requirements, additional procedures executed against the Log</p><p>Database.</p><p>Public © 2020 Forcepoint 281</p><p>If Policy Source is running on the appliance, follow this procedure:</p><p> Always run a backup of all your systems to be upgraded</p><p> Communicate with your Network team for fail-open procedures while Proxies are down during the upgrade</p><p>process</p><p>4</p><p>Log Server</p><p>• Upgrading the Log Server</p><p>also updates the Log DB</p><p>hosted in Microsoft SQL</p><p>Server</p><p>Upgrading Web Security: Distributed Environment</p><p>1</p><p>Policy Source</p><p>Upgrade this Appliance first</p><p>This will upgrade all components</p><p>installed on the appliance</p><p>2</p><p>User Directory and Filtering</p><p>• This will upgrade all components</p><p>installed on the appliance</p><p>• If other appliances are running in</p><p>this mode in your network, upgrade</p><p>them too on this step</p><p>• In this step also consider appliances</p><p>running in Filtering Only mode</p><p>3</p><p>Security Manager Server</p><p>• Upgrade all components</p><p>running on this server</p><p>• This assumes Log</p><p>server is off this box</p><p>20 > 21</p><p>This example assumes no appliance is deployed on the network. Customer has provided</p><p>servers to install the Web Security components. In this example, you can see a Security</p><p>Manager with the Policy Broker running on-box, Web Security Policy Broker replicas, with</p><p>Web Security servers running other services.</p><p>As we have been mentioning, you would upgrade the Forcepoint Log Server last.</p><p>Public © 2020 Forcepoint 283</p><p>Upgrading Web Security: Software Install</p><p>Policy Source:</p><p> Always run a backup of all your systems to be upgraded</p><p> Communicate with your Network team for fail-open procedures while Proxies are down during the upgrade</p><p>process</p><p>1</p><p>Security Manager with Broker</p><p>• Upgrade all components</p><p>running on this server</p><p>• This assumes Log</p><p>server is off this box</p><p>4</p><p>Log Server</p><p>• Upgrading the</p><p>Log Server also</p><p>updates the</p><p>Log DB hosted</p><p>in Microsoft’s</p><p>SQL server</p><p>3</p><p>Web Security Servers</p><p>• Upgrade all components running</p><p>on this server</p><p>• This could include Policy Servers</p><p>Filtering Services, Network Agents</p><p>XID Agents, and other services</p><p>• This assumes Log</p><p>server is off this box</p><p>2</p><p>Web Security Policy Broker</p><p>Replicas</p><p>• Applies to Policy Broker</p><p>Replicas</p><p>• Upgrade all components</p><p>running</p><p>on this server</p><p>• This assumes Log server is off</p><p>this box</p><p>22 > 23</p><p>Perhaps, topics such as system health, logs and disaster recovery are key areas where</p><p>most administrators thrive. In this section, you will perform various tasks that include</p><p>verifying for service status, how to stop and start services and the correct way of doing so.</p><p>Logs, logs, and more logs, Web Security does a great job in writing verbose data into</p><p>individual logs and generates additional debugging data if needed.</p><p>Backing up our systems is imperative. You will learn how to properly back up all the</p><p>important systems in a Web Security deployment by following these activities.</p><p>Hands-on lab</p><p>4: System Health, Logs, and</p><p>Disaster Recovery</p><p>4.1 Verifying Status of Web Security</p><p>Services</p><p>4.2 Viewing Web Security Logs</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>24</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 25</p><p>Depending on the Web Security mode running on the appliance, you will see different</p><p>services enabled and their status. By default, services not used are disabled and shown</p><p>grayed out in the console.</p><p>1. Log on to the Appliance CLI, and then switch to config mode.</p><p>a. Using PuTTy, connect to 172.31.0.151.</p><p>b. Enter the following username and password:</p><p>Username: admin</p><p>Password: Forcepoint1!</p><p>c. Switch to config mode:</p><p># config</p><p>When prompted, enter Forcepoint1! as the password.</p><p>2. Enter the following command to display the Web Security status:</p><p># show web</p><p>All components should be enabled with their corresponding services running, as the</p><p>screenshot above shows.</p><p>Public © 2020 Forcepoint 288</p><p>4.1.1: Verify On-box Services</p><p>1. Access the Appliance CLI, and then</p><p>switch to config mode.</p><p>2. Enter the following command to display</p><p>the Web Security status:</p><p># show web</p><p>26 Status > Deployment</p><p>page, this is a smaller list. The WebsenseAdmin command only shows the Web Security</p><p>services. Additional commands can be used:</p><p>• start: Starts the Forcepoint Services if they are not already running.</p><p>• stop: Stops the Forcepoint Services if they are not already stopped.</p><p>• restart: Stops and then starts the Forcepoint Services.</p><p>• status: Displays the current operating status of the Forcepoint Services.</p><p>One of the advantages of using this tool is executing the action in the right order of turning</p><p>off or on all services.</p><p>TIP:</p><p>Additionally, you can start and stop services via Security Manager. This is more of a</p><p>manual process as you will need to stop/start individual services in the right order.</p><p>Public © 2020 Forcepoint 289</p><p>4.1.2: Verify Off-box Services</p><p>1. Log on back to the Security_Manager VM.</p><p>2. Using cmd.exe, do the following:</p><p>a. Change the directory to C:\Program Files (x86)\Websense\Web Security.</p><p>b. Run the following command:</p><p>WebsenseAdmin status</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 27</p><p>In this activity, you will learn the default Web Security logs on Windows.</p><p>Hands-on lab</p><p>4: System Health, Logs,</p><p>and Disaster Recovery</p><p>4.1 Verifying Status of Web Security</p><p>Services</p><p>4.2 Viewing Web Security Logs</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>28 .log</p><p>Where indicates the name of the Forcepoint service. For</p><p>example, WebsensePolicyServer.log only displays messages for the Policy Server</p><p>service.</p><p>2. Using Windows Explorer, go to %PROGRAMFILES(X86)%\Websense\Web</p><p>Security\ to view the installation logs.</p><p>File are compressed and use the following naming convention:</p><p>Log_MMDDYY_HHhMMmSSs.zip</p><p>MMDDYY_HHhMMmSSs is the timestamp of when the installer was executed.</p><p>When a *.zip file is opened, a collection of logs created during the installation of the</p><p>Forcepoint suite of specific services will be seen.</p><p>IMPORTANT:</p><p>Installation logs are very useful when tracing an issue with components failing installation or</p><p>external components causing Forcepoint services to be install unsuccessfully. These logs</p><p>provide accurate verbose information of each action taken by the Forcepoint installer.</p><p>Aside from the logs related to Forcepoint services and installation, take note of the following</p><p>other log types:</p><p>• %PROGRAMFILES(X86)%\Websense\EIP Infra\Logs: Forcepoint Management</p><p>Infrastructure logs</p><p>• %PROGRAMFILES(X86)%\Websense\EIP Infra\Tomcat\Logs: Tomcat-specific logs</p><p>Public © 2020 Forcepoint 291</p><p>4.2: View Web Security Logs</p><p>1. Go to %PROGRAMFILES(X86)%\Websense\Web Security\bin and sort the files according to type.</p><p>2. Go to %PROGRAMFILES(X86)%\Websense\Web Security\ to view the installation logs.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 29</p><p>Hands-on lab</p><p>4: System Health, Logs,</p><p>and Disaster Recovery</p><p>4.1 Verifying Status of Web Security</p><p>Services</p><p>4.2 Viewing Web Security Logs</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>30 Administrative Tools > Services.</p><p>b. Right click the Websense Log Server and click Stop Service.</p><p>2. Log on to Security Manager, navigate to Web > Settings > General > Logging, and</p><p>then verify that the Log Server IP address or name is set to the IP address of the</p><p>Security_Manager host (172.31.0.155) and uses the correct port (55805).</p><p>3. On the Security_Manager Desktop, click Start > Command Prompt to run the</p><p>commands below.</p><p>• If you are still running the testlogserver in a command prompt window from a</p><p>previous lab activity, stop it now by using the CTRL+C key combination.</p><p>• cd \Program Files (x86)\Websense\Web Security\bin</p><p>testlogserver</p><p>The system is now accepting connection on TCP port 55805, as shown in the</p><p>screenshot above.</p><p>Public © 2020 Forcepoint 293</p><p>4.3.1: Verify System Functionality using CLI and Testing Tools</p><p>1. Accessing the Security_Manager VM, stop the Websense Log Server service.</p><p>2. Using Security Manager, verify that the Log Server IP address or name is 172.31.0.155 and the port</p><p>number set is 55805.</p><p>3. Make sure that any previous instances testlogserver of is stopped, and then run bin</p><p>testlogserver.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 31</p><p>4. Log on to the Windows_test_client VM using the JLondon account.</p><p>a. Verify that the web browser is configured with explicit proxy server settings pointing</p><p>to 172.31.0.152 or webva-1-wcg.fpcert.com on port 8080 for both HTTP and Secure</p><p>traffic.</p><p>b. Navigate to https://www.cnn.com.</p><p>5. On the Security_Manager VM, return to the Command Prompt window.</p><p>a. Observe the stream of data.</p><p>Your window should have several entries similar to the screenshot above.</p><p>b. Stop testlogserver by pressing CTRL + C.</p><p>c. Type the following command:</p><p>testlogserver > C:\TestLogCapture.txt</p><p>This will save the information into a *.txt file. The file path can be anywhere</p><p>accessible and writable. This command will not display the data on the screen.</p><p>Use the –file switch to save in a text file (including the content).</p><p>For example:</p><p>testlogserver –file C:\TestLogCapture.txt</p><p>Public © 2020 Forcepoint 294</p><p>(cont.) 4.3.1: Verify System Functionality using CLI and Testing Tools</p><p>4. On Windows_test_client, log on as</p><p>JLondon and</p><p>navigate to www.cnn.com</p><p>using a browser with the</p><p>explicit proxy server settings</p><p>enabled.</p><p>5. Observe the stream of data.</p><p>32</p><p>the next step after a</p><p>few sites are sent to the proxy server.</p><p>Stop the testlogserver by pressing CTRL+C.</p><p>e. Open the file C:\logfile.txt in Notepad.</p><p>Scroll down to the end of the file and note how the system logs information per</p><p>request, and how each object from a Web page is a separate HTTP request with its</p><p>own set of information:</p><p>• Time</p><p>• Source and destination IP addresses</p><p>• Category</p><p>• User credentials (requires authentication to be enabled)</p><p>• Bytes received</p><p>• Bytes sent</p><p>• [...]</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 33</p><p>1. Access the Security_Manager VM, and then go to</p><p>%PROGRAMFILES(X86)%\Websense\Web Security\bin to locate and run</p><p>DiagClient.bat.</p><p>Alternatively, if you prefer CLI, launch the Diagnostics Tool via DOS, and then change</p><p>the directory to %PROGRAMFILES(X86)%\Websense\Web Security\bin and run</p><p>DiagClient.bat.</p><p>Once executed, the batch file will open a DOS window that launches the Forcepoint</p><p>Visual Diagnostic Tool (a.k.a. Diagnostic Tool). The DOS window will remain open in</p><p>the background. Closing the DOS window will stop the Diagnostics Tool process.</p><p>Verify that the Diagnostic Tool has opened successfully similar to the screenshot above.</p><p>The Diagnostics Tool is Java based. Ensure that a version of Java is installed on the</p><p>server where the tool is running.</p><p>2. Connect to a diagnostic source by clicking File > Connect to a Diagnostic Source.</p><p>3. Connect to a local host and click SCAN FOR PROCESSES.</p><p>The tool checks for Forcepoint processes running on the server. It takes a few seconds</p><p>to load a complete list of running services.</p><p>Public © 2020 Forcepoint 295</p><p>4.3.2: Verify System Functionality using Visual Diagnostics Tool</p><p>1. Access the Security_Manager VM, and go to %PROGRAMFILES(X86)%\Websense\Web</p><p>Security\bin to locate and run DiagClient.bat.</p><p>2. Connect to a diagnostic source.</p><p>3. Connect to a local host and</p><p>click SCAN FOR PROCESSES.</p><p>34 .</p><p>The Forcepoint Policy Server diagnostic options appear.</p><p>5. Click the collapse icon to display the options for the Inspector section, select</p><p>ServerManager, right click details, and then click Inspect.</p><p>The Inspector tab appears. Clicking Inspector displays an output similar to the</p><p>screenshot above.</p><p>Reviewing your output, notice the service and server specific information listed. Every</p><p>section presents a unique set of data. This activity allows you to be familiar with the</p><p>potential of the Forcepoint Visual Diagnostics Tool.</p><p>Public © 2020 Forcepoint 296</p><p>(cont.) 4.3.2: Verify System Functionality using Visual Diagnostics Tool</p><p>4. In the Connect to Processes dropdown list, select a Websense Policy Server.</p><p>For example:</p><p>5. Click the collapse icon ( ) to inspect the Server Manager</p><p>output.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 35</p><p>As an administrator who manages a system on a day-to-day basis, this section This section</p><p>covers the following topics:</p><p>• Differences between major and minor disasters</p><p>• Why minor disasters are bigger problems</p><p>• How to prepare and survive minor disasters</p><p>Disaster Recovery</p><p>36 > 37</p><p>A minor disaster requires better planning time than a major disaster does because of the</p><p>following reasons:</p><p>One of the worst-case scenarios is a storage system supporting your virtual infrastructure</p><p>fails for some reason. You can explain to a user that your datacenter is gone but it’s hard to</p><p>explain that your storage system has a firmware update problem. There is less grace;</p><p>users/customers are less understanding of these situations. They give less patience. Most</p><p>minor disasters can cause damage to a company’s reputation, and certainly to the IT’s</p><p>reputation within that company.</p><p>• User expectations are higher</p><p>• Users are less tolerant</p><p>• Minor disasters have less exposure to the user—they have little or no background</p><p>information about the event and why it is happening</p><p>38</p><p>areas:</p><p>protection,</p><p>cloud services,</p><p>communication</p><p>servers and</p><p>others.</p><p>Testing</p><p>• Is backup and</p><p>recovery</p><p>sufficient?</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 39</p><p>As discussed in Module 1 > Deployment Overview, every Forcepoint web protection</p><p>deployment must include a policy source. This is an appliance or other server that hosts at</p><p>least two components:</p><p>• Forcepoint Policy Broker</p><p>• Forcepoint Policy Database (Policy Server must also be present; additional components</p><p>are often installed)</p><p>When Policy Broker replication is enabled in an appliance source, if the primary Policy</p><p>Broker machine fails, all components connect to replica Policy Broker instances and</p><p>continue to run normally, using the read-only configuration and policy data stored by the</p><p>replica.</p><p>A Forcepoint appliance that is not serving as the policy source can be designated to run</p><p>either in User directory and filtering or Filtering only mode. These appliances can continue</p><p>filtering for as long as 14 days if their connection with the policy source machine is</p><p>interrupted. So even if a network connection is poor or is lost, filtering continues as</p><p>expected.</p><p>As for Content Gateway or Filtering Service, every request that Content Gateway sends to</p><p>Filtering Service must be completed within the communication timeout period. If it is not, the</p><p>request is either permitted or blocked based on the Action for Communication Errors</p><p>setting on the Configure > My Proxy > Subscription > Scanning page. When a</p><p>communication timeout occurs, a dedicated monitor process continues to test the</p><p>connection. If it fails five consecutive times, Filtering Service is marked down, and the</p><p>communication errors setting is applied until the monitor process detects that Filtering</p><p>Service is responding.</p><p>Public © 2020 Forcepoint 302</p><p>Will traffic still flow if Web Security components go down?</p><p>40 > 41</p><p>Two types of backup are available on Forcepoint appliances:</p><p>• Full appliance configuration backup: saves the appliance controller and all installed</p><p>modules.</p><p>Forcepoint recommends running a full backup on every appliance in your network on a</p><p>regular basis. Note that the full backup file may be smaller than the module backup files,</p><p>because of the compression used.</p><p>• Module configuration backup: saves configuration information for the Web module.</p><p>This includes any client and policy data stored on the selected appliance.</p><p>Web module backups include only data in the Web container. Neither the Network Agent or</p><p>Content Gateway modules are included.</p><p>Separate Content Gateway backups can be performed in the Content Gateway manager.</p><p>To include all modules, perform a full appliance backup.</p><p>Public © 2020 Forcepoint 304</p><p>Appliance Backup: Backup Options</p><p>Option 1:</p><p>Two backup options in V Series Appliances</p><p>Option 2:</p><p>Appliance CLI</p><p>• Local Backup</p><p>• Full Backup</p><p>• Web Security</p><p>• Can be scheduled</p><p>• Remote</p><p>• Full Backup</p><p>• Web Security</p><p>• Can be scheduled</p><p># create backup schedule</p><p>42 Task Scheduler Library list, which executes C:</p><p>\Program Files (x86)\Websense\EIP Infra\EIPBackup.vbs.</p><p>An EIPBackup directory is created on the first time the Windows backup task runs Inside this</p><p>folder are the different backups sorted by time stamps.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 43</p><p>Public © 2020 Forcepoint 307</p><p>Web Security: Backup Mechanism</p><p> PGSetup</p><p>• Saves a copy of the Policy Database and client</p><p>objects</p><p>• Only runs on Policy Broker machines</p><p>• Runs via DOS command line:</p><p>PgSetup -- save FileName.db</p><p>PgSetup -- save</p><p>\\Server\Directory\File_Path\</p><p> WSBackup</p><p>• Saves a copy of all configuration files and folders</p><p>needed to restore a Web Security installation</p><p>• Can be scheduled</p><p>• Exports two files:</p><p> Backup configuration parameters</p><p> Compressed file with all files backed up in</p><p>.tar.gz format</p><p>Using WSBackup</p><p>The Forcepoint Backup Utility helps you to back up your Web Security settings and policy</p><p>data, and to revert to a previous configuration.</p><p>Windows syntax:</p><p>wsbackup -b -d</p><p>To schedule a backup:</p><p>wsbackup -s -t " " -d</p><p>Linux syntax:</p><p>/wsbackup -b -d</p><p>Make sure to export libraries:</p><p>export LD_LIBRARY_PATH=</p><p>To schedule a backup:</p><p>./wsbackup -b -s -t \"</p><p>\" -d</p><p>44 > 45</p><p>When you initiate the restore process, all current settings for the appliance or module are</p><p>erased. Backup files stored on the appliance are not affected.</p><p>When a restore completes, an appliance automatically restarts.</p><p>When you restore a full appliance configuration:</p><p>• The current appliance version must match the version associated with the backup file.</p><p>Thus, a version 8.5 backup can be restored only on an appliance that is at version 8.5.</p><p>• The hardware model of the current appliance must be the same as the model that was</p><p>backed up.</p><p>For example, a backup from model V10000 G4 must be used to restore a model V10000</p><p>G4.</p><p>• The current appliance mode (Forcepoint Email Security, Forcepoint Web Security, or</p><p>Forcepoint URL Filtering) must match that of the backup file.</p><p>For example, a backup from a Web appliance must be used to restore a Web appliance.</p><p>• The current appliance policy source mode (Full policy source, User directory and</p><p>filtering, or Filtering only) must match the policy source mode in effect when the backup</p><p>file was created.</p><p>User directory and filtering and Filtering only appliances must have retained the same</p><p>policy-source IP address that was captured in the backup.</p><p>• The original appliance that was backed up cannot also be running elsewhere in the</p><p>network.</p><p>Restoring a full configuration recreates the original appliance and makes use of unique</p><p>ID numbers from that appliance.</p><p>Public © 2020 Forcepoint 310</p><p>Appliance Restore</p><p>Two restore options available in V-Series appliances:</p><p> Option 1:  Option 2:</p><p>Appliance CLI</p><p>• Restore from Local</p><p>Backup</p><p>• Full Appliance</p><p>• Web Security</p><p>• Restore from Remote</p><p>Server</p><p>• Full Appliance</p><p>• Web Security configuration</p><p># restore</p><p>backup</p><p>46</p><p>Restore</p><p> Use the Forcepoint Security Setup > Use</p><p>Backup data option</p><p> Running this tool will overwrite</p><p>any existing configuration</p><p>Performing system restores in Web Security is an easy process. With Security Manager</p><p>and commands to restore different configurations, Web Security provides administrators</p><p>with several options to enable you to restore Web Security efficiently in an event when a</p><p>disaster occurs.</p><p>However, as easy as the process may seem, keep the following points in mind when you</p><p>are getting ready to restore an existing Forcepoint Management Infrastructure or Web</p><p>Security configuration from backup:</p><p>• When you restore a previous management infrastructure configuration, use a web</p><p>protection backup file created in the same time period to restore configuration</p><p>information for your web protection components.</p><p>• If you are restoring both management and web protection components, do not restart the</p><p>management components (listed below) until after the web protection component restore</p><p>process is complete.</p><p>• Before restoring a previous web protection configuration (for example, on the Policy</p><p>Broker machine or full policy source appliance), stop the following Forcepoint Security</p><p>Manager and reporting services:</p><p>• Before restoring a management infrastructure configuration, stop the following services:</p><p>• If administrators receive a browser 404 error when they attempt to log on to the Security</p><p>Manager after a restore process is complete, use the Windows Services tool to restart</p><p>the Websense TRITON Unified Security Center service.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 47</p><p>When you restore your Web Security configuration, make sure that you are restoring data</p><p>for the components that exist on the current machine.</p><p>If the machine was rebuilt after, for example, a serious hardware failure, make sure that you</p><p>have installed only the components that previously resided on the machine. The backup</p><p>process can only restore configuration information for components that were present on the</p><p>machine when the backup file was created.</p><p>Also, remember that cross-platform backup and restore (from Windows to Linux, for</p><p>example) is not supported.</p><p>Public © 2020 Forcepoint 312</p><p>Web Security Restore</p><p> WsBackup</p><p>• Restores configuration of previously installed components</p><p>• Cross-platform restore is not supported</p><p>• Syntax:</p><p>Wsbackup –r (Restore flag) –f (directory and file name of restore file)</p><p> PgSetup</p><p>• PgSetup --restore FileName.db</p><p>48 > 49</p><p>As a best practice, run the backup process on all machines with web protection</p><p>components within a 30-minute time window. This may include:</p><p>• Forcepoint appliances</p><p>• Content Gateway</p><p>• Forcepoint management server, including the management infrastructure</p><p>Hands-on lab</p><p>4: System Health, Logs,</p><p>and Disaster Recovery</p><p>4.1 Verifying Status of Web Security</p><p>Services</p><p>4.2 Viewing Web Security Logs</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>50 path in C:\Program Files (x86)\Websense\EIP</p><p>Infra\EIPBackup.xml to C:\TRITONBackups\.</p><p>This file is viewable using any text editor. However, use Notepad++ to avoid</p><p>modifying the code structure.</p><p>If the backup path is not modified, the task will automatically create a backup folder</p><p>under C:\. Additional variables can be modified when needed.</p><p>3. Go back to Task Scheduler, right click the task, and select Run.</p><p>Alternatively, click Run on the right-pane menu.</p><p>Once the task completes, a new EIPBackup folder in the directory you specified is created.</p><p>The backups are created in a separate folder using the following naming convention:</p><p>MMDDYYHHMMSS</p><p>You can use the backup files as a restore point if a restore is needed.</p><p>NOTE:</p><p>These files do not contain settings for other components, only for Security Manager.</p><p>Public © 2020 Forcepoint 316</p><p>4.4.1: Use the Security Manager (Management Infrastructure) Backup</p><p>1. While accessing the Security_Manager VM, go to Windows Server Administrative Tools > Task</p><p>Scheduler.</p><p>2. Enable the Websense TRITON Backup task.</p><p>3. Run Websense TRITON Backup.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 51</p><p>NOTE: To back up Web Security settings, run their respective backup tasks.</p><p>Backing up Web Security is a different from Security Manager as interaction with the</p><p>command line interface (CLI) is required. After learning how to back up Web Security, you</p><p>can apply basic Windows scripting knowledge to automate this process.</p><p>Access the Security_Manager VM, open Command Prompt and run the following</p><p>commands to save a backup in C:\web_backups\:</p><p>cd C:\Program Files (x86)\Websense\Web Security\bin</p><p>wsbackup –b –d C:\web_backups</p><p>The wsbackup command executes the backup process.</p><p>The message “Starting New Diagnostics” appears. A blinking cursor indicates that the</p><p>backup process is running. Once “Starting New Diagnostics” and the blinking cursor</p><p>disappear, the backup process has successfully completed.</p><p>The backup process saves the following files:</p><p>• WebsenseBackup.cfg</p><p>• Wsbackup_2015-07-23_123228.tar.gz</p><p>The files are in a tar.gz compressed format. Use 7zip, which is installed on the lab</p><p>machines, to extract files. When restoring these files, you need to restore the .tar.gz file</p><p>NOT the files you would manually extract using an extraction utility.</p><p>Public © 2020 Forcepoint 317</p><p>4.4.2: Back up Web Security</p><p>Access the Security_Manager VM, and then run the following commands:</p><p> cd C:\Program Files (x86)\Websense\Web Security\bin</p><p> wsbackup –b –d C:\web_backups</p><p>The following files are generated:</p><p>52 " -d</p><p>• Linux:</p><p>wsbackup -b -s -t \"</p><p>\" -d</p><p>• Specify a numeric value for the KeepDays parameter, which sets the number of days</p><p>archive files remain in the backup directory (365, by default).</p><p>When a file is older than the specified time period, it is deleted automatically.</p><p>• Specify a numeric value for the KeepDays parameter, which sets the maximum number of</p><p>bytes allotted for backup files (10857600, by default).</p><p>When the backup directory reaches the specified size limit, the oldest backup file is</p><p>deleted automatically.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 53</p><p>As a best practice, run appliance backups after office hours or during periods when network</p><p>bandwidth demand is low.</p><p>1. While connecting to the Security_Manager</p><p>VM, log on to the Appliance CLI, and then</p><p>switch to config mode.</p><p>a. Using PuTTy, connect to 172.31.0.151.</p><p>b. Enter the following username and password:</p><p>Username: admin</p><p>Password: Forcepoint1!</p><p>c. Switch to config mode :</p><p># config</p><p>When prompted, enter Forcepoint1! as the password.</p><p>2. Run the following commands:</p><p>• To create a local backup (on-demand):</p><p># create backup now --location local --type full</p><p>• To schedule a backup every 28th of the month at 11:59 PM:</p><p># create backup schedule --freq monthly</p><p>--location local --type full</p><p>--date 28 --time 23:59</p><p>• To confirm that the on-demand backup is created and already running:</p><p># show backup list --location local</p><p>• To confirm that the scheduled backup is set:</p><p># show backup schedule</p><p>Public © 2020 Forcepoint 318</p><p>4.4.3: Back up an Appliance</p><p>1. Access the Appliance CLI, and then switch to config mode.</p><p>2. Run the following commands:</p><p>• To perform an immediate backup on the appliance:</p><p># create backup now</p><p>--location local</p><p>--type full</p><p>-–description “sample appliance backup”</p><p>• To create a monthly backup:</p><p>NOTE: Set your own schedule by substituting the value of your choice for the date and time parameters.</p><p>create backup schedule --type full</p><p>--location local</p><p>--freq monthly</p><p>--date</p><p>--time</p><p>• To display a list of available appliance backup:</p><p># show backup list --location local</p><p>• To display the available scheduled appliance backup</p><p># show backup schedule</p><p>54 My Proxy > Snapshots > File System tab.</p><p>2. Use the Change Snapshot Directory field to find or edit the local directory for storing</p><p>configuration snapshots (config/snapshots, by default).</p><p>Relative paths are created in the Content Gateway config directory. To create a</p><p>snapshot directory in another location, use the full path.</p><p>3. In the Save Snapshot field, type the name you want to use for the current</p><p>configuration.</p><p>4. Click Apply.</p><p>Public © 2020 Forcepoint 319</p><p>4.4.4: Back up Content Gateway</p><p>1. Access Content Gateway Manager, and then go to the Configure > My Proxy > Snapshots > File</p><p>System tab.</p><p>2. Find or edit the local directory for storing the Content Gateway backup.</p><p>3. Specify a name for the backup file.</p><p>4. Click Apply.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 55</p><p>Hands-on lab</p><p>4: System Health, Logs,</p><p>and Disaster Recovery</p><p>4.1 Verifying Status of Web Security</p><p>Services</p><p>4.2 Viewing Web Security Logs</p><p>4.3 Verifying system functionality</p><p>using CLI and Testing Tools</p><p>4.4 Recovering from a Disaster</p><p>4.5 Restoring Web Security Backups</p><p>56 All Programs ></p><p>Websense to open the Forcepoint TRITON Setup and then click Modify.</p><p>2. Click Next three times.</p><p>The Restore Data from Backup screen appears.</p><p>3. Select Use backup data, browse for the backup file, and then click Next.</p><p>NOTE: C:\web_backups\EIPBackup is the backup folder for the lab environment.</p><p>The Restoring Data process starts.</p><p>Public © 2020 Forcepoint 321</p><p>4.5.1: Restore Security Manager</p><p>1. In Security_Manager, click the Forcepoint</p><p>Security Setup launcher ( ) on the</p><p>Windows Taskbar, and then click Modify.</p><p>2. Click Next three times to display</p><p>the Restore Data from Backup screen.</p><p>3. Select Use backup data, browse for</p><p>the backup file, and then click Next.</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 57</p><p>In the Security_Manager VM, open Command Prompt and run the following commands to</p><p>initiate the restore process.</p><p>• cd C:\Program Files (x86)\Websense\Web Security\bin</p><p>• wsbackup -r -f C:\web_backups\YOUR_Backup_File</p><p>See sample screenshots above.</p><p>A blinking cursor indicates that the restoration process is running. Once the blinking cursor</p><p>disappears, the restoration process has successfully completed.</p><p>Public © 2020 Forcepoint 322</p><p>4.5.2: Restore Web Security</p><p>In Security_Manager, run the following commands:</p><p>The restore process may take several minutes. Do not stop the process while restoration is underway.</p><p>58</p><p>3. Run the following command to restore a backup:</p><p># restore backup --location</p><p>Wait for the process to complete, which usually takes about 15-20 minutes.</p><p>Public © 2020 Forcepoint 323</p><p>4.5.3: Restore an Appliance</p><p>1. Access the Appliance CLI in config mode.</p><p>2. Make sure that an appliance backup is ready.</p><p># show backup list --location</p><p>3. Restore the backup.</p><p># restore backup --location</p><p>Forcepoint Web Security Administrator Course (Module 4) >> 59</p><p>1. While connecting to the Security_Manager VM, launch Content Gateway Manager,</p><p>and then navigate to the Configure > My Proxy > Snapshots > File System tab.</p><p>2. Use the Restore/Delete Snapshot drop-down list to select the configuration snapshot</p><p>that you want to restore.</p><p>3. Mark the Restore Snapshot from “snapshots” Directory box.</p><p>4. Click Apply.</p><p>The Content Gateway system or cluster uses the restored configuration.</p><p>Public © 2020 Forcepoint 324</p><p>4.5.4: Restore Content Gateway</p><p>1. Access Content Gateway Manager, and go to the Configure > Snapshots > File System tab.</p><p>2. Select the backup that you want to restore.</p><p>3. Mark the Restore Snapshot from</p><p>“snapshots” Directory box.</p><p>4. Click Apply.</p><p>60 > 61</p><p>Public © 2020 Forcepoint 328</p><p>You should now be able to:</p><p> Access, find, and modify key user interface options to accomplish administrative tasks.</p><p> Customize and manage Web Security policies to meet your organization’s filtering needs.</p><p> Extend and combine available reporting options to gain actionable insights related to Web</p><p>Security detections.</p><p> Leverage Web Security configuration options and available tools to respond to incidents.</p><p>Web Security Administrator course objectives</p><p>62 > 63</p><p>Public © 2020 Forcepoint 329</p><p>Post-class Task (2 of 2):</p><p>Taking the certification exam and printing the certificate</p><p>To take the certification exam and print certificate:</p><p>1. Log on to Forcepoint Cyber Institute (https://learn.forcepoint.com/).</p><p>2. Go to your Course Map, then click the Certified Forcepoint Web Security</p><p>Administrator (Multiple-Choice Test) link under CERTIFICATION EXAM > Multiple-</p><p>Choice Test.</p><p>3. Click the Start Test</p><p>button.</p><p>NOTE:</p><p>The passing percentage is 80% or more.</p><p>4. After passing the exam, you may opt to print a copy of your course</p><p>certificate, which is available in your FCI Transcript.</p><p>64 > 65</p><p>Cover</p><p>Copyright</p><p>Table of Contents</p><p>Module 4:</p><p>Disaster Response and Recovery</p><p>Module Objectives</p><p>Module Agenda</p><p>Incident Response</p><p>System Health</p><p>Updates and Upgrades</p><p>Module 4 Lab Introduction</p><p>Lab 4.1: Verifying Status of Web Security Services</p><p>Lab 4.2: Viewing Web Security Logs</p><p>Lab 4.3: Verifying System Functionality using CLI and Testing Tools</p><p>Disaster Recovery</p><p>Lab 4.4: Recovering from a Disaster</p><p>Lab 4.5: Restoring Web Security Backups</p><p>Module Summary</p><p>Course Summary</p><p>Post-class Tasks</p><p>Filling out the course evaluation</p><p>Taking the certification exam and printing the certificate</p>